Commit Graph

389 Commits

Author SHA1 Message Date
Hitendra Prajapati
eb631c12be sssd: CVE-2022-4254 libsss_certmap fails to sanitise certificate data used in LDAP filters
Upstream-Status: Backport from 1c40208aa1 & a2b9a84460

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-23 06:28:09 -04:00
Armin Kuster
95a8f38d2e clamav: disable DB creation.
The DB is no longer available, so disable it.
remove from pkg group

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-27 09:42:52 -07:00
Jeremy A. Puhlman
5467910ed7 sssd: re-package to fix QA issues
It packages all file in ${libdir} to package sssd, including the .so
symlink files. Then it causes QA issues:

| ERROR: QA Issue: sssd rdepends on dbus-dev [dev-deps]
| ERROR: QA Issue: sssd rdepends on ding-libs-dev [dev-deps]

So re-package sssd then the .so symlink files and .pc files are packaged
to sssd-dev which should be.

File ${libdir}/libsss_sudo.so is not a symlink file but packaged to
sssd-dev too. Then causes another QA issue:

| ERROR: sssd-2.5.2-r0 do_package_qa: QA Issue:
    -dev package sssd-dev contains non-symlink .so '/usr/lib/libsss_sudo.so' [dev-elf]

So create a new sub-package libsss-sudo to package file libsss_sudo.so
and make sssd rdepends on it.

JP: Update for version differences.

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit e81c15f851)
Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-18 14:56:36 -08:00
Armin Kuster
d2b9de25cb packagegroup-core-security: remove clamav from musl image
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 496a734c14)
2020-10-16 07:24:06 -07:00
Armin Kuster
59e5512023 packagegroup-core-security: dont include suricata on riscv or ppc
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit caf76696e8)
2020-10-16 07:16:29 -07:00
Jonatan Pålsson
369a7bd129 sssd: Make manpages buildable
Some XML related fixes are needed to make the sssd manpages buildable

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 5efa53b2b2)
2020-10-16 07:14:24 -07:00
Kai Kang
9fdaf248f5 sssd: disable build secrets
It requires http_parser.h to build secrets:

| configure: error:
| You must have the header file http_parser.h installed to build sssd
| with secrets responder. If you want to build sssd without secret responder
| then specify --without-secrets when running configure.

The header file is from package http-parser[1] rather than apache2. But
there is no recipe http-parser in openembedded. So disable build secrets
for sssd and remove related systemd service and socket files.

Reference:
1. https://github.com/nodejs/http-parser

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 7831969f8c)
2020-10-16 07:14:05 -07:00
Armin Kuster
36d732f97c packagegroup-core-security: remove libseccomp for riscv*
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 29f47b4485)
2020-10-16 07:06:46 -07:00
Armin Kuster
bb321aa1d7 libsecomp: rv32/rv64 target builds are not supported yet
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit b5a5cbe1f5)
2020-10-16 07:06:23 -07:00
Armin Kuster
a1d933f457 packagegroup-core-security: remove clamav for riscv*
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 98ff502d40)
2020-10-16 07:05:47 -07:00
Armin Kuster
3f6a0ff540 packagegroup-core-security-ptest: update fail2ban ptest pkg name
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit a2a102b2de)
2020-10-16 06:46:49 -07:00
Zheng Ruoqin
0b69bd3553 bastille: Deleted redundant inherit to fix error when enable multilib.
There is no need to inherit module-base. Because this inherit will stop
bastille to build to lib32-bastille.

Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-07-14 21:27:35 -07:00
Jonatan Pålsson
47de50efdb sssd: Add infopipe PACKAGECONFIG
infopipe was previously on by default, so add it to the default
PACKAGECONFIG.

The systemd files are only installed when --with-infopipe is passed to
configure, so conditionally add them to SYSTEMD_SERVICE.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Jonatan Pålsson
e54b07c3d4 sssd: Add missing DEPENDS on jansson
When building with the curl PACKAGECONFIG, sssd will depend on the
jansson library.

Fixes the following error:
    | checking for JANSSON... no
    | checking jansson.h usability... no
    | checking jansson.h presence... no
    | checking for jansson.h... no
    | configure: error:
    | You must have the header file jansson.h installed to build sssd
    | with secrets and KCM responder. If you want to build sssd without
    these
    | responders then specify --without-secrets --without-kcm when running
    configure.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Jonatan Pålsson
cf423c05bf sssd: Add missing files to SYSTEMD_SERVICE
These files are installed when the ssh or curl PACKAGECONFIGs are enabled.

Fixes the following error:

    ERROR: sssd-1.16.4-r0 do_package: QA Issue: sssd: Files/directories were
      installed but not shipped in any package:
        /lib/systemd/system/sssd-kcm.socket
        /lib/systemd/system/sssd-kcm.service
        /lib/systemd/system/sssd-ssh.socket
        /lib/systemd/system/sssd-ssh.service

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Jonatan Pålsson
52e3654d34 sssd: Add sudo PACKAGECONFIG
sudo was previously on by default, so add it to the default
PACKAGECONFIG.

The systemd files are only installed when --with-sudo is passed to
configure, so conditionally add them to SYSTEMD_SERVICE.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Jonatan Pålsson
79d9fc23e2 sssd: Add autofs PACKAGECONFIG
autofs was previously on by default, so add it to the default
PACKAGECONFIG.

