Commit Graph

1136 Commits

Author SHA1 Message Date
Armin Kuster
0120b7475d arpwatch: add postfix to pkg config
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-14 10:51:32 -07:00
Armin Kuster
d198b6fab1 packagegroup-core-security: add dynamic python pkgs
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-14 10:51:32 -07:00
Armin Kuster
28194e9251 packagegroup-core-security: add perl pkgs grps
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-14 10:51:32 -07:00
Armin Kuster
55839bcd20 packagegroup-core-security: remove pkgs
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-14 10:51:32 -07:00
Armin Kuster
a764533c20 meta-security: move perl and python recipes to dynamic layers structure
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-14 10:51:32 -07:00
Armin Kuster
20c13f6335 fscrypt: add distro_check on pam
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-14 10:51:32 -07:00
Josh Harley
8ca6bb86e6 Add EROFS support to dm-verity-img class
[PATCH] Add support for the EROFS image, and it's compressed options,
 to the dm-verity-img.bbclass setup, theoretically this is a simple addition
 to the list of types however there is a quirk in how Poky handles the
 filesystems in poky/meta/classes/image_types.bbclass.

Specifically the 'IMAGE_CMD' and 'IMAGE_FSTYPES' use a hyphen, e.g.
erofs-lz4, however in the image_type bbclass the task for that would be
"do_image_erofs_lz4", replacing the hyphen with an underscore.

As the dm-verity-img.bbclass adds a dependency to the wic image creation
on the do_image_* task then it fails as there is no
"do_image_erofs-lz4", so simply replace the hypen with an underscore.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-01 10:26:52 -07:00
Joe Slater
93f2146211 LICENSE: update to SPDX standard names
Use convert-spdx-licenses.py to update LICENSE in recipes.

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-13 13:45:44 -07:00
Ranjitsinh Rathod
4158c871a6 samhain.inc: Correct LICENSE to GPL-2.0-only
It seems below change done manually and so LICENSE variable modified
from GPLv2 to GPL-2.0-or-later. But it should be GPL-2.0-only
Link: https://git.yoctoproject.org/meta-security/commit/?id=c56ae450c93a1383a1ce800a32a6ef2c3fbbae1c

Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-13 13:45:44 -07:00
Petr Gotthard
d4fffc44f3 tpm2-pkcs11: update to 1.8.0
The build patches are now included in the upstream,
the local binary checkes can be disabled with --disable-ptool-checks,
the boostrap doesn't need to be called if the release .tar.gz is used.

Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-13 13:45:44 -07:00
Petr Gotthard
f576e38379 tpm2-tss-engine: fix version string and build with openssl 3.0
Calling autoreconf outside git repo causes the version number to
be null. This patch makes the version number fixed.

Since Yocto now uses OpenSSL 3.0, the file packaging need to
be updated.

Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-13 13:45:44 -07:00
Petr Gotthard
da8cbb3b16 tpm2-abrmd: update to 2.4.1
The version number is correctly assigned only when the release .tar.gz
is used.

Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-13 13:45:44 -07:00
Petr Gotthard
5855990d6f tpm2-tss: update to 3.2.0
This deletes the patches that were unused for a long time,
updates the tpm2-tss package and introduces a fix to the version
number problem that got introduced with the 3.2.0 version.

Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-13 13:45:44 -07:00
Petr Gotthard
f203d64c1f tpm2-openssl: update to 1.1.0
Also, the recipe is fixed to correctly package the openssl provider.

This new tpm2-openssl:
- Fixed segmentation fault when a signature algorithm is beging initialized
  without a private key.
- Fixed RSA/EC key equality checks. Works with OpenSSL 3.0.1.
- Added support for the `TPM2OPENSSL_PARENT_AUTH` environment variable.

Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-13 13:45:44 -07:00
Petr Gotthard
c010297b49 tpm2-tools: fix missing version number
Calling autoreconf outside git repo causes the version number to
be null. This patch makes the version number fixed.

Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-13 13:45:44 -07:00
Anton Antonov
71fd7eda04 Upgrade parsec-service to 1.0.0 and parsec-tool to 0.5.2
Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-13 13:45:44 -07:00
Davide Gardenal
498ca39cd6 fscrypt: update dependecy from go-dep-native to go-native
Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-07 10:26:45 -07:00
Davide Gardenal
e92fad507a clamav: add COMPATIBLE_HOST to fix build error
Add COMPATIBLE_HOST to match what is found in glibc
to avoid build error when using musl

Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-07 10:26:45 -07:00
Armin Kuster
48d6ff13e3 samhain: update to 4.4.7
This fixes musl builds too.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-07 10:26:45 -07:00
Armin Kuster
cfb79c913f linux-yocto_security.inc: add lkrg kfrags
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-07 10:26:45 -07:00
Armin Kuster
fb67042242 lkrg-module: covert to git fetcher
This allows to track tip easier.
refresh patch
Fix LICENSE to match SPDX format

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-07 10:26:45 -07:00
Armin Kuster
2be1d069ec python3-fail2ban: fix compile issue on some hosts
Use python3-native to use 2to3

Fix build issue on some hosts with this error:
 (result, consumed) = self._buffer_decode(data, self.errors, final)
 | UnicodeDecodeError: 'utf-8' codec can't decode byte 0xd8 in position 152: invalid continuation byte

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-02 11:21:42 -07:00
Robert Yang
0c41d792cf LICENSE: adopt SPDX standard names
Modify LICENSE for ding-libs and libmhash.

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-02 11:21:42 -07:00
Ashish Sharma
c56ae450c9 meta-security : Use SPDX style licensing format
WARNING: selinux-sandbox-3.3-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \
WARNING: selinux-gui-3.3-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \
WARNING: semodule-utils-3.3-r0.1 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \
WARNING: selinux-dbus-3.3-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \
WARNING: libwhisker2-perl-2.5-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPL-1.0+ [obsolete-license] \
WARNING: lib-perl-0.63-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPL-1.0+ [obsolete-license] \
WARNING: libhtp-0.5.39-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2 [obsolete-license] \
...

Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-02 11:21:42 -07:00
Armin Kuster
943f48419a openscap-daemon: use renamaed python_setuptools_build_meta
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-02 11:21:34 -07:00
Armin Kuster
da93339112 kas-security-alt: drop rust layer
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-13 08:11:29 -07:00
Armin Kuster
288391edc5 python3-privacyidea: drop old package ref.
meta-python dropped package via commit:

620689d4efba28bc8dd60e2d82908bfb3531fbd0
python3-backports-functional-lru-cache: remove, not needed for Python 3

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-13 08:11:21 -07:00
Ashish Sharma
e5e3dd4877 Subject: [PATCH] Subject: python3-fail2ban: switch to legacy setuptools3
raise InvalidWheelFilename(f"{filename} is not a valid wheel filename.")
pip._internal.exceptions.InvalidWheelFilename: fail2ban-*-*.whl is not a valid wheel filename.
Removed build tracker: '/tmp/pip-req-tracker-qnepnk46'

ERROR: Failed to pip install wheel. Check the logs.

Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:13:15 -08:00
Armin Kuster
30f34fa990 python3-fail2ban: fix SPDX license.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:12:56 -08:00
Armin Kuster
da23c2a094 tpm2-tss: fix user perms
[Yocto #14724]

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:12:46 -08:00
Armin Kuster
46622a3b26 tpm-tools: Fix pod2man race
On some systems, pod2man is not available so add native depends.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:41 -08:00
Armin Kuster
ddb27e71d8 ima-evm-keys: don't use lnr
lnr is a script in oe-core that creates relative symlinks, with the same
behaviour as `ln --relative --symlink`.  It was added back in 2014[1] as
not all of the supported host distributions at the time shipped
coreutils 8.16, the first release with --relative.

