9d6e3ff0ed
tpm2-abrmd: update to 2.3.3
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-15 21:15:03 -07:00
8566325c96
tpm2-totp: update to 0.2.1
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-15 21:15:03 -07:00
6c6e967b98
tpm2-tss: update to 2.4.3
...
includes: CVE-2020-24455
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-15 21:15:03 -07:00
bf494f2114
gitlab-ci: add qemux86 and qemuarm64 musl builds
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-15 21:15:03 -07:00
16ab6ce706
kas: fixup alt configs
...
add smack
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-15 21:14:53 -07:00
3ce8b759c9
suricata: update to 4.1.9
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-10 16:21:48 -07:00
496a734c14
packagegroup-core-security: remove clamav from musl image
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-10 16:21:48 -07:00
c0e801f1e0
sssd: update to latest ltm 1.16.5
...
fix musl support
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-10 16:21:48 -07:00
7578a8b2ed
libest: fix musl build.
...
fixes
est.c:38:10: fatal error: execinfo.h: No such file or directory
| 38 | #include <execinfo.h>
| | ^~~~~~~~~~~~
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-10 16:21:48 -07:00
b3f10d2285
ecryptfs-utils: fix musl build
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-10 16:21:48 -07:00
11dd919372
apparmor: fix build for on musl
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-10 16:21:31 -07:00
c5b5737ef3
qemux86-test: add apparmor back
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-10 16:21:31 -07:00
d3aff039c9
suricata: fix compiling on gcc10
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-09 07:02:01 -07:00
8bab022533
packagegroup-core-security: apparmor 3.0 ptest does not build
...
for now skip apparmor ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-09 07:02:01 -07:00
b8c437bf70
apparmor: update to 3.0
...
skip ptest for now, on todo list for fix.
Runtime test pass
remove patch now included in update: 0001-regression-tests-Don-t-build-syscall_sysctl-if-missi.patch
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-09 07:02:01 -07:00
21489a2942
security-test-image: tweak to get more tests to runn
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-09 07:02:01 -07:00
2a7963df18
apparmor: fix build issue with ptest enabled.
...
minor spacing cleanup
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-09 07:02:01 -07:00
d9feafe991
linux-%/5.x: Add dm-verity fragment as needed
...
Add checks that include dm-verity specific kernel config fragment
when dm-verity-img.bbclass is used.
Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com >
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-09 07:02:01 -07:00
0de4f3bfb7
wic: add wks.in for intel dm-verity
...
Based on systemd-bootdisk-microcode.wks.in, this adds
the dm-verity image similar to the beaglebone wks
already in meta-security.
Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com >
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-09 07:02:01 -07:00
e23767fc72
initramfs-framework/dmverity: add retry loop for slow boot devices
...
Detection of USB devices by the kernel is slow enough. We need to
keep trying for a while (default: 5s seconds, controlled by roottimeout=<seconds>)
and sleep between each attempt (default: one second, rootdelay=<seconds>).
Fix is based on https://git.yoctoproject.org/cgit.cgi/poky/commit/meta/recipes-core/initrdscripts/initramfs-framework/rootfs?id=ee6a6c3461694ce09789bf4d852cea2e22fc95e4
Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com >
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-09 07:01:47 -07:00
ab56b1df52
packagegroup-core-security-ptest: remove
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-01 06:22:07 -07:00
b03d65ffe4
security-test-image: simplify
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-01 06:22:07 -07:00
60a17b82d2
packagegroup-core-security-ptest: remove keyutils-ptest
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-01 06:22:07 -07:00
ab251c2c7b
libseccomp: fix ptest failures.
...
Fixes:
BusyBox v1.32.0 () multi-call binary.
Usage: dd [if=FILE] [of=FILE] [bs=N] [count=N] [skip=N]
Don't use Busybox dd, not compatable. Use coreutils
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-01 06:22:07 -07:00
1b8f1b1dfb
gitlab-ci: allow test to fail
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-10-01 06:22:07 -07:00
cef1768aff
packagegroup-core-security: add opendnssec to pkg grp
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-29 07:18:24 -07:00
524a44f6d5
opendnssec: add recipe
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-29 07:18:24 -07:00
904b0cbd33
gitignore added
...
