Commit Graph

336 Commits

Author SHA1 Message Date
Armin Kuster
0d7ae67b0f packagegroup-core-security-ptest: only included if ptest is enabled
update python package names

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-07 08:32:50 -07:00
Stefan Agner
2153c59b42 libseccomp: build static library always
Always build static library. This is required e.g. for runc from
meta-virtualization in its default configuration.

Signed-off-by: Stefan Agner <stefan.agner@toradex.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-01 15:11:17 -07:00
Armin Kuster
bf5dbd0313 python-scapy: drop py2 package
fixup run-ptest

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-09-01 15:11:17 -07:00
Yuan Chao
30ea7a89dc checksec: upgrade 1.11.1 -> 2.1.0
Signed-off-by: Yuan Chao <yuanc.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-29 16:04:50 -07:00
Yuan Chao
c6c9dd2e06 python-scapy: upgrade 2.4.2 -> 2.4.3
License file changed from bin/scapy to LICENSE

Signed-off-by: Yuan Chao <yuanc.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-29 16:04:35 -07:00
Adrian Bunk
7ce3c3368a xmlsec1: Remove, moved to meta-oe
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-28 08:05:55 -07:00
Qi.Chen@windriver.com
10ac9f8bff ecryptfs-utils: fix race condition in do_install
The rootsbindir is a self-defined directory. The install-rootsbinPROGRAMS
is actually treated as part of install-data instead of install-exec.

Do making install-exec-am depend on it actually results in the following
Makefile contents.

  install-data-am: install-rootsbinPROGRAMS
  install-exec-am: install-binPROGRAMS install-binSCRIPTS
          @$(NORMAL_INSTALL)
          $(MAKE) $(AM_MAKEFLAGS) install-exec-hook
  install-exec-hook:      install-rootsbinPROGRAMS

And this results in race condition as two install commands of the same
file running at the same time. Error message is like below.

  TOPDIR/tmp-glibc/hosttools/install: cannot create regular file 'TOPDIR/tmp-glibc/work/aarch64-wrs-linux/ecryptfs-utils/111-r0/image/sbin/mount.ecryptfs': File exists

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-28 08:05:55 -07:00
Qi.Chen@windriver.com
bcbd10be87 ecryptfs-utils: remove openssl PACKAGECONFIG
ecryptfs-utils does not build with openssl1.1.

Previously this openssl PACKAGECONFIG is disabled by default, so
we are not getting build failures by default. But if we enable it,
we get do_compile failure.

This package is from ubuntu source, and the one ubuntu ships does not
depend on openssl. The development of this package has stopped for about
3 years. I don't see it will fix the build offically.

So remove this PACKAGECONFIG and use '--disable-openssl' directly.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-28 08:05:48 -07:00
Yi Zhao
26e306b9d2 xmlsec1: upgrade 1.2.27 -> 1.2.28
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-11 20:16:16 -07:00
Armin Kuster
265d27f3d2 keyutils: remove from meta-security
now in meta-oe

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
Armin Kuster
3f253ddab8 clamav: minor recipe cleanup
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster
37dc57c998 libmspack: update SRC_URI and package
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster
88350b1267 test-image: add a few more packages to image
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster
2098981e0c test-image: add packagegroup-core-security-ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster
55ff4e2434 packagegroup-core-security: cleanup and remove ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster
ee580bd011 security-test-image: add a testing image
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Zang Ruochen
c28b72e91d python3-scapy: solved the conflict with python-scapy
-Rename the following file to resolve the conflict with python-scapy:
	Rename /usr/bin/UTscapy to /usr/bin/UTscapy3
	Rename /usr/bin/scapy to /usr/bin/scapy3

Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-10 07:35:35 -07:00
Zang Ruochen
470271aea7 python-scapy: solved the conflict with python3-scapy
-Rename the following file to resolve the conflict with python3-scapy:
	Rename /usr/bin/UTscapy to /usr/bin/UTscapy2
	Rename /usr/bin/scapy to /usr/bin/scapy2

Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-10 07:35:35 -07:00
Zang Ruochen
b1e379ee5c python-scapy: Remove redundant sed operations
-Remove redundant sed operations.

Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-10 07:35:27 -07:00
Zang Ruochen
376d34368e bastille: solved the conflict with perl-module-text-wrap and base-files
-Remove the link to perl5 to resolve the conflict with perl-module-text-wrap.

-Remove the operation on /var/lock to resolve the conflict with base-files.

Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-10 07:35:18 -07:00
leimaohui
479d9cc23a python3-fail2ban: Fix build error of xrange.
NameError: name 'xrange' is not defined

Signed-off-by: Lei Maohui <leimaohui@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-05-21 08:18:36 -07:00
Armin Kuster
28629fe8a4 keyutils: fix library install path
[v2]
fix multilib support
Als add native support

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-05-21 08:18:36 -07:00
Armin Kuster
7b9206d346 checksec: update to 1.11.1
* checksec.sh: Updated to 1.11.1
* checksec.sh: resolved issues with readelf
* checksec.sh: Added docker images for testing
* checksec.sh: Added armhf and aarch64 libc locations
* checksec.sh: Replace FS_COUNT with fgrep
* checksec.sh: Fixed symbols count in csv
* checksec.sh: Fixed RW-RPATH and RW-RUNPATH
* checksec.sh: Added stack canaries generated by intel compiler
* checksec.sh: Mute stat errors for non-existent directories
* checksec.sh: Removed invalid json structures and duplicate kernel checks
* checksec.sh: fixed spaces in -d option
* checksec.sh: Added stack-protector-string check
* checksec.sh: Add arm64 specific kernel checks
* checksec.sh: Add REFCOUNT_FULL to kernel tests
* checksec.sh: Remove OSX support

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-05-21 08:18:36 -07:00
Armin Kuster
34cb20fe5c libseccomp: update to 2.4.1
bug fix release.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-05-09 20:05:47 -07:00
Armin Kuster
5959e4f4bf clamav-native: fix new build issue
re-arch the reciped to build properly.

