Commit Graph

1285 Commits

Author SHA1 Message Date
Paul Gortmaker
bd7a25c4dd dm-verity: update beaglebone wic to match meta-yocto
This file was forked from the generic (non verity) version in
meta-yocto, but it would seem that due to limited use, an update
in the parent never made it here, even after two years:

[commit 0c679ac53b52e631a7c961872ce58f5cf74b8629 in meta-yocto]

  From: Kevin Hao <kexin.hao@windriver.com>
  Date: Tue, 23 Mar 2021 17:35:29 +0800
  Subject: [PATCH] meta-yocto-bsp: beaglebone: Set a fixed size for boot
   partition in WIC image

  After the dosfstools has been updated to v4.2 by commit b522f24723e1
  ("dosfstools: update 4.1 -> 4.2"), the commit b29eb5be67e9 ("mkfs.fat:
  Align total number of sectors to be multiple of sectors per track") in
  v4.2 has caused a regression in beagebone black board. The reason is
  that the real total sectors of the fat filesystem created by the mkdosfs
  may not be the same size as what we requested due to align with the
  sectors per track, this change seem no side effect to linux kernel,
  but it breaks the beaglebone black boot ROM and make it can't load the
  MLO. In order to fix this issue, we choose to set a fixed size for the
  boot partition to make sure that the total sectors always are aligned
  with the sectors per track.

  [Yocto #14306]

Bring the same change across, so dm-verity doesn't face the same
frustrating silent boot failure with zero console output.

With this change in place, and allowing for read-only rootfs, we see:

device-mapper: verity: sha256 using implementation "sha256-generic"
EXT4-fs (dm-0): mounted filesystem with ordered data mode. Opts: (null). Quota mode: disabled.
INIT: version 3.01 booting

Note that the above is from booting on real hardware on Kirkstone.

Cc: Kevin Hao <kexin.hao@windriver.com>
Cc: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:27:24 -04:00
Jose Quaresma
0e648bae9c meta-tpm/layer: lower the priority from 10 to 6
The priority change on sumo version without any description.
Since then is very hard to add in other layers a new version
of any recipe on this layer with such priority so these patch
reverts the priority back to 6.

Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:27:24 -04:00
Jose Quaresma
b9eb2b4d82 meta-security-compliance/layer: lower the priority from 10 to 6
The priority change on sumo version without any description.
Since then is very hard to add in other layers a new version
of any recipe on this layer with such priority so these patch
reverts the priority back to 6.

Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:27:24 -04:00
Jose Quaresma
d8306e4824 meta-hardening/layer: lower the priority from 10 to 6
The priority change on sumo version without any description.
Since then is very hard to add in other layers a new version
of any recipe on this layer with such priority so these patch
reverts the priority back to 6.

Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-20 16:27:24 -04:00
Petr Gotthard
c06b9a18a6 tpm2-abrmd: upgrade 2.4.1 -> 3.0.0
Changelog:
https://github.com/tpm2-software/tpm2-abrmd/blob/3.0.0/CHANGELOG.md

Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 15:22:36 -05:00
Petr Gotthard
13653bf807 tpm2-pkcs11: upgrade 1.8.0 -> 1.9.0
Changelog:
https://github.com/tpm2-software/tpm2-pkcs11/blob/1.9.0/CHANGELOG.md

Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 15:22:36 -05:00
Petr Gotthard
1ac7c66afc tpm2-tools: upgrade 5.3 -> 5.5
Changelog:
https://github.com/tpm2-software/tpm2-tools/blob/5.5/docs/CHANGELOG.md

Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 15:22:36 -05:00
Petr Gotthard
e188be029c tpm2-tss: upgrade 3.2.0 -> 4.0.1
Changelog:
https://github.com/tpm2-software/tpm2-tss/blob/4.0.1/CHANGELOG.md

Signed-off-by: Petr Gotthard <petr.gotthard@advantech.cz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 15:22:36 -05:00
Maciej Borzęcki
ab8651c139 dm-verity-img.bbclass: add squashfs images
Add squashfs to images supported by verity.

