Commit Graph

1117 Commits

Author SHA1 Message Date
Armin Kuster
cfb79c913f linux-yocto_security.inc: add lkrg kfrags
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-07 10:26:45 -07:00
Armin Kuster
fb67042242 lkrg-module: covert to git fetcher
This allows to track tip easier.
refresh patch
Fix LICENSE to match SPDX format

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-07 10:26:45 -07:00
Armin Kuster
2be1d069ec python3-fail2ban: fix compile issue on some hosts
Use python3-native to use 2to3

Fix build issue on some hosts with this error:
 (result, consumed) = self._buffer_decode(data, self.errors, final)
 | UnicodeDecodeError: 'utf-8' codec can't decode byte 0xd8 in position 152: invalid continuation byte

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-02 11:21:42 -07:00
Robert Yang
0c41d792cf LICENSE: adopt SPDX standard names
Modify LICENSE for ding-libs and libmhash.

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-02 11:21:42 -07:00
Ashish Sharma
c56ae450c9 meta-security : Use SPDX style licensing format
WARNING: selinux-sandbox-3.3-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \
WARNING: selinux-gui-3.3-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \
WARNING: semodule-utils-3.3-r0.1 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \
WARNING: selinux-dbus-3.3-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2+ [obsolete-license] \
WARNING: libwhisker2-perl-2.5-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPL-1.0+ [obsolete-license] \
WARNING: lib-perl-0.63-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPL-1.0+ [obsolete-license] \
WARNING: libhtp-0.5.39-r0 do_package_qa: QA Issue: Recipe LICENSE includes obsolete licenses GPLv2 [obsolete-license] \
...

Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-02 11:21:42 -07:00
Armin Kuster
943f48419a openscap-daemon: use renamaed python_setuptools_build_meta
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-02 11:21:34 -07:00
Armin Kuster
da93339112 kas-security-alt: drop rust layer
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-13 08:11:29 -07:00
Armin Kuster
288391edc5 python3-privacyidea: drop old package ref.
meta-python dropped package via commit:

620689d4efba28bc8dd60e2d82908bfb3531fbd0
python3-backports-functional-lru-cache: remove, not needed for Python 3

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-13 08:11:21 -07:00
Ashish Sharma
e5e3dd4877 Subject: [PATCH] Subject: python3-fail2ban: switch to legacy setuptools3
raise InvalidWheelFilename(f"{filename} is not a valid wheel filename.")
pip._internal.exceptions.InvalidWheelFilename: fail2ban-*-*.whl is not a valid wheel filename.
Removed build tracker: '/tmp/pip-req-tracker-qnepnk46'

ERROR: Failed to pip install wheel. Check the logs.

Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:13:15 -08:00
Armin Kuster
30f34fa990 python3-fail2ban: fix SPDX license.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:12:56 -08:00
Armin Kuster
da23c2a094 tpm2-tss: fix user perms
[Yocto #14724]

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:12:46 -08:00
Armin Kuster
46622a3b26 tpm-tools: Fix pod2man race
On some systems, pod2man is not available so add native depends.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:41 -08:00
Armin Kuster
ddb27e71d8 ima-evm-keys: don't use lnr
lnr is a script in oe-core that creates relative symlinks, with the same
behaviour as `ln --relative --symlink`.  It was added back in 2014[1] as
not all of the supported host distributions at the time shipped
coreutils 8.16, the first release with --relative.

