264 Commits

Author SHA1 Message Date
Robert Yang a41f3b242f apparmor: Remove tab indentations in python code
Use 4 spaces to replace a tab.

Fixed:
apparmor_2.12.bb: python should use 4 spaces indentation, but found tabs in apparmor_2.12.bb, line 49

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-12-15 15:03:00 -08:00
Armin Kuster 28508811dc clamav: update to 0.99.4
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-10-31 09:02:21 -07:00
Armin Kuster 5462ce5b7a packagegroup-core-security: add fail2ban ptest to image
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-10-31 09:02:21 -07:00
Armin Kuster d32ae3cb83 fail2ban: add ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-10-31 09:02:21 -07:00
Armin Kuster af173c0440 packagegroup-core-security: add tripwire ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-10-31 09:02:21 -07:00
Armin Kuster dd5b5c2753 tripwire: add ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-10-31 09:02:21 -07:00
Armin Kuster e8f5ec707f security-build-image: remove X11
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-10-31 09:02:21 -07:00
Armin Kuster ab7b4aefa2 packagegroup-core-security: add suricata-ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-10-31 09:02:21 -07:00
Armin Kuster 94c7e71682 suricata: add ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-10-31 09:02:21 -07:00
Armin Kuster 4e3e7da657 packagegroup-core-security: add few more ptest packages
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-10-31 09:02:21 -07:00
Armin Kuster d51793e69c packagegroup-core-security: add ptest capable packages
and favor python-scapy

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-10-31 09:02:21 -07:00
Armin Kuster b58f4ca4fb packagegroups: add more packages
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-10-31 09:02:21 -07:00
Armin Kuster b898dc231a suricata: fix QA error
ollected errors:
 * check_data_file_clashes: Package suricata wants to install file .../1.0-r0/rootfs/var/run
	But that file is already provided by package  * base-files

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-10-31 09:02:21 -07:00
Changqing Li 729fca6d2c bseccomp: fix do package qa warning
Fix below warning:

lib32-libseccomp-2.3.3-r0 do_package: QA Issue: lib32-libseccomp:
Files/directories were installed but not shipped in any package:

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-29 10:43:01 -07:00
Yi Zhao 29b5ec44c7 keynote: remove recipe
The keynote is unmaintained for a long time. It had been removed from
main distributions (Fedora, Suse and Debian).
See: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=594867

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-29 10:43:01 -07:00
Armin Kuster 4bbc0d9d94 samhain: update to 4.3.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-23 15:34:10 -07:00
Armin Kuster e535ac49fd aircrack: update to 1.3
remove unneeded patch.
minor cleanups

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-17 21:08:19 -07:00
Armin Kuster 5a9f865792 packagegroup-core-security: change scapy to python name
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-17 21:08:19 -07:00
Armin Kuster 62e7b5798d bastille: fix QA error
bastille_3.2.1.bb: cannot map 'allarch' to a linux kernel architecture

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-17 21:08:19 -07:00
Armin Kuster 93c5ab6687 suricata: include a emerging rules snapshot
it appears to be changing w/o version control so
keep a snapshot when reciped was updated.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-17 21:08:19 -07:00
Armin Kuster c9a21aae52 apparmor: update to 2.12
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-17 21:08:19 -07:00
Armin Kuster 9ef4c66498 fscryptctl: update to tip
fix mkfs.ext4 invocation

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-17 21:08:19 -07:00
Armin Kuster 561d0806a9 scapy: update to 2.4.0 and covert
convert package to python standard

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-17 21:08:19 -07:00
Armin Kuster 32def3971b fail2ban: update to 10.3.1
covert to python package standard

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-17 21:08:19 -07:00
Armin Kuster d743e44710 sssd: update to 1.16.3
Includes:
CVE-2018-10852

see:
https://docs.pagure.org/SSSD.sssd/users/relnotes/notes_1_16_3.html

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-17 21:08:19 -07:00
Alex Kiernan 31de145fe1 keyutils: Fix build with usrmerge
Update BINDIR and SBINDIR so keyutils builds with usrmerge

ERROR: keyutils-1.5.10-r0 do_package: QA Issue: keyutils: Files/directories were installed but not shipped in any package:
  /sbin/key.dns_resolver
  /sbin/request-key
  /bin/keyctl
Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install.
keyutils: 3 installed and not shipped files. [installed-vs-shipped]

Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-17 21:08:19 -07:00
Yi Zhao 6e8d6f96d2 keynote: depend on openssl10
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-17 21:08:19 -07:00
Yi Zhao 9449ba75ea xmlsec1: upgrade 1.2.25 -> 1.2.26
Drop patch xmlsec1-fix-a-typo-in-examples-verify3.c.patch since the
issue had been fixed upstream.

Rebase patch change-finding-path-of-nss.patch

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-01 10:34:02 -07:00
Yi Zhao 108cb736d9 samhain: upgrade 4.2.2 -> 4.2.4
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-01 10:34:02 -07:00
Mingli Yu 492b8b8f4a ecryptfs-utils: fix usrmerge install path
Update rootsbindir from /sbin to ${base_sbindir}
to fix below do_install error when usrmerge
enabled in DISTRO_FEATURES
| chmod: cannot access '/poky-build/tmp-glibc/work/core2-64-wrs-linux/ecryptfs-utils/111-r0/image/usr/sbin/mount.ecryptfs_private': No such file or directory

And pass "--with-pamdir=${base_libdir}/security"
to configure script to fix below warning when
usrmerge enabled in DISTRO_FEATURES
| WARNING: ecryptfs-utils-111-r0 do_package: QA Issue: ecryptfs-utils: Files/directories were installed but not shipped in any package:
  /lib64/security/pam_ecryptfs.so

Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-01 10:34:02 -07:00
Joe Slater 46d81c4737 keynote: add dependency on bison-native
bison/yacc is no longer automatically supplied.

