mirrors/meta-security
1
0
Fork 0
mirror of https://git.yoctoproject.org/meta-security synced 2026-04-20 11:29:37 +00:00
Code Issues Projects Releases Wiki Activity
856 Commits 38 Branches 0 Tags
a67a0cb1bdf3f0ea42be339964ba68c5ecc5e9ed
Commit Graph

856 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mingli Yu
15061e3a4e linux-yocto: update the bbappend to 5.x 
As linux-yocto upgraded to 5.x in oe-core, update
the bbappend to 5.x to remove the warning:

WARNING: No recipes available for:
  /buildarea/layers/meta-security/recipes-kernel/linux/linux-yocto_4.%.bbappend

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
[Droped 4.x part]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-03-05 08:06:44 -08:00
Yi Zhao
b23e7eac2d scap-security-guide: pass the correct schema file path to openscap-native 
There is a build error when using openscap-native sstate cache.
Steps to reproduce:
Create a new build project in build-1 directory.
$ bitbake openscap-native
Then remove the whole build directory only keep the sstate-cache
directory as a sstate mirror.

Create another new build project in build-2 directory.
Set SSTATE_MIRRORS
$ bitbake scap-security-guide

Error message:
OpenSCAP Error: Schema file 'xccdf/1.1/xccdf-schema.xsd' not found in path
'/buildarea/build-1/tmp/work-shared/openscap/oscap-build-artifacts/usr/share/openscap/schemas' when trying to validate
'/buildarea/build-2/tmp/work/core2-64-poky-linux/scap-security-guide/0.1.44+gitAUTOINC+5fdfdcb2e9-r0/git/build/jre/xccdf-unlinked-resolved.xml'
[/buildarea/build-1/tmp/work/x86_64-linux/openscap-native/1.3.1+gitAUTOINC+4bbdb46ff6-r0/git/src/source/validate.c:104]

The oscap command from openscap-native tries to find the schema files in
build-1 directory since these paths are hardcoded when building
openscap-native.

We need to pass the correct schema/xslt/cpe paths to oscap to make sure
it can find the files in right location.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-03-05 07:20:07 -08:00
Armin Kuster
17b0f42647 secuirty*-image: remove dead var and minor cleanup 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-03-01 22:16:14 -08:00
Bartosz Golaszewski
a3f5288624 linux: drop the bbappend for linux v4.x series 
v4.19 LTS has been dropped in poky in favor of v5.4. Drop the bbappend
from meta-security as right now the build fails.

Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-03-01 22:16:14 -08:00
Armin Kuster
290b4bbf8c clamav-native: missed bison fix 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-03-01 22:16:14 -08:00
Armin Kuster
209ccfea1a README.md: update to new maintainer 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-03-01 22:16:14 -08:00
Armin Kuster
7fcf17b9fe layer.conf: add zeus 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-03-01 22:16:14 -08:00
Armin Kuster
0e0472f376 isafw: fix to work against master 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-03-01 22:16:14 -08:00
Armin Kuster
4842e14299 meta-security-isafw: import layer from Intel 
take over layer

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-03-01 22:16:14 -08:00
Armin Kuster
73cb9a32dc clamav: add bison-native to depend 
fixes build issue:
clamav/0.101.5-r0/git/config/ylwrap: line 176: yacc: command not found

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-03-01 22:16:14 -08:00
Armin Kuster
0d8cee5029 apparmor: update to tip 
fixes Python3.8 configure issues

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-02-17 19:13:30 -08:00
Armin Kuster
2a91f5cc62 google-authenticator-libpam: install module in pam location 
pam_google_authenticator.so was being installed where pam could not find
it. Move it where the rest of the pam modules site.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-02-16 08:49:20 -08:00
Armin Kuster
238b8936e6 python3-fail2ban: add 2-3 conversion changes 
Had to use the fail2ban-2.3 program to create py3 code
Add it as a patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-02-16 08:48:43 -08:00
Armin Kuster
676d7166a2 ibmswtpm2: update to 1563 
fix build issue

[v2]
Fix subject line

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-02-10 19:13:52 -08:00
Armin Kuster
5f258016b3 tpm2-tss: update to 2.3.2 
clean up reciped. drop git fetching

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-02-10 19:13:52 -08:00
Armin Kuster
e87130f429 tpm2-tcti-uefi: fix build issue for i386 machine 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-02-10 19:13:52 -08:00
Armin Kuster
f2e9e8f96f tpm2-tools: update to 4.1.1 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-02-10 19:13:52 -08:00
Armin Kuster
2df5bbcf17 bastille: convert to py3 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-02-10 19:13:52 -08:00
Yi Zhao
ace43479e7 scap-security-guide: fix xml parsing error when build remediation files 
Backport 2 patches to fix the build error:

Processing fix.text for: java_jre_configure_crypto_policy rule
Unable to extract part of the fix.text after inclusion of remediation functions. Aborting..
jre/CMakeFiles/generate-internal-jre-bash-fixes.xml.dir/build.make:60:
recipe for target 'jre/bash-fixes.xml' failed
make[2]: *** [jre/bash-fixes.xml] Error 1
make[2]: *** Deleting file 'jre/bash-fixes.xml'