After running testimage there are some python left overs at
lib/oeqa/runtime/cases/__pycache__/
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com >
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-29 07:18:24 -07:00
082305ded8
packagegroup-core-security: add libest package
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-29 07:18:24 -07:00
0a2feda94b
libest: add recipe
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-29 07:18:24 -07:00
f0c6f7769c
packagegroup-core-security: add softHSM
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-29 07:18:24 -07:00
b4b741f985
softHSM: add pkg
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-29 07:18:24 -07:00
46a7fa856c
kas: build with ptest. remove apparmor
...
apparmor does not build with ptest enabled. skipping it for now
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-29 07:17:55 -07:00
d6baccc068
qemu test: set ptest
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-18 04:06:31 -07:00
8abff56c89
kas-security-base: set RPM and disable ptest
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-18 04:06:31 -07:00
3c3992a184
kas: add alt and mutli build images
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-18 04:06:31 -07:00
f176756890
apparmor: exclude mips64, not supported
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-18 04:06:31 -07:00
91d6d1f5f3
packagegroup-core-security: add more pkgs to base group
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-18 04:06:31 -07:00
0d5662acd1
kas-security-base: define sections as base
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-18 04:06:13 -07:00
7486ab3f5b
ibmtpm2tss: add recipe
...
Add recipe for companion of IBM Software TPM 2.0 - IBM's TPM 2.0 TSS.
It's a user space TSS for TPM 2.0.
Signed-off-by: Jens Rehsack <sno@netbsd.org >
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-13 07:08:49 -07:00
b265ca0b63
clamav: update SO_VER to 9.0.4
...
Signed-off-by: Charlie Davies <charles.davies@whitetree.xyz >
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-13 07:08:34 -07:00
0d72d40772
meta-harden: Add a layer to demo harding OE/YP
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-13 07:05:50 -07:00
0ba6059805
gitlab-ci: add testimage
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-12 08:55:28 -07:00
ea04d3f836
gitlab-ci: add dm-verify-image
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-12 08:55:28 -07:00
2cf817a9a4
kas: add one dm-verify image build
...
gitlab-ci: add qemux86-64-dm-verify build image
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-12 08:55:28 -07:00
0dac8fac90
kas: add test config
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-12 08:55:28 -07:00
415bdc7f0d
kas-security-base: add testimage
...
allow root to login
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-12 08:55:28 -07:00
b9c72cc8bc
ibmswtpm2: update to 1637
...
Update ibmswtpm2 from 1628 to 1637. Build 1637 Includes:
* Increase NV memory size to match PC Client RSA 3072 requirements
* Add and fix ACT support
* Update Visual Studio files to 2019.
Signed-off-by: Jens Rehsack <sno@netbsd.org >
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-12 08:55:28 -07:00
caf76696e8
packagegroup-core-security: dont include suricata on riscv or ppc
...
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-12 08:55:28 -07:00
4602d64208
beaglebone-yocto-verity.wks.in: Refer IMGDEPLOYDIR
...
Since dm-verity-image.bbclass effectively injects
<DM_VERITY_IMAGE>:do_image_<DM_VERITY_IMAGE_TYPE>
dependency for do_image_wic task, we can change verity rootfs artifact
reference here from DEPLOY_DIR_IMAGE to IMGDEPLOYDIR in order to
mitigate following breakage which was observed when bitbaking
<DM_VERITY_IMAGE> target from scratch (using sstate-cache provided
artifacts):
| wic.filemap.Error: cannot open image file '.../build/tmp/deploy/images/beaglebone-yocto/core-image-minimal-beaglebone-yocto.ext4.verity': [Errno 2] No such file or directory: '.../build/tmp/deploy/images/beaglebone-yocto/core-image-minimal-beaglebone-yocto.ext4.verity'
| WARNING: exit code 1 from a shell command.
|
ERROR: Task (.../meta/recipes-core/images/core-image-minimal.bb:do_image_wic) failed with exit code '1'
Signed-off-by: Niko Mauno <niko.mauno@vaisala.com >
Signed-off-by: Armin Kuster <akuster808@gmail.com >
2020-09-12 08:55:28 -07:00
Armin Kuster
Naveen Saini
Adrian
Jens Rehsack
Charlie Davies
niko.mauno@vaisala.com