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-01 10:34:02 -07:00
Alex Kiernan 1d1c293819 libseccomp: Drop RDEPENDS on bash
Commit ada3eee ("libseccomp: fix rdepends") added RDEPENDS on bash, but
this is no longer needed, so drop it.

Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-01 10:34:02 -07:00
Armin Kuster e296c53687 suricata: update 4.0.5
Fix rules make. Don't allow the makefile to download the rules. Use
fetcher

add install configs and remove manual intall of those files

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-01 10:34:02 -07:00
Armin Kuster 407abe22ef libhtp: update to 0.5.27
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-09-01 10:33:53 -07:00
Koen Kooi 68a727e9cb suricata: rename ${PN}-python to ${PN}-socketcontrol
This describes the content a lot better. RDEPENDS are still missing, so it's still as non-working as before :/

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-08-04 07:50:07 -07:00
Koen Kooi 95e21e8cd9 suricata: install and package threshold.config
This fixes the following warning during startup:

  suricata[24522]: 31/7/2018 -- 13:47:15 - <Warning> - [ERRCODE: SC_ERR_FOPEN(44)] - Error opening file: "/etc/suricata//threshold.config": No such file or directory

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-08-04 07:50:07 -07:00
Koen Kooi cce040956e suricata: install and package rules
This fixes the following warning during startup:

  suricata[22707]: 31/7/2018 -- 13:34:40 - <Warning> - [ERRCODE: SC_ERR_NO_RULES_LOADED(43)] - 47 rule files specified, but no rule was loaded at all!

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-08-04 07:50:07 -07:00
Koen Kooi 2c266a1cfe suricata: enable syslog output
This fixes the following error preventing startup in daemon mode:

  suricata[20485]: 31/7/2018 -- 13:19:48 - <Error> - [ERRCODE: SC_ERR_MISSING_CONFIG_PARAM(118)] - NO logging compatible with daemon mode selected, suricata won't be able to log. Please update  'logging.outputs'

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-08-04 07:50:07 -07:00
Koen Kooi 111835003d suricate: create and package logdir
This fixes the following error preventing startup:

  suricata[18771]: 31/7/2018 -- 13:08:21 - <Error> - [ERRCODE: SC_ERR_LOGDIR_CONFIG(116)] - The logging directory "/var/log/suricata/" supplied by /etc/suricata/suricata.yaml (default-log-dir) doesn't exist. Shut>

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-08-04 07:50:07 -07:00
Koen Kooi e58ad185be suricata: add systemd unit
Based on the debian systemd unit.

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-08-04 07:50:07 -07:00
Koen Kooi a0a3160923 suricata: add 'nfq' PACKAGECONFIG
For inline IPS nfqueue is nice to have, so add a PACKAGECONFIG entry for
it.

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-08-04 07:50:07 -07:00
Koen Kooi ccd9950ebd suricata: mark config file as CONFFILE
This preserves user edits during package upgrades.

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-08-04 07:50:07 -07:00
Koen Kooi c933696e9e suricata: fix packaging
Move ${PN}-python in front so ${PN} can use default packaging rules.

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-08-04 07:50:07 -07:00
Koen Kooi 3277886451 suricata: don't start service in postinst
Apart from hardcoding the wrong networking device it won't survive device restart

Signed-off-by: Koen Kooi <koen.kooi@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-08-04 07:50:07 -07:00
Armin Kuster 7c6532e1c0 nmap: remove recipe as it is in meta-oe now
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-08-04 07:49:58 -07:00
Armin Kuster 4d139b95c4 clamav: update postinit
log_check] WARNING: Intentionally failing postinstall scriptlets of ['suricata', 'clamav'] to defer them to first boot is deprecated. Please place them into pkg_postinst_ontarget_${PN} ()

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-07-07 08:14:54 -07:00
Armin Kuster d2946afbd2 suricata: update postinit
[log_check] WARNING: Intentionally failing postinstall scriptlets of ['suricata', 'clamav'] to defer them to first boot is deprecated. Please place them into pkg_postinst_ontarget_${PN} ()

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-07-07 08:14:47 -07:00
Nagalakshmi Veeramallu a1406fe1c8 CVE-2018-11652 nikto: arbitray OS command injection via http server field.
CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers
to inject arbitrary OS commands via the Server field in an HTTP response header,
 which is directly injected into a CSV report.

Signed-off-by: Nagalakshmi Veeramallu <nveeramallu@mvista.com>
Reviewed-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>
2018-07-03 15:30:51 -07:00
Changqing Li 0551002922 samhain: correct service status
status get by "systemctl status samhain" is not correct.
It is active(exited) now. but actually, there is a dameon
running, it should be active(running). so change Type of
servive.

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-07-03 15:30:40 -07:00
Jinliang Li f9c5e2022b Fix build issue for apparmor when systemd is used
When systemd is used as system init manager, there is a build issue complains
"can't found apparmor.service". This patch fix it.

Signed-off-by: Jinliang Li <jinliang.li@linux.alibaba.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-06-11 10:57:43 -07:00