944 Commits

Author SHA1 Message Date
Armin Kuster
3ce8b759c9 suricata: update to 4.1.9
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10 16:21:48 -07:00
Armin Kuster
496a734c14 packagegroup-core-security: remove clamav from musl image
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10 16:21:48 -07:00
Armin Kuster
c0e801f1e0 sssd: update to latest ltm 1.16.5
fix musl support

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10 16:21:48 -07:00
Armin Kuster
7578a8b2ed libest: fix musl build.
fixes
 est.c:38:10: fatal error: execinfo.h: No such file or directory
|    38 | #include <execinfo.h>
|       |          ^~~~~~~~~~~~

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10 16:21:48 -07:00
Armin Kuster
b3f10d2285 ecryptfs-utils: fix musl build
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10 16:21:48 -07:00
Armin Kuster
11dd919372 apparmor: fix build for on musl
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10 16:21:31 -07:00
Armin Kuster
c5b5737ef3 qemux86-test: add apparmor back
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10 16:21:31 -07:00
Armin Kuster
d3aff039c9 suricata: fix compiling on gcc10
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09 07:02:01 -07:00
Armin Kuster
8bab022533 packagegroup-core-security: apparmor 3.0 ptest does not build
for now skip apparmor ptest

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09 07:02:01 -07:00
Armin Kuster
b8c437bf70 apparmor: update to 3.0
skip ptest for now, on todo list for fix.
Runtime test pass

remove patch now included in update: 0001-regression-tests-Don-t-build-syscall_sysctl-if-missi.patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09 07:02:01 -07:00
Armin Kuster
21489a2942 security-test-image: tweak to get more tests to runn
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09 07:02:01 -07:00
Armin Kuster
2a7963df18 apparmor: fix build issue with ptest enabled.
minor spacing cleanup

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09 07:02:01 -07:00
Naveen Saini
d9feafe991 linux-%/5.x: Add dm-verity fragment as needed
Add checks that include dm-verity specific kernel config fragment
when dm-verity-img.bbclass is used.

Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09 07:02:01 -07:00
Naveen Saini
0de4f3bfb7 wic: add wks.in for intel dm-verity
Based on systemd-bootdisk-microcode.wks.in, this adds
the dm-verity image similar to the beaglebone wks
already in meta-security.

Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09 07:02:01 -07:00
Naveen Saini
e23767fc72 initramfs-framework/dmverity: add retry loop for slow boot devices
Detection of USB devices by the kernel is slow enough. We need to
keep trying for a while (default: 5s seconds, controlled by roottimeout=<seconds>)
and sleep between each attempt (default: one second, rootdelay=<seconds>).

Fix is based on https://git.yoctoproject.org/cgit.cgi/poky/commit/meta/recipes-core/initrdscripts/initramfs-framework/rootfs?id=ee6a6c3461694ce09789bf4d852cea2e22fc95e4

Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09 07:01:47 -07:00
Armin Kuster
ab56b1df52 packagegroup-core-security-ptest: remove
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-01 06:22:07 -07:00
Armin Kuster
b03d65ffe4 security-test-image: simplify
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-01 06:22:07 -07:00
Armin Kuster
60a17b82d2 packagegroup-core-security-ptest: remove keyutils-ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-01 06:22:07 -07:00
Armin Kuster
ab251c2c7b libseccomp: fix ptest failures.
Fixes:
BusyBox v1.32.0 () multi-call binary.
Usage: dd [if=FILE] [of=FILE] [bs=N] [count=N] [skip=N]

Don't use Busybox dd, not compatable. Use coreutils

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-01 06:22:07 -07:00
Armin Kuster
1b8f1b1dfb gitlab-ci: allow test to fail
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-01 06:22:07 -07:00
Armin Kuster
cef1768aff packagegroup-core-security: add opendnssec to pkg grp
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-29 07:18:24 -07:00
Armin Kuster
524a44f6d5 opendnssec: add recipe
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-29 07:18:24 -07:00
Adrian
904b0cbd33 gitignore added
After running testimage there are some python left overs at
lib/oeqa/runtime/cases/__pycache__/

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-29 07:18:24 -07:00
Armin Kuster
082305ded8 packagegroup-core-security: add libest package
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-29 07:18:24 -07:00
Armin Kuster
0a2feda94b libest: add recipe
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-29 07:18:24 -07:00
Armin Kuster
f0c6f7769c packagegroup-core-security: add softHSM
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-29 07:18:24 -07:00
Armin Kuster
b4b741f985 softHSM: add pkg
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-29 07:18:24 -07:00
Armin Kuster
46a7fa856c kas: build with ptest. remove apparmor
apparmor does not build with ptest enabled. skipping it for now

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-29 07:17:55 -07:00
Armin Kuster
d6baccc068 qemu test: set ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-18 04:06:31 -07:00
Armin Kuster
8abff56c89 kas-security-base: set RPM and disable ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-18 04:06:31 -07:00
Armin Kuster
3c3992a184 kas: add alt and mutli build images
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-18 04:06:31 -07:00
Armin Kuster
f176756890 apparmor: exclude mips64, not supported
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-18 04:06:31 -07:00
Armin Kuster
91d6d1f5f3 packagegroup-core-security: add more pkgs to base group
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-18 04:06:31 -07:00
Armin Kuster
0d5662acd1 kas-security-base: define sections as base
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-18 04:06:13 -07:00
Jens Rehsack
7486ab3f5b ibmtpm2tss: add recipe
Add recipe for companion of IBM Software TPM 2.0 - IBM's TPM 2.0 TSS.
It's a user space TSS for TPM 2.0.

