34 Commits

Author SHA1 Message Date
Yi Zhao 83788ca34d scap-security-guide: upgrade 0.1.73 -> 0.1.74
ChangeLog:
https://github.com/ComplianceAsCode/content/releases/tag/v0.1.74

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-08-20 13:03:46 -04:00
Yi Zhao f6bb41ca4a openscap: upgrade 1.3.10 -> 1.4.0
ChangeLog:
https://github.com/OpenSCAP/openscap/releases/tag/1.4.0

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-08-20 13:03:42 -04:00
Armin Kuster ca10975033 recipes-*: convert WORKDIR->UNPACKDIR
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-07-29 20:07:01 -04:00
Yi Zhao 61f2428158 openscap: fix PACKAGECONFIG[remediate_service]
* Fix typo: remdediate_service -> remediate_service
* No need to manually install oscap-remediate.service, as it is already
  installed when ENABLE_OSCAP_REMEDIATE_SERVICE=ON is set.
* Add a patch to fix installation directory for systemd service file.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-07-01 07:07:58 -04:00
Changqing Li b4a8bc606f scap-security-guide: WORKDIR -> UNPACKDIR
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-06-17 08:25:25 -04:00
Yi Zhao 651767d028 scap-security-guide: upgrade 0.1.72 -> 0.1.73
ChangeLog:
https://github.com/ComplianceAsCode/content/releases/tag/v0.1.73

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-06-17 08:25:25 -04:00
Yi Zhao 063a629ac2 scap-security-guide: upgrade 0.1.71 -> 0.1.72
ChangeLog:
https://github.com/ComplianceAsCode/content/releases/tag/v0.1.72

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-05-08 22:04:13 -04:00
Yi Zhao fca6068f2a openscap: upgrade 1.3.9 -> 1.3.10
ChangeLog:
https://github.com/OpenSCAP/openscap/releases/tag/1.3.10

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-05-08 22:03:43 -04:00
Yi Zhao 7346f5996c scap-security-guide: remove __pycache__ in ptest directory
Remove __pycache__ directories as they contain references to TMPDIR.

Fix QA warnings:
WARNING: scap-security-guide-0.1.71-r0 do_package_qa: QA Issue: File
/usr/lib64/scap-security-guide/ptest/git/utils/_pycache_/gen_reference_table.cpython-312.pyc
in package scap-security-guide-ptest contains reference to TMPDIR

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-05-08 22:02:48 -04:00
Wang Mingyu 93239b90ac lynis: upgrade 3.0.9 -> 3.1.1
0001-osdetection-add-OpenEmbedded-and-Poky.patch
removed since it's included in 3.1.1.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-04-22 07:51:05 -04:00
Armin Kuster 60021acffb openscap: update to tip to fix new build issue.
drop patch now included.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-03-27 12:36:58 -04:00
BELOUARGA Mohamed 30e755c592 lynis: Add missing runtime dependencies
Lynis tool needs ip, ss, tr and netstat.
If they are missing Lynis skips some important audit tests.

Signed-off-by: BELOUARGA Mohamed <m.belouarga@technologyandstrategy.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-02-20 07:40:39 -05:00
Yi Zhao 6f7f2b6b47 openscap: fix build with python 3.12
Backport a patch to fix build with python 3.12:
$ bitbake openscap-native
Traceback (most recent call last):
  File "<string>", line 1, in <module>
ModuleNotFoundError: No module named 'distutils'
CMake Error at swig/python3/CMakeLists.txt:35 (install):
  install TARGETS given no LIBRARY DESTINATION for module target
  "_openscap_py".

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-02-20 07:40:39 -05:00
Armin Kuster 3791852532 scap-security-guide: update to 0.1.71
change branch name to stable.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-01-28 12:13:54 -05:00
Armin Kuster a0731b7b3c lynis: Update SRC_URI to improve updater
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-29 09:09:30 -05:00
Armin Kuster aca6d4a9e7 scap-security-guide: Drop Poky patch and update to tip
The Poky patch has been accepted.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-25 09:47:15 -04:00
Armin Kuster c3c84aef49 lynis: Update to 3.0.9
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-25 09:45:46 -04:00
Armin Kuster 0d47c43dce openscap: update to 1.3.9
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-25 09:45:11 -04:00
Armin Kuster 8a91e5e9d1 scap-security-guide: update to 0.1.69+
Update to tip of branch

Drop 0001-scap-security-guide-add-openembedded-distro-support.patch is now included in tip

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-08 12:06:31 -04:00
Yi Zhao 533da3cd2b scap-security-guide: pass the correct cpe/schemas/xsl paths to oscap
There is a build error when using openscap-native sstate cache mirror.
Steps to reproduce:
Create a new build project in build-1 directory.
$ bitbake openscap-native

Then remove all directories in build-1 directory except sstate-cache.
Use the sstate-cache directory as sstate mirror.