Signed-off-by: Maciek Borzecki <maciek@thing.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-11 10:36:23 -05:00
Mikko Rapeli
3529cfb43e linux-yocto: drop version from bbappends
These bbappends apply to multiple kernel versions so no
need to make them version dependent. Fixes recipe parsing when
using meta-security master branch on kirkstone. In our custom layer we
set layer compatibility for kirkstone and I understand why meta-security
upstream would not want to do that:

LAYERSERIES_COMPAT_security-layer += 'kirkstone'
LAYERSERIES_COMPAT_parsec-layer += 'kirkstone'
LAYERSERIES_COMPAT_tpm-layer += 'kirkstone'

While I work towards supporting also yocto master branch and newer
releases than kirkstone, I would appreciate if I would not have to
branch off layers over minor details like this.

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-06 07:32:41 -05:00
Max Krummenacher
7eed4a60f5 samhain: rework due to changed cache handling
OE-Core changed the cache handling which made the use of ${BPN} no fail.

| Parsing recipes...WARNING: .../samhain-standalone.bb: Exception during build_dependencies for do_configure
| WARNING: .../samhain-standalone.bb: Error during finalise of .../samhain-standalone.bb
| ERROR: ExpansionError during parsing .../samhain-standalone.bb
| Traceback (most recent call last):
|   File "Var <MODE_NAME>", line 1, in <module>
| bb.data_smart.ExpansionError: Failure expanding variable MODE_NAME, expression was ${@d.getVar('BPN').split('-')[1]} which triggered exception IndexError: list index out of range
| The variable dependency chain for the failure is: MODE_NAME -> SAMHAIN_MODE -> do_configure

Simplify the setting of MODE_NAME and SAMHAIN_MODE by setting them
in the recipe files where we know their values.

bitbake:
ee89ade5 cache/codeparser: Switch to a new BB_CACHEDIR variable for cache location
oe-core:
7c15e03dd3 bitbake.conf: Add BB_HASH_CODEPARSER_VALS

Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-28 10:22:30 -05:00
Armin Kuster
92f04c78f0 meta-tpm: bump linux-yocto to 6.x kernel
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-28 10:17:03 -05:00
Armin Kuster
769ddade73 linux-yocto.bbappend: bump to kernel version 6.x
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-28 10:15:27 -05:00
Chen Qi
3d9dab6d14 openscap: add libpcre DEPEDNS to fix do_configure failure
swig has switched to use libpcre2, we need to add libpcre to
DEPENDS to avoid do_configure failure.

Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-16 09:30:09 -05:00
Markus Volk
d623fc232b bubblewrap: remove recipe
It was moved to meta-oe.

Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-04 10:46:25 -05:00
Martin Jansa
1550c126ce layer.conf: update LAYERSERIES_COMPAT for mickledore
* oe-core switched to mickedore in:
  https://git.openembedded.org/openembedded-core/commit/?id=57239d66b933c4313cf331d35d13ec2d0661c38f

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-04 10:32:16 -05:00
Alex Kiernan
f991b20f56 bubblewrap: Update 0.6.2 -> 0.7.0
Inherit github-releases so that `devtool upgrade` can identify new
versions correctly.

Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-11-19 14:01:41 -05:00
Armin Kuster
2893be10d0 chipsec: update to 1.9.1
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-11-19 14:01:41 -05:00
Armin Kuster
715537c48b python3-privacyidea: update to 2.7.4
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-11-19 14:01:41 -05:00
Michael Haener
dbab46107d tpm2-tools: update to 5.3 2022-11-19 14:01:41 -05:00
Gowtham Suresh Kumar
2aa48e6f4e Update PARSEC recipe to latest v1.1.0 release
This commit updates the parsec-service to v1.1.0 and the parsec-tool
to v0.5.4.

The buildpaths QA check has been disabled and relevant
issue links have been added to address this.

Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
2022-10-24 10:27:58 -04:00
Michael Haener
6bc02ba989 tpm2-openssl: update to 1.1.1
Signed-off-by: Michael Haener <michael.haener@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-10-24 10:27:58 -04:00
Armin Kuster
d7d3056ed7 kas-security-base.yml: make work again
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-10-24 10:27:58 -04:00
Armin Kuster
e8e7318189 cryptmount: update to 6.0
LIC_FILES_CHKSUM changed do to yr change
Drop patch remove_linux_fs.patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-25 15:19:51 -04:00
Armin Kuster
b29ce7d47d libgssglue: update to 0.7
LIC_FILE_CHKSUM changes to to indentations changes.
use bootstrap to setup config properly.