Signed-off-by: Jens Rehsack <sno@netbsd.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-13 07:08:49 -07:00
Charlie Davies
b265ca0b63 clamav: update SO_VER to 9.0.4
Signed-off-by: Charlie Davies <charles.davies@whitetree.xyz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-13 07:08:34 -07:00
Armin Kuster
0d72d40772 meta-harden: Add a layer to demo harding OE/YP
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-13 07:05:50 -07:00
Armin Kuster
0ba6059805 gitlab-ci: add testimage
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
Armin Kuster
ea04d3f836 gitlab-ci: add dm-verify-image
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
Armin Kuster
2cf817a9a4 kas: add one dm-verify image build
gitlab-ci: add qemux86-64-dm-verify build image

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
Armin Kuster
0dac8fac90 kas: add test config
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
Armin Kuster
415bdc7f0d kas-security-base: add testimage
allow root to login

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
Jens Rehsack
b9c72cc8bc ibmswtpm2: update to 1637
Update ibmswtpm2 from 1628 to 1637. Build 1637 Includes:
* Increase NV memory size to match PC Client RSA 3072 requirements
* Add and fix ACT support
* Update Visual Studio files to 2019.

Signed-off-by: Jens Rehsack <sno@netbsd.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
Armin Kuster
caf76696e8 packagegroup-core-security: dont include suricata on riscv or ppc
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
niko.mauno@vaisala.com
4602d64208 beaglebone-yocto-verity.wks.in: Refer IMGDEPLOYDIR
Since dm-verity-image.bbclass effectively injects

  <DM_VERITY_IMAGE>:do_image_<DM_VERITY_IMAGE_TYPE>

dependency for do_image_wic task, we can change verity rootfs artifact
reference here from DEPLOY_DIR_IMAGE to IMGDEPLOYDIR in order to
mitigate following breakage which was observed when bitbaking
<DM_VERITY_IMAGE> target from scratch (using sstate-cache provided
artifacts):

  | wic.filemap.Error: cannot open image file '.../build/tmp/deploy/images/beaglebone-yocto/core-image-minimal-beaglebone-yocto.ext4.verity': [Errno 2] No such file or directory: '.../build/tmp/deploy/images/beaglebone-yocto/core-image-minimal-beaglebone-yocto.ext4.verity'
  | WARNING: exit code 1 from a shell command.
  |
  ERROR: Task (.../meta/recipes-core/images/core-image-minimal.bb:do_image_wic) failed with exit code '1'

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
niko.mauno@vaisala.com
5f196cf59d dm-verity-image-initramfs: Drop locales from image
Since IMAGE_LINGUAS defaults to 'en-us en-gb' and since localization is
not needed on this type of purpose-specific initramfs image, reset the
variable which helps by shaving off almost 700kB from resulting bundled
zImage-initramfs artifact.

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
niko.mauno@vaisala.com
e88895e109 dm-verity-image-initramfs: Add base-passwd package
This removes following boot-time complaints from udevd regarding
missing group declarations:

  [    6.624454] udevd[163]: specified group 'tty' unknown
  [    6.625340] udevd[163]: specified group 'dialout' unknown
  [    6.625692] udevd[163]: specified group 'kmem' unknown
  [    6.626022] udevd[163]: specified group 'input' unknown
  [    6.626541] udevd[163]: specified group 'video' unknown
  [    6.626977] udevd[163]: specified group 'audio' unknown
  [    6.627532] udevd[163]: specified group 'lp' unknown
  [    6.628187] udevd[163]: specified group 'disk' unknown
  [    6.628558] udevd[163]: specified group 'cdrom' unknown

Size impact of this change on resulting bundled zImage-initramfs
artifact is less than +1kB which is neglible.

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
niko.mauno@vaisala.com
1d21cec5fd dm-verity-initramfs-image: Cosmetic improvements
- revise declaration ordering as suggested by oe-stylize.py
 - sort PACKAGE_INSTALL entries in alphabetic order
 - split long command line in deploy_verity_hash()

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
niko.mauno@vaisala.com
45e8b20cd0 dm-verity-image-initramfs: Use initramfs-framework
Switch from this layer's initramfs-dm-verity recipe to poky-provided
initramfs-framework suite to manage veritysetup et al.

This commit also removes initramfs-dm-verity recipe which is not
referred from elsewhere in this meta layer.

Also update the install path of dm-verity.env from /usr/share to
/usr/share/misc in order to better comply with FHS3.0, see
https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s11.html#usrsharemiscMiscellaneousArchitecture

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
niko.mauno@vaisala.com
489f7c900c initramfs-framework: Add dmverity module
Add 'initramfs-module-dmverity' as an extension to poky upstream
provided initramfs-framework suite via matchingly named bbappend file.

Together with pre-existing 'initramfs-module-udev' this module can be
used to facilitate dm-verity rootfs mounting from initramfs context
that is bundled with Linux kernel.

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00