However the oldest coreutils release in the supported distributions is
now 8.22 in CentOS 7, so lnr can be deprecated and users switched to ln.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
47bbac5242 libtpm: update to 0.9.2
includes: CVE-2021-3623

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
6ea6a4982c swtpm: update to 0.7.1
fixes: CVE-2022-23645.
Add implementation of SWTPM_HMAC using OpenSSL 3.0 APIs

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
6c3262f5bb openscap-daemon: fix wheels and License issues.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
be65e1c3ba python3-privacyidea: update to 3.6.2
Fix license.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
dac1280dee python3-privacyidea: fix QA ERROR
ERROR: python3-privacyidea-3.5.2-r0 do_package: QA Issue: python3-privacyidea: Files/directories were installed but not shipped in any package:
/usr/etc
/usr/etc/privacyidea
/usr/etc/privacyidea/dictionary
/usr/etc/privacyidea/privacyideaapp.wsgi

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Akshay Bhat
ba4485f331 meta-security-isafw: Fixes to work with oe-core master
Update isafw bbclass to build with oe-core master
- prelink support was dropped in oe-core as part of 23c0be78106f
- do_populate_cve_db was renamed to do_fetch in oe-core as part
of f5f97d33a1703d

Signed-off-by: Akshay Bhat <akshay.bhat@timesys.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
2993f459fc parsec-service: Only enable TPM is layer and DISTRO_FEATURE is defined.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
048cc16aef layer.conf: enable apparmor for qemu machine
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:08:22 -08:00
Armin Kuster
0272f7ff02 apparmor: update to 3.0.4
drop to patches no longer needed
use setuptools

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:07:52 -08:00
Armin Kuster
75073a5617 packagegroup-security-tpm: Fix QA Error
ERROR: packagegroup-security-tpm-1.0-r0 do_package_write_rpm: An allarch packagegroup shouldn't depend on packages which are dynamically renamed (libtpm-dbg to libtpms-dbg)
ERROR: packagegroup-security-tpm-1.0-r0 do_package_write_rpm: An allarch packagegroup shouldn't depend on packages which are dynamically renamed (libtpm to libtpms0)
ERROR: packagegroup-security-tpm-1.0-r0 do_package_write_rpm: An allarch packagegroup shouldn't depend on packages which are dynamically renamed (libtpm-dev to libtpms-dev)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:07:52 -08:00
Armin Kuster
c8681cc40f README.md: fix typo
Fix typo in parsec-tools to parsec-tool

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-11 21:07:52 -08:00
Anton Antonov
6cc8dde794 Upgrade parsec-tool to 0.5.1
Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-25 07:19:55 -08:00
Armin Kuster
cc11c8c0ab smack: Use new CVE_CHECK_IGNORE variable
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-22 08:10:02 -08:00
Armin Kuster
8ff2d27721 chipsec: fix WARNING
distutils3.bbclass is deprecated, please use setuptools3.bbclass instead

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-22 08:10:02 -08:00
Armin Kuster
419946655d recipes: Use renamed SKIP_RECIPE varFlag
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-22 08:09:54 -08:00
Armin Kuster
30a4227e3c layer.conf: Update to use kirkstone
Update the layers to use the kirkstone namespace. No compatibility is made
for honister due to the variable renaming.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-20 19:39:36 -08:00
Patrick Williams
a6fc2597b4 tpm2-pkcs11: fix RDEPENDS variable
The RDEPENDS variable was misspelled and as a result was never fixed up
with the `_${PN}` to `:${PN}` transition.  Fix both aspects.

Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-20 19:39:36 -08:00
Akshay Bhat
caec0c657d scap-security-guide: Fix openembedded platform tests
Update the installed_OS_is_openembedded check to drop the quotes
in the VERSION_ID string to match f451c68667cca of openembedded-core.
Without this fix, all tests are reported as "notapplicable".

Signed-off-by: Akshay Bhat <akshay.bhat@timesys.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-20 19:39:28 -08:00
Akshay Bhat
9cd85e054f meta-hardening: Fix override syntax
Commit 352e6498a missed updating the override syntax for the
"harden" distro override.