Drop libgssglue-fix-CVE-2011-2709.patch, libgssglue-g-initialize.patch now included in update.
  and ibgssglue-mglueP.patch now included in update.

Drop libgssglue-gss-inq-cred.patch still pending after 5 yrs.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-25 13:37:57 -04:00
Armin Kuster
852daaf67b apparmor: update to 3.0.7
Fix typo in HOMEPAGE

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-25 12:18:45 -04:00
Michael Haener
014f9dab78 tpm: update the linux-yocto rule with the one from sanity-meta-tpm class 2022-09-25 11:29:43 -04:00
Armin Kuster
824d2762f6 update chipsec to 1.8.8
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-12 11:11:50 -04:00
Armin Kuster
8a4ed4034f update sssd to 2.7.4
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-12 11:11:50 -04:00
Armin Kuster
ee8a51c582 cryptmount: fix systemd service install
Default is to install the service in /usr/lib

Signed-off-by: Armin Kuster <akuster808@gmail.com>

--
[V2]
Fix typo in subject
2022-09-12 11:11:50 -04:00
Armin Kuster
b59691b3d9 suricata: fix compile issue
make[2]: *** No rule to make target '../rust/target/arm-poky-linux-gnueabi/release/libsuricata.a', needed by 'suricata'

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-09-12 11:11:50 -04:00
Armin Kuster
10fdc2b13a kas: update testimage inherit
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-25 08:24:12 -04:00
Anton Antonov
2753e73086 parsec-service: Update oeqa tests
Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
2022-08-25 08:17:39 -04:00
Anton Antonov
64b64696a9 Use CARGO_TARGET_SUBDIR in do_install
Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
2022-08-25 08:17:39 -04:00
Armin Kuster
aa57a13788 cyptmount: Fix mount.h conflicts seen with glibc 2.36+
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-25 08:15:58 -04:00
Mingli Yu
ea5bb2f2e7 samhain-standalone: fix buildpaths issue
Fixes:
  WARNING: samhain-standalone-4.4.9-r0 do_package_qa: QA Issue: File /usr/share/doc/samhain-standalone/scripts/samhain.ebuild-light in package samhain-standalone-doc contains reference to TMPDIR
  File /usr/share/doc/samhain-standalone/scripts/samhain.ebuild in package samhain-standalone-doc contains reference to TMPDIR [buildpaths]

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-25 08:14:21 -04:00
John Edward Broadbent
571af37e9c meta-security: Add recipe for Glome
Generic Low Overhead Message Exchange (GLOME) is a protocol providing
secure authentication and authorization for low dependency environments.

Signed-off-by: John Edward Broadbent <jebr@google.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-12 08:32:51 -07:00
Armin Kuster
5f530ba5ab packagegroup-core-security: add pkg to grp
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-12 08:32:51 -07:00
Armin Kuster
8e26e9dc7a cryptmount: Add new pkg
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-12 08:32:51 -07:00
Armin Kuster
c352530c13 packagegroup-core-security: add space for appends
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-06 08:55:49 -07:00
Armin Kuster
a891026392 apparmor: update to 3.0.6
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-06 08:55:41 -07:00
Armin Kuster
13120455a5 lkrg-module: update to 0.9.5
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-06 08:55:34 -07:00
Armin Kuster
8173cc90c8 python3-privacyidea: update to 3.7.3
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-06 08:55:26 -07:00
Armin Kuster
2a2d650ee0 packagegroup-core-security: remove krill for some archs
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
70859e8608 krill: only builds on x86/x86-64 and arm64
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
4e0ba84530 lkrg: update to 0.9.4
drop Makefile fixup patch. Use sed instead

LIC_FILES_CHKSUM update do to yr update

Signed-off-by: Armin Kuster <akuster808@gmail.com>

---
V2]
Add LIC_FILES_CHKSUM change reason
2022-08-02 13:45:26 -07:00
Armin Kuster
8a90b05e72 swtpm: update to 0.7.3
drop musl patch.Fix another way

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
e73c62adf7 ibmswtpm2: update to 1682
fixes openssl 3.0 support

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
67c42369b3 ibmswtpm2: fix UPSTREAM_CHECK
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00
Armin Kuster
55b5906ddd ibmtpm2tss: update version format
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 13:45:26 -07:00