Commit Graph

59 Commits

Author SHA1 Message Date
Armin Kuster
ac0a4ea0f8 packagegroup-core-security.bb: add bubblewrap to pkg grp
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-30 14:11:27 -07:00
Armin Kuster
f453866cf6 security-build-image: add lkrg-module to build image
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-23 18:47:59 -07:00
Armin Kuster
a68a46ded9 packagegroup-core-security: skip mips firejail
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-23 18:47:59 -07:00
Armin Kuster
123c59c313 security-test-image: add firejail and aide test suites
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-23 18:47:59 -07:00
Armin Kuster
6cdb369591 packagegroup-core-security: add firejail
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-23 18:47:59 -07:00
Armin Kuster
6c77d06b84 security-test-image: auto include layers if present.
This is to simplify tesing to build one image and include pkgs depending on the
layers included in the BBLAYERS.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-18 06:48:22 -07:00
Armin Kuster
db2ebfc0d3 packagegroup-core-security: drop sssd
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-18 06:48:22 -07:00
Armin Kuster
8c6fe006a1 packagegroup-core-security: don't include aprwatch for musl
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-07 16:58:24 -07:00
Armin Kuster
5bdb7a35c1 packagegroup-core-security: drop arpwatch for riscv from pkg grp
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-07 16:58:24 -07:00
Armin Kuster
982ff6fb97 packagegroup-core-security: add arpwatch and chkrootkit to pkg grp
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-07 16:58:24 -07:00
Armin Kuster
bc59937b54 packagegroup-core-security.bb: fix suricata inclusion
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-14 10:51:32 -07:00
Armin Kuster
55839bcd20 packagegroup-core-security: remove pkgs
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-14 10:51:32 -07:00
Armin Kuster
e740a30c10 libest: does not build with openssl 3.x
blacklist for now. Remove from pkg grp

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-25 11:29:31 -08:00
Armin Kuster
e5e54135da opendnssec: blacklist do to ldns being blacklisted
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-10-24 19:54:00 -07:00
Christer Fletcher
650e6d6d4b dmverity: Make use of DATA_BLOCK_SIZE variable in initrdscript.
DATA_BLOCK_SIZE variable was set in dm-verity-img.bbclass at build
time but the initrdscript was not updated to pass the DATA_BLOCK_SIZE
to the veritysetup. Now the functionality is complete.

Signed-off-by: Paulo Neves <paulo.neves1@inter.ikea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-09-28 16:18:41 -07:00
Armin Kuster
c885d399cd packagegroup-core-security.bb: only include suricat-ptest if rust is included
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-01 08:47:08 -07:00
Armin Kuster
11a67b861a meta-security: Convert to new override syntax
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-01 08:47:08 -07:00
Armin Kuster
f447658731 packagegroup-core-security.bb: fix suricat-ptest inclusion
drop libseccomp ptest

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-28 18:21:25 -07:00
Armin Kuster
be53d1a467 initramfs-framework: rename files dir
Fixes:
ERROR: initramfs-framework-1.0-r4 do_fetch: Fetcher failure for URL: 'file://dmverity'. Unable to fetch URL from any source.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-06-29 09:31:13 -07:00
Armin Kuster
8f313d951c packagegroup-core-security: add sshguard
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-06-29 09:31:13 -07:00
Armin Kuster
54186fc738 initramfs-framework: fix typo in conditional
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-06-29 09:31:13 -07:00
Armin Kuster
0c26950b0d packagegroup-core-security: drop python3-scapy
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-06-05 19:25:24 +00:00
Armin Kuster
f40fdc7e6d initramfs-framework: fix YCL issue.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-06-05 19:25:24 +00:00
Armin Kuster
a1d5476acc busybox: drop as libsecomp is in core
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-06-05 19:25:23 +00:00
Armin Kuster
e1f0699492 packagegroup-core-security: exclude ossec-hids from musl
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-06-05 19:25:17 +00:00
Armin Kuster
ab239f1497 packagegroup-core-security: add clamav-daemon
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-16 13:23:55 -07:00
Armin Kuster
31e5b3e08f packagegroup-core-security: add aide and ossec
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-16 13:23:55 -07:00
Armin Kuster
06101dd3da packagegroup-core-security: fix typo for mips
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-16 13:23:55 -07:00
Armin Kuster
7db47965a2 tripwire: Blacklist pkg, upstream seems abandond
Last update was 2018. Does not build with gcc11.
There are other actively maintained IDS options.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-16 13:23:55 -07:00
Armin Kuster
881d441f71 packagegroup-core-security: exclude apparmor in mips64
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-19 06:56:18 -07:00
Armin Kuster
44d51ebff5 packagegroup-core-security: drop clamav-cvd
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-02 08:21:34 -07:00
Armin Kuster
496a734c14 packagegroup-core-security: remove clamav from musl image
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-10 16:21:48 -07:00
Armin Kuster
8bab022533 packagegroup-core-security: apparmor 3.0 ptest does not build
for now skip apparmor ptest

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09 07:02:01 -07:00
Armin Kuster
21489a2942 security-test-image: tweak to get more tests to runn
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09 07:02:01 -07:00
Naveen Saini
e23767fc72 initramfs-framework/dmverity: add retry loop for slow boot devices
Detection of USB devices by the kernel is slow enough. We need to
keep trying for a while (default: 5s seconds, controlled by roottimeout=<seconds>)
and sleep between each attempt (default: one second, rootdelay=<seconds>).