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-02-09 09:33:22 -08:00
Armin Kuster
2732ab1467 ecryptfs-utils: search nspr header files in ${STAGING_INCDIR}/nspr directory 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-02-02 08:38:43 -08:00
Armin Kuster
84fb57b53f swtpm: fix configure error 
checking for whether to build with seccomp profile... configure: error: "Is libseccomp-devel installed? -- could not get cflags for libseccomp"

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-02-01 09:52:51 -08:00
Armin Kuster
037adba72e buck-security: fix rdebends and minor style cleanup 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-01-28 10:02:36 -08:00
Armin Kuster
3e9b32c714 checksecurity: fix runtime issues 
add some missing perl modules

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-01-28 10:02:36 -08:00
Armin Kuster
dc0403042b linux-yocto-dev: remove "+" 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-01-28 10:02:36 -08:00
Pierre-Jean Texier via Lists.Yoctoproject.Org
4c98f16973 google-authenticator-libpam: upgrade 1.07 -> 1.08 
See changelog: https://github.com/google/google-authenticator-libpam/releases/tag/1.08

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-01-28 10:02:36 -08:00
Yi Zhao
4f65c58251 samhain: fix build with new version attr 
The attr/xattr.h has been removed from attr 2.4.48 with commit:
http://git.savannah.nongnu.org/cgit/attr.git/commit/include?id=7921157890d07858d092f4003ca4c6bae9fd2c38
The xattr syscalls are provided by sys/xattr.h from glibc now.
Remove the checking code to adapt it otherwise it would fail to build
with selinux support.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-01-28 10:02:21 -08:00
Armin Kuster
197d3588b6 Apparmor: fix some runtime depends 
missing xargs and comm

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-01-23 19:53:31 -08:00
Armin Kuster
b02f3fae9d python3-fail2ban: update to latest 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-01-21 21:41:57 -08:00
Armin Kuster
fa8d29bffc sssd: drop py2 support 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-01-21 21:41:20 -08:00
Armin Kuster
4295cfa89e README: add pull request option 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-01-19 22:51:11 -08:00
Armin Kuster
b72cc7f87c fail2ban: fix runtime error 
use success/failure calls in initd/function

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-01-05 16:09:44 -08:00
Armin Kuster
5d629ccb54 meta-integrity: fix issues with yocto-check-layer 
[v2]
re-did solutions

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-01-04 10:55:26 -08:00
Armin Kuster
912ead8099 clamav: update to 0.101.5 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-01-03 11:54:58 -08:00
Armin Kuster
6400eba66a lib/oeqa/runtime: fix clamav test order 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2020-01-03 11:54:14 -08:00
Armin Kuster
41506052f6 smack-test: add feature check for smack 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-25 16:04:27 +00:00
Armin Kuster
6b42f1c033 google-authenticator-libpam: update to 1.07 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-25 16:04:27 +00:00
Armin Kuster
4786213cab python3-fail2ban: include python-fail2ban.inc 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-25 16:04:27 +00:00
Armin Kuster
36ebd09b06 python-fail2ban: Drop python2 package 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-25 16:04:27 +00:00
Armin Kuster
980bdff22e smack: add distro check 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-25 16:04:27 +00:00
Armin Kuster
2e5662214d apparmor: add distro check 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-25 16:04:27 +00:00
Armin Kuster
3001c3ebfc suricata: update to 4.1.6 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-16 20:51:47 -08:00
Armin Kuster
0ca8cad641 lib/oeqa/runtime: suricata add tests 
drop the unit test as it should be run via ptest
add more tests for python3-suricata-update

Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-16 20:51:35 -08:00
Armin Kuster
79983488a7 libhtp: bugfix only update 0.5.32 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-16 20:51:13 -08:00
Armin Kuster
195157e5a0 python3-suricata-update: update to 1.1.1 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-16 20:51:08 -08:00
Yi Zhao
2c2161fbc2 libseccomp: upgrade 2.4.1 -> 2.4.2 
Backport a patch to fix ptest build failure on arm64.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-16 20:51:00 -08:00
Armin Kuster
1bad7ebf9c meta-security-compliance/conf/layer.conf: fix typo 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-15 08:45:49 -08:00
Philip Tricca
4029f92ac8 tpm2-abrmd: Port command line options to new version. 
These have changed upstream.

Signed-off-by: Philip Tricca <flihp@twobit.org>
Signed-off-by: Diego Santa Cruz <Diego.SantaCruz@spinetix.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-07 15:31:42 -08:00
Trevor Woerner
6d059a9d34 tpm2-abrmd-init.sh: fix for /dev/tpmrmX 
Newer kernels, in addition to the traditional /dev/tpmX device nodes, are now
also creating /dev/tpmrmX device nodes. This causes this script to get
confused and abort, meaning tpm2-abrmd does not get started during boot.

Fix for https://github.com/flihp/meta-measured/issues/56

Signed-off-by: Trevor Woerner <twoerner@gmail.com>
Signed-off-by: Diego Santa Cruz <Diego.SantaCruz@spinetix.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-07 15:31:42 -08:00
Armin Kuster
72b05edff5 meta-security: add layer index callouts 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-07 15:31:34 -08:00
Armin Kuster
2df7dd9fba README: update mailing list to new groups.io 
Signed-off-by: Armin Kuster <akuster808@gmail.com>
 2019-12-05 18:00:46 -08:00