Commit Graph

1697 Commits

Author SHA1 Message Date
Armin Kuster 8f8a42eec8 linux-%: remove kernel fragments now in cache
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-15 20:10:26 -07:00
Yi Zhao 26e306b9d2 xmlsec1: upgrade 1.2.27 -> 1.2.28
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-11 20:16:16 -07:00
Dmitry Eremin-Solenikov 9549b76a90 layer.conf: switch to keyutils from meta-oe
As pointer by Martin Jansa, keyutils package is now a part of meta-oe,
so switch to using keyutils from that layer.

Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-07 07:09:50 -07:00
Yi Zhao 531f6c1a4d scap-security-guide: fix typo
Fix typo: RDEPNEDS_${PN} -> RDEPENDS_${PN}

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-07 07:09:50 -07:00
Yi Zhao daf92c57fa openscap: cleanup DEPENDS
Remove autoconf-archive from DEPENDS because it is using CMake/Ninjia
build now. Also remove unused dpkg-native dependency from
DEPENDS_class-native.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-07 07:09:50 -07:00
Dmitry Eremin-Solenikov eebe0ff18a linux: add support for kernel modules signing
Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
2019-08-07 07:09:50 -07:00
Dmitry Eremin-Solenikov 79bc2559fe kernel-modsign.bbclass: add support for kernel modules signing
Add bbclass responsible for handling signing of kernel modules.

Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>

fixup class to avoid including in every configure task

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-07 07:09:43 -07:00
Dmitry Eremin-Solenikov c2ddc05c20 ima-evm-utils: bump to release 1.2.1
Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 13:13:38 -07:00
Dmitry Eremin-Solenikov c9c4e6c228 meta-integrity: rename IMA_EVM_BASE to INTEGRITY_BASE
data/debug-keys will be reused for demo modsign keys, so rename
IMA_EVM_BASE to more generic INTEGRITY_BASE.

Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
2019-08-04 13:12:41 -07:00
Yi Zhao 0a73a14fbb scap-security-guide: update recipe
* Set B="${S}/build" to fix the build failure for out of source
  directory
* Remove do_complile and do_install. Use the default functions from
  cmake.bbclass.
* Install the artifacts to /usr/share rather than /usr/local/share

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
Yi Zhao b9b575823d openscap: update recipe
* Add PACKAGECONFIG for gcrypt, nss3 and selinux
* Use EXTRA_OECMAKE rather than EXTRA_OECONF
* Set CMAKE_SKIP_RPATH and CMAKE_SKIP_INSTALL_RPATH instead of chrpath
* Remove ptest since there are many host contamination issues on target.
  We will add it back when these issues are solved.
* Drop the unused patch
* Add PV

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
Dmitry Eremin-Solenikov a655c8e4b4 tpm2-tcti-uefi: build and install examples
Examples are usefull to actually check TPM2 from UEFI shell. Add them to
tpm2-tcti-uefi package.

Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
Dmitry Eremin-Solenikov 60fc73e4da tpm2-tcti-uefi: stop inserting host directories into build path
Do not insert /usr/lib and /usr/lib64 into LDFLAGS.

Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
Dmitry Eremin-Solenikov e3352832a7 tpm2-tcti-uefi: fix configure arguments
Pass correct location of EFI's crt0 and ld script.

Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
Dmitry Eremin-Solenikov 95e58ad690 tpm2-tcti-uefi: add autoconf-archive-native dependency
Add dependency on autoconf-archive-native to receive AX_* macro definitions.

Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
Dmitry Eremin-Solenikov df2745e172 tpm2-tss: fix compilation when using updated AX_CODE_COVERAGE macro
New autoconf-archive comes with updated AX_CODE_COVERAGE macro, which is
not compatible with current tpm2-tss source base. Apply upstream patch
to fix this incompatibility.

Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
Dmitry Eremin-Solenikov 00a05ed92a packagegroup-security-tpm2: stop including tpm2-tcti-uefi
tpm2-tcti-uefi is a EFI module, so it should not be included in the
rootfs.

Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
lumag fc20f45964 ima-evm-utils: refresh xattr patch
Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
lumag 2fa48c800d ima-evm-utils: bump version
Currently selected SRCREV (782224f33cd711050cbf6146a12122cd73f9136b)
comes after 1.1 ima-evm-utils release, so bump PV accordingly.

Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
lumag 964972ea01 layer.conf: add dependency on meta-security
ima-evm-utils recipe depends on keyutils recipe which is a part of
meta-security layer.

Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
Armin Kuster 265d27f3d2 keyutils: remove from meta-security
now in meta-oe

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
Armin Kuster 2634aba3e1 samhain: update to 4.3.3
remove PV from recipes names to make package update easier.

PV set in include file now

drop samhain-cross-compile.patch as stripping appears to have been removed.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
Armin Kuster 270eefd758 waf-cross-answers: remove files
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:25 -07:00
Armin Kuster c138442bbc libldb: remove recipe
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-08-04 12:17:18 -07:00
Armin Kuster eca01510bf meta-security-compliance: add meta-python
with some for the recipe updates, more pyton support is needed

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-07-17 16:56:39 -07:00
Armin Kuster a64348d0df scap-security-guide: update to 0.1.44
create a PV version to track upstream
git version includes OE changes

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-07-17 16:56:39 -07:00
Armin Kuster 90ccc8b4f5 openscap: add 1.3.1 recipes for upstream source
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-07-17 16:56:39 -07:00
Armin Kuster 37040cfb76 openscap_git: update to 1.3.0
removed unneeded patch
convert over to cmake

refactor files

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-07-17 16:56:02 -07:00
Mark Asselstine eabb07f6d2 openscap/scap-security-guide: use _git instead of versioned filenames
In order to facilate the reuse of the recipe code via layer or distro
specific bbappends rename the recipe files to use _git instead of
versined filenames. Specifically this allows for minimal bbappends in
additional layers which may use the upstream, non-forked, repos that
can be version skewed when compared to what is present in this repo.

Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-07-07 19:18:41 -07:00
Armin Kuster 217e33ff31 meta-security-compliance: update README
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-07-07 19:18:41 -07:00
Armin Kuster 0581604172 lynis: update to 2.7.5
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-07-07 19:18:18 -07:00
He Zhe 586f40897a kernel: Add conditional inclusion of fragments for linux-yocto-dev
Signed-off-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster 3f253ddab8 clamav: minor recipe cleanup
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster 37dc57c998 libmspack: update SRC_URI and package
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster f59c5437d6 tpm2-tss-engine: update to 1.0.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster 6cd8959569 tpm2-totp: update to offical release v0.1.1
Clean up recipe to match actual app

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster cdd44a61c6 tpm2-tss: update to 2.2.3
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster 1a02980de6 tpm2-tools: update to 3.2.0
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster 432dafda41 tpm2-tcti-uefi: update to tip
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster 90e47de316 tpm2-pkcs11/tpm2-pkcs11: update to tip
license-check-sum: Add SPDX format

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster 7af4d16f33 tpm image: split out tpm2
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster 44cb58c3e8 tpm2 images: create tpm2 image and fix packagegroup
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster 6aae738ee6 runtime: tpm2 fix names in packagecheck
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster f63db8ce1d ima-evm-utils: update to tip
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster 88350b1267 test-image: add a few more packages to image
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster 2098981e0c test-image: add packagegroup-core-security-ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster 55ff4e2434 packagegroup-core-security: cleanup and remove ptest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster c44f8f3cb2 runtime: clamav test cleanup
mirror test is independant of download

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster ee580bd011 security-test-image: add a testing image
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00
Armin Kuster 723cd9e372 layers: set warrior only
remove TEST_SUITES from main layer.conf

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-06-26 15:47:47 -07:00