Create another new build project in build-2 directory.
Set SSATE_MIRRORS to point to the sstate-cache in build-1 directory.
$ bitbake scap-security-guide

Error message:
OpenSCAP Error: Schema file 'sds/1.3/scap-source-data-stream_1.3.xsd' not found in path
'/build-1/tmp-glibc/work-shared/openscap/oscap-build-artifacts/usr/share/openscap/schemas' when trying to validate
'/build-2/tmp-glibc/work/corei7-64-wrs-linux/scap-security-guide/0.1.67/build/ssg-openembedded-ds.xml'
[/build-1/tmp-glibc/work/x86_64-linux/openscap-native/1.3.8/git/src/source/validate.c:103]

The oscap command from openscap-native tries to find the schema files in
build-1 directory since these paths are hardcoded when building
openscap-native.

We need to pass the correct cpe/schemas/xsl paths to oscap to make sure
it can find the files in right location.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-08 12:06:31 -04:00
Armin Kuster 1ca654ef4f scap-security-guide: enable ptest
This add the basic framework to allow the test suite to run. It takes a very long time
so it my not be practical to run in some cases (days in my case).

The ptest log format has not been verified.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-31 06:18:52 -04:00
Kai Kang ef184ce03a openscap: fix buildpaths issue
Variables PREFERRED_PYTHON_PATH and PYTHON3_PATH are set with
${PYTHON_EXECUTABLE}. For cross compile, ${PYTHON_EXECUTABLE} may point
to other path rather than standard dir such as /usr/bin. Then the
generated library file contains such path which should NOT. Update to
make variables PREFERRED_PYTHON_PATH and PYTHON3_PATH configurable to
fix buildpaths issue:

| WARNING: openscap-1.3.7-r0 do_package_qa: QA Issue: File
| /usr/lib/libopenscap.so.25.5.1 in package openscap contains reference
| to TMPDIR [buildpaths]

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-31 06:18:52 -04:00
Armin Kuster 64b8f9b68e scap-security-guide: refactor patches
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-31 06:18:52 -04:00
Martin Jansa df8a1eb479 *.patch: fix malformed Upstream-Status and SOB lines
* as reported by openembedded-core/scripts/contrib/patchreview.py -v .

Malformed Signed-off-by 'Signed-Off-By:' (./recipes-mac/AppArmor/files/crosscompile_perl_bindings.patch)
Malformed Signed-off-by 'Signed-Off-By:' (./recipes-mac/AppArmor/files/disable_perl_h_check.patch)

Missing Upstream-Status tag (./recipes-compliance/scap-security-guide/files/0001-standard.profile-expand-checks.patch)

Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-ids/samhain/files/samhain-not-run-ptest-on-host.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-ids/samhain/files/samhain-pid-path.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-ids/suricata/files/fixup.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-scanners/clamav/files/fix2_libcurl_check.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/isic/files/configure_fix.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/krill/files/panic_workaround.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/opendnssec/files/libdns_conf_fix.patch
Malformed Upstream-Status 'Malformed Upstream-Status in patch ./recipes-security/opendnssec/files/libxml2_conf.patch

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-25 15:05:28 -04:00
Armin Kuster 1fa205aedf openscap: update to 1.3.8
Remediate service is now off by default. Only include if needed.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-25 15:05:28 -04:00
Armin Kuster 6cf7d71885 scap-security-guide: Does not build for musl
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-25 15:05:28 -04:00
Armin Kuster 965dee3282 scap-security-guide: add Upstream-Status
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-25 15:05:28 -04:00
Armin Kuster 53c6324c5f scap-security-guide: Add Poky
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-25 15:05:28 -04:00
Armin Kuster 2b052a6165 scap-security-guide: bump the number of test that pass
Add a eval script.
Lets see how many checks pass out of the box

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-25 15:05:28 -04:00
Armin Kuster 4dc2b52027 openscap: Update to tip to get OE/Poky support
Drop changes now in upstream.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-25 15:05:28 -04:00
Armin Kuster c4c7592dcb scap-security-guide: add OE support
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-20 11:07:20 -04:00
Armin Kuster 49de76c980 openscap: add support for OpenEmbedded nodistro and Poky
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-20 11:07:20 -04:00
Armin Kuster 4bfd29a330 openscap: move to main meta-security layer
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-20 11:07:20 -04:00
Armin Kuster 666a0c6ccf lynis: move to main meta-security layer
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-20 11:07:20 -04:00