Fixes: 352e6498a ("meta-hardening: Convert to new override syntax")

Signed-off-by: Akshay Bhat <akshay.bhat@timesys.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-20 19:38:30 -08:00
Armin Kuster
7898fc8117 parsec-service: fix compile issue.
|   thread 'main' panicked at 'Failed to find tss2-sys library.: Command { command: "\"pkg-config\" \"--libs\" \"--cflags\" \"tss2-sys\" \"tss2-sys >= 2.3.3\"", cause: Os { code: 2, kind: NotFound, message: "No such file or directory" } }', /home/akuster/oss/clean/poky/build/tmp-glibc/work/cortexa57-oe-linux/parsec-service/0.8.1-r0/cargo_home/bitbake/tss-esapi-sys-0.2.0/build.rs:62:10

add inherit pkgconfig

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-20 19:38:30 -08:00
Armin Kuster
32c0e160ea tpm2-tss: update to 3.1.0
Drop 001-configure.ac-fix-compatibility-with-autoconf-2.70.patch which is included in update.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-20 19:38:30 -08:00
Armin Kuster
c62664348d suricata: update to 6.0.4
bump lexical-core to 0.6.8

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-04 12:56:43 -08:00
Armin Kuster
7df64c5c2e lkrg-module: update to 0.9.2
see https://github.com/lkrg-org/lkrg
Support new stable and mainline kernels 5.14 to at least 5.16-rc*
Support new longterm kernels 5.4.118+, 4.19.191+, 4.14.233+

update SRC_URI as location changed.
refresh patch.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-04 11:33:41 -08:00
Armin Kuster
deeadddfb4 tpm2-pkcs11_1.7.0: Drop dstat from DPENDS
dstat was removed from meta-oe.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-01-30 12:14:37 -08:00
Armin Kuster
0594aee231 packagegroup-security-tpm2.bb: remove dynamic pkgs
fixes:
packagegroup-security-tpm2-1.0-r0 do_package_write_rpm: An allarch packagegroup shouldn't depend on packages which are dynamically renamed (libtss2-tcti-device to libtss2-tcti-device0)

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-01-30 12:14:37 -08:00
Yi Zhao
c763e2715c samhain: upgrade 4.4.3 -> 4.4.6
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-01-30 12:14:37 -08:00
Armin Kuster
b46386395b google-authenticator-libpam: update to 1.09
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-01-30 12:13:54 -08:00
Armin Kuster
c20b35b527 meta-tpm: drop strongswan bbappends
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-27 11:47:56 -08:00
Armin Kuster
d6f8b795a8 meta-integrity: drop strongswan bbappends
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-27 11:47:51 -08:00
Armin Kuster
147ed69a19 packagegroup-security-tpm2: drop ibmswtpm2
ibmswtpm2 has not been ported to openssl 3

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-27 11:47:15 -08:00
Armin Kuster
e3b50febf8 tpm2-pkcs11: backport openssl 3.x build fixes
bump to tip of current sources.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-27 11:47:11 -08:00
Kristian Klausen
126860dac3 dm-verity-img.bbclass: Fix wrong override syntax for CONVERSION_DEPENDS
CONVERSION_DEPENDS hasn't been converted to the new syntax.

Fixes: a23ceef ("dm-verity-img.bbclass: more overided fixups")

Signed-off-by: Kristian Klausen <kristian@klausen.dk>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-25 11:31:45 -08:00
Armin Kuster
cb7778e5ef python3-fail2ban: update to tip
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-25 11:29:31 -08:00
Armin Kuster
587c92251d clamav: fix useradd warning
WARNING: security-build-image-1.0-r0 do_rootfs: [log_check] security-build-image: found 2 warning messages in the logfile:
[log_check] warning: user clamav does not exist - using root
[log_check] warning: group clamav does not exist - using root

clamav-freshclam is the package needing to have its user/group set.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-25 11:29:31 -08:00
Armin Kuster
e740a30c10 libest: does not build with openssl 3.x
blacklist for now. Remove from pkg grp

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-25 11:29:31 -08:00
Armin Kuster
9bf5c504d1 tpm2-pkcs11: update to 1.7.0
drop patch now included.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-25 11:29:19 -08:00
Yi Zhao
e4a49814e1 meta-parsec/README.md: fix for append operator combined with +=
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-28 16:16:19 -08:00