The systemd files are only installed when --with-autofs is passed to
configure, so conditionally add them to SYSTEMD_SERVICE.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Jonatan Pålsson
70a4908a97 sssd: Sort PACKAGECONFIG entries
Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster
5b82f67c48 buck-security: move to recipes-scanners
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster
7beb91332f checksecurity: move to recipes-scanners
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster
a9e3b04576 checksec: move to recipe-scanners
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster
e4a2dd0b4a clamav: move to recipes-scanners
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster
d2c383fa63 fail2ban: change hardcoded sysklogd to VIRTUAL-RUNTIME_base-utils-syslog
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-27 16:53:25 -07:00
Armin Kuster
4229f5025e libseccomp: update to 2.4.3
dropped patch now included in update

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:13:07 -07:00
Armin Kuster
96737082ad sssd: python2 not supported
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:13:07 -07:00
Jonatan Pålsson
6eaee464bf sssd: DEPEND on nss if nothing else is chosen
sssd will attempt to build against nss if no crypto is selected. If a
bbappend sets PACKAGECONFIG = <list without nss or crypto>, the
appropriate DEPEND is not established.

Fixes the following configure error:

    ... snip ...
    | checking for NSS... configure: error: Package requirements (nss) were not met:
    |
    | No package 'nss' found
    |
    | Consider adjusting the PKG_CONFIG_PATH environment variable if you
    | installed software in a non-standard prefix.
    |
    | Alternatively, you may set the environment variables NSS_CFLAGS
    | and NSS_LIBS to avoid the need to call pkg-config.
    | See the pkg-config man page for more details.
    |
    | WARNING: exit code 1 from a shell command.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:13:07 -07:00
Jonatan Pålsson
1c22721eae sssd: Fix typo in PACKAGECONFIG. cyrpto -> crypto
Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:13:07 -07:00
Jonatan Pålsson
a509e21902 sssd: Add PACKAGECONFIG for python2
Fixes the following build error:

    .. snip ..
    | checking for python2... no
    | checking for python3... (cached) python3.8
    | configure: error:
    | The program python2 was not found in search path.
    | Please ensure that it is installed and its directory is included in the search
    | path. It is required for building python2 bindings. If you do not want to build
    | them please use argument --without-python2-bindings when running configure.
    | WARNING: exit code 1 from a shell command.

Signed-off-by: Jonatan Pålsson <jonatan.p@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-08 14:12:59 -07:00
Kai Kang
4375507f39 sssd: fix for ldblibdir and systemd etc
Fix sssd issue for ldblibdir, systemd, pam etc.

* fix ldblibdir which is not calculated right for cross compile
* create directory /var/log/sssd which is required by sssd daemon
* disable building python2 binding
* fix pam module path
* update systemd configure options and service files

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-05 08:06:51 -08:00
Armin Kuster
17b0f42647 secuirty*-image: remove dead var and minor cleanup
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-01 22:16:14 -08:00
Armin Kuster
290b4bbf8c clamav-native: missed bison fix
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-01 22:16:14 -08:00
Armin Kuster
73cb9a32dc clamav: add bison-native to depend
fixes build issue:
clamav/0.101.5-r0/git/config/ylwrap: line 176: yacc: command not found

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-03-01 22:16:14 -08:00
Armin Kuster
2a91f5cc62 google-authenticator-libpam: install module in pam location
pam_google_authenticator.so was being installed where pam could not find
it. Move it where the rest of the pam modules site.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-16 08:49:20 -08:00
Armin Kuster
238b8936e6 python3-fail2ban: add 2-3 conversion changes
Had to use the fail2ban-2.3 program to create py3 code
Add it as a patch

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-16 08:48:43 -08:00
Armin Kuster
2df5bbcf17 bastille: convert to py3
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-10 19:13:52 -08:00
Armin Kuster
2732ab1467 ecryptfs-utils: search nspr header files in ${STAGING_INCDIR}/nspr directory
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-02-02 08:38:43 -08:00
Armin Kuster
037adba72e buck-security: fix rdebends and minor style cleanup
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-28 10:02:36 -08:00
Armin Kuster
3e9b32c714 checksecurity: fix runtime issues
add some missing perl modules

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-28 10:02:36 -08:00
Pierre-Jean Texier via Lists.Yoctoproject.Org
4c98f16973 google-authenticator-libpam: upgrade 1.07 -> 1.08
See changelog: https://github.com/google/google-authenticator-libpam/releases/tag/1.08

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-28 10:02:36 -08:00
Armin Kuster
b02f3fae9d python3-fail2ban: update to latest
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-21 21:41:57 -08:00
Armin Kuster
fa8d29bffc sssd: drop py2 support
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-21 21:41:20 -08:00
Armin Kuster
b72cc7f87c fail2ban: fix runtime error
use success/failure calls in initd/function

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-05 16:09:44 -08:00
Armin Kuster
912ead8099 clamav: update to 0.101.5
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-01-03 11:54:58 -08:00
Armin Kuster
6b42f1c033 google-authenticator-libpam: update to 1.07
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-25 16:04:27 +00:00
Armin Kuster
4786213cab python3-fail2ban: include python-fail2ban.inc
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-25 16:04:27 +00:00
Armin Kuster
36ebd09b06 python-fail2ban: Drop python2 package
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-25 16:04:27 +00:00
Yi Zhao
2c2161fbc2 libseccomp: upgrade 2.4.1 -> 2.4.2
Backport a patch to fix ptest build failure on arm64.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-12-16 20:51:00 -08:00
Ming Liu
fa800e5261 meta: inherit features_check instead of distro_features_check
distro_features_check has been deprecated in OE.

Signed-off-by: Ming Liu <liu.ming50@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-27 13:38:58 -08:00
Christopher Larson
484d13bc59 clamav: add tmpfiles.d config
This is needed to ensure freshclam's /var/log directory and file are
created when using systemd.

Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-27 13:38:58 -08:00
Christopher Larson
b111206c4c checksecurity: use more portable find args
Signed-off-by: Christopher Larson <chris_larson@mentor.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2019-11-27 13:38:58 -08:00