However the oldest coreutils release in the supported distributions is
now 8.22 in CentOS 7, so lnr can be deprecated and users switched to ln.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
47bbac5242 libtpm: update to 0.9.2
includes: CVE-2021-3623

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
6ea6a4982c swtpm: update to 0.7.1
fixes: CVE-2022-23645.
Add implementation of SWTPM_HMAC using OpenSSL 3.0 APIs

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
6c3262f5bb openscap-daemon: fix wheels and License issues.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
be65e1c3ba python3-privacyidea: update to 3.6.2
Fix license.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
dac1280dee python3-privacyidea: fix QA ERROR
ERROR: python3-privacyidea-3.5.2-r0 do_package: QA Issue: python3-privacyidea: Files/directories were installed but not shipped in any package:
/usr/etc
/usr/etc/privacyidea
/usr/etc/privacyidea/dictionary
/usr/etc/privacyidea/privacyideaapp.wsgi

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Akshay Bhat
ba4485f331 meta-security-isafw: Fixes to work with oe-core master
Update isafw bbclass to build with oe-core master
- prelink support was dropped in oe-core as part of 23c0be78106f
- do_populate_cve_db was renamed to do_fetch in oe-core as part
of f5f97d33a1703d

Signed-off-by: Akshay Bhat <akshay.bhat@timesys.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
2993f459fc parsec-service: Only enable TPM is layer and DISTRO_FEATURE is defined.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
048cc16aef layer.conf: enable apparmor for qemu machine
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
0272f7ff02 apparmor: update to 3.0.4
drop to patches no longer needed
use setuptools

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:07:52 -08:00
Armin Kuster
75073a5617 packagegroup-security-tpm: Fix QA Error
ERROR: packagegroup-security-tpm-1.0-r0 do_package_write_rpm: An allarch packagegroup shouldn't depend on packages which are dynamically renamed (libtpm-dbg to libtpms-dbg)
ERROR: packagegroup-security-tpm-1.0-r0 do_package_write_rpm: An allarch packagegroup shouldn't depend on packages which are dynamically renamed (libtpm to libtpms0)
ERROR: packagegroup-security-tpm-1.0-r0 do_package_write_rpm: An allarch packagegroup shouldn't depend on packages which are dynamically renamed (libtpm-dev to libtpms-dev)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:07:52 -08:00
Armin Kuster
c8681cc40f README.md: fix typo
Fix typo in parsec-tools to parsec-tool

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:07:52 -08:00
Anton Antonov
6cc8dde794 Upgrade parsec-tool to 0.5.1
Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-25 07:19:55 -08:00
Armin Kuster
cc11c8c0ab smack: Use new CVE_CHECK_IGNORE variable
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-22 08:10:02 -08:00
Armin Kuster
8ff2d27721 chipsec: fix WARNING
distutils3.bbclass is deprecated, please use setuptools3.bbclass instead

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-22 08:10:02 -08:00
Armin Kuster
419946655d recipes: Use renamed SKIP_RECIPE varFlag
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-22 08:09:54 -08:00
Armin Kuster
30a4227e3c layer.conf: Update to use kirkstone
Update the layers to use the kirkstone namespace. No compatibility is made
for honister due to the variable renaming.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-20 19:39:36 -08:00
Patrick Williams
a6fc2597b4 tpm2-pkcs11: fix RDEPENDS variable
The RDEPENDS variable was misspelled and as a result was never fixed up
with the `_${PN}` to `:${PN}` transition.  Fix both aspects.

Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-20 19:39:36 -08:00
Akshay Bhat
caec0c657d scap-security-guide: Fix openembedded platform tests
Update the installed_OS_is_openembedded check to drop the quotes
in the VERSION_ID string to match f451c68667cca of openembedded-core.
Without this fix, all tests are reported as "notapplicable".

Signed-off-by: Akshay Bhat <akshay.bhat@timesys.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-20 19:39:28 -08:00