Fixed /var/lib/clamav dir issue

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-04-14 10:54:20 -07:00
Armin Kuster
ab3c84c4d3 clamav: add clamav-cvd package for cvd db
Add native package to support creating a mirror
of the clamav cvd and supply it in a new package.

Provide a INSTALL_CLAMAV_CVD flag to bypass this creation

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-04-14 10:54:07 -07:00
Armin Kuster
67369e1428 clamav: fix llvm reference version
llvm8.0 does not exist. dropped the version part.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-04-13 10:31:20 -07:00
Armin Kuster
8a1f54a246 libmspack: update to 0.10.1
For details see: https://github.com/kyz/libmspack/blob/master/libmspack/ChangeLog

change compression to match that now being used from source

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-04-07 05:13:33 +05:30
Armin Kuster
98750e8933 ccs-tools: move to reciped-mac
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-04-07 05:12:43 +05:30
Armin Kuster
1460d9b86d reorg ids: move ids recipes to recipes-ids
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-31 10:37:09 -07:00
Armin Kuster
75e609f7b1 reorg: move mac recipes to recipes-mac
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-31 10:37:09 -07:00
Armin Kuster
6d3aa03272 clamav: drop llvm version setting
There is only one llvm and its in core so
drop allowing it to be overwritten.
We can hardcode it now.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-31 10:37:09 -07:00
Armin Kuster
b551fdef0e samhain: fix runtime error
fix:
samhain[1652]: FATAL: x_dnmalloc.c: 2790: hashval < AMOUNTHASH
Killed

disable dnmalloc

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-31 10:37:09 -07:00
Armin Kuster
1fae87cd1c sssd: update to 1.16.4
Add systemd pkgconf via DISTRO_FEATURE

Fix uid/gid of sssd.conf

[v2]
drop non update related changes

also, this includes CVE-2019-3811

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-31 10:37:09 -07:00
Armin Kuster
9553b9a8dd sssd: fix a few runtime issues
include a few more RDEPEND packages. remove init script as there really
isn't one yet.

[v2]
Squish build tweeking done in pkg update into this changeset

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-31 10:36:37 -07:00
Armin Kuster
f11dbe0d6d Revert "sssd: fix libcrypto version used"
This reverts commit 2488c965d6b1b440734f43326fb33ac642ac7b82.

This corrects an incorrect fix as pointed out by Adrian Bunk.
2019-03-29 08:28:49 -07:00
Armin Kuster
0a97ed301e sssd: fix libcrypto version used
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-25 22:33:22 -07:00
Armin Kuster
228e566a55 keyutils: fix pulling in glibc when musl enabled
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-25 22:33:22 -07:00
Armin Kuster
86d2c0c66a keyutils: fix QA WARNING
WARNING: keyutils-1.6-r0 do_package: QA Issue: keyutils: Files/directories were installed but not shipped in any package:
  /lib/pkgconfig
  /lib/pkgconfig/libkeyutils.pc

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-16 04:17:29 -07:00
Armin Kuster
eae5224fa8 libseccomp: update to 2.4.0
Update the syscall table for Linux v5.0-rc5.
also a security releated issue;
https://github.com/seccomp/libseccomp/issues/139

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-16 04:17:29 -07:00
Armin Kuster
712a635f37 suricata: update to 4.1.3
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-12 11:07:55 -07:00
Armin Kuster
0d8f900816 packagegroup-core-security: change fail2ban ptest to reg python pkg
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-12 11:07:46 -07:00
Armin Kuster
c4f1c91377 tripwire: fix ptest so more tests pass
replace relative path with abs path for binaries.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-08 14:51:55 -08:00
Armin Kuster
dd6006e8bc keyutils: improve ptests
Tests need lsb

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-08 14:51:55 -08:00
Armin Kuster
49cdcd42e9 keyutils: update to 1.6
remove patch now included in update:
keyutils-use-relative-path-for-link.patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-06 11:49:35 -08:00
Armin Kuster
6cc71c7d07 suricata: update to 4.0.6
includes: SMTP crash issue was fixed: CVE-2018-18956

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-06 11:49:35 -08:00
Armin Kuster
65097a0867 python-fail2ban: update 0.10.4.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-06 11:49:35 -08:00
Armin Kuster
d7fc8dd898 libmspack: update to 0.9.1
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-06 11:49:35 -08:00
Armin Kuster
9c471d4d23 tripwire: update to 2.4.3.7
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-06 11:49:35 -08:00
Armin Kuster
7b997bdddf samhain: update to 4.3.2
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-03-06 11:49:35 -08:00