Fix is based on https://git.yoctoproject.org/cgit.cgi/poky/commit/meta/recipes-core/initrdscripts/initramfs-framework/rootfs?id=ee6a6c3461694ce09789bf4d852cea2e22fc95e4

Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-09 07:01:47 -07:00
Armin Kuster
ab56b1df52 packagegroup-core-security-ptest: remove
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-01 06:22:07 -07:00
Armin Kuster
b03d65ffe4 security-test-image: simplify
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-01 06:22:07 -07:00
Armin Kuster
60a17b82d2 packagegroup-core-security-ptest: remove keyutils-ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-10-01 06:22:07 -07:00
Armin Kuster
cef1768aff packagegroup-core-security: add opendnssec to pkg grp
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-29 07:18:24 -07:00
Armin Kuster
082305ded8 packagegroup-core-security: add libest package
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-29 07:18:24 -07:00
Armin Kuster
f0c6f7769c packagegroup-core-security: add softHSM
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-29 07:18:24 -07:00
Armin Kuster
91d6d1f5f3 packagegroup-core-security: add more pkgs to base group
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-18 04:06:31 -07:00
Armin Kuster
caf76696e8 packagegroup-core-security: dont include suricata on riscv or ppc
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
niko.mauno@vaisala.com
5f196cf59d dm-verity-image-initramfs: Drop locales from image
Since IMAGE_LINGUAS defaults to 'en-us en-gb' and since localization is
not needed on this type of purpose-specific initramfs image, reset the
variable which helps by shaving off almost 700kB from resulting bundled
zImage-initramfs artifact.

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
niko.mauno@vaisala.com
e88895e109 dm-verity-image-initramfs: Add base-passwd package
This removes following boot-time complaints from udevd regarding
missing group declarations:

  [    6.624454] udevd[163]: specified group 'tty' unknown
  [    6.625340] udevd[163]: specified group 'dialout' unknown
  [    6.625692] udevd[163]: specified group 'kmem' unknown
  [    6.626022] udevd[163]: specified group 'input' unknown
  [    6.626541] udevd[163]: specified group 'video' unknown
  [    6.626977] udevd[163]: specified group 'audio' unknown
  [    6.627532] udevd[163]: specified group 'lp' unknown
  [    6.628187] udevd[163]: specified group 'disk' unknown
  [    6.628558] udevd[163]: specified group 'cdrom' unknown

Size impact of this change on resulting bundled zImage-initramfs
artifact is less than +1kB which is neglible.

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
niko.mauno@vaisala.com
1d21cec5fd dm-verity-initramfs-image: Cosmetic improvements
- revise declaration ordering as suggested by oe-stylize.py
 - sort PACKAGE_INSTALL entries in alphabetic order
 - split long command line in deploy_verity_hash()

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
niko.mauno@vaisala.com
45e8b20cd0 dm-verity-image-initramfs: Use initramfs-framework
Switch from this layer's initramfs-dm-verity recipe to poky-provided
initramfs-framework suite to manage veritysetup et al.

This commit also removes initramfs-dm-verity recipe which is not
referred from elsewhere in this meta layer.

Also update the install path of dm-verity.env from /usr/share to
/usr/share/misc in order to better comply with FHS3.0, see
https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s11.html#usrsharemiscMiscellaneousArchitecture

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
niko.mauno@vaisala.com
489f7c900c initramfs-framework: Add dmverity module
Add 'initramfs-module-dmverity' as an extension to poky upstream
provided initramfs-framework suite via matchingly named bbappend file.

Together with pre-existing 'initramfs-module-udev' this module can be
used to facilitate dm-verity rootfs mounting from initramfs context
that is bundled with Linux kernel.

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
niko.mauno@vaisala.com
170945ff9f dm-verity-img.bbclass: Stage verity.env file
Introduce new STAGING_VERITY_DIR variable specific to this bbclass which
defines the directory where the verity.env file is stored during
<DM_VERITY_IMAGE>:do_image_<DM_VERITY_IMAGE_TYPE> task and can
consequtively be picked up into associated initramfs rootfs (which
facilitates executing 'veritysetup' and related actions).

By doing this we mitigate failures that were thus far associated to this
facility, such as

  install: cannot stat '.../build/tmp/deploy/images/qemux86-64/core-image-minimal-qemux86-64.ext4.verity.env': No such file or directory

and

  install: cannot stat '.../build/tmp/deploy/images/beaglebone-yocto/core-image-minimal-beaglebone-yocto.ext4.verity.env': No such file or directory

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00
niko.mauno@vaisala.com
03fdaf2f04 dm-verity-image-initramfs: Bind at do_image instead
Bind custom actions in this image recipe in do_image() rather than
do_rootfs(), which can help shaving even dozens of seconds from duration
of 'bitbake <DM_VERITY_IMAGE>' command re-execution.

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-09-12 08:55:28 -07:00