Yi Zhao 533da3cd2b scap-security-guide: pass the correct cpe/schemas/xsl paths to oscap
There is a build error when using openscap-native sstate cache mirror.
Steps to reproduce:
Create a new build project in build-1 directory.
$ bitbake openscap-native

Then remove all directories in build-1 directory except sstate-cache.
Use the sstate-cache directory as sstate mirror.

Create another new build project in build-2 directory.
Set SSATE_MIRRORS to point to the sstate-cache in build-1 directory.
$ bitbake scap-security-guide

Error message:
OpenSCAP Error: Schema file 'sds/1.3/scap-source-data-stream_1.3.xsd' not found in path
'/build-1/tmp-glibc/work-shared/openscap/oscap-build-artifacts/usr/share/openscap/schemas' when trying to validate
'/build-2/tmp-glibc/work/corei7-64-wrs-linux/scap-security-guide/0.1.67/build/ssg-openembedded-ds.xml'
[/build-1/tmp-glibc/work/x86_64-linux/openscap-native/1.3.8/git/src/source/validate.c:103]

The oscap command from openscap-native tries to find the schema files in
build-1 directory since these paths are hardcoded when building
openscap-native.

We need to pass the correct cpe/schemas/xsl paths to oscap to make sure
it can find the files in right location.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-08 12:06:31 -04:00
2023-08-06 11:31:18 -04:00
2023-08-06 11:31:18 -04:00
2023-07-31 06:18:52 -04:00
2023-07-31 06:18:52 -04:00
2020-09-29 07:18:24 -07:00
2013-06-17 17:24:38 +03:00
2022-06-07 16:58:24 -07:00

Meta-security
=============

The bbappend files for some recipes (e.g. linux-yocto) in this layer need
to have 'security' in DISTRO_FEATURES to have effect.
To enable them, add in configuration file the following line.

  DISTRO_FEATURES:append = " security"

If meta-security is included, but security  is not enabled as a
distro feature a warning is printed at parse time:

    You have included the meta-security layer, but
    'security' has not been enabled in your DISTRO_FEATURES. Some bbappend files
    and preferred version setting may not take effect.

If you know what you are doing, this warning can be disabled by setting the following
variable in your configuration:

  SKIP_META_SECURITY_SANITY_CHECK = 1

This layer provides security tools, hardening tools for Linux kernels
and libraries for implementing security mechanisms.

Dependencies
============

This layer depends on:

  URI: git://git.openembedded.org/openembedded-core
  branch: [same one as checked out for this layer]

  URI: git://git.openembedded.org/meta-openembedded/meta-oe
  branch: [same one as checked out for this layer]

Adding the security layer to your build
========================================

In order to use this layer, you need to make the build system aware of
it.

Assuming the security layer exists at the top-level of your
yocto build tree, you can add it to the build system by adding the
location of the security layer to bblayers.conf, along with any
other layers needed. e.g.:

  BBLAYERS ?= " \
    /path/to/oe-core/meta \
    /path/to/meta-openembedded/meta-oe \
    /path/to/layer/meta-security "

Optional Dynamic layer dependancy
======================================

  URI: git://git.openembedded.org/meta-openembedded/meta-oe

  URI: git://git.openembedded.org/meta-openembedded/meta-perl

  URI: git://git.openembedded.org/meta-openembedded/meta-python

  BBLAYERS += "/path/to/layer/meta-openembedded/meta-oe"
  BBLAYERS += "/path/to/layer/meta-openembedded/meta-perl"
  BBLAYERS += "/path/to/layer/meta-openembedded/meta-python"

This will activate the dynamic-layer mechanism.



Maintenance
======================================

Send pull requests, patches, comments or questions to yocto@lists.yoctoproject.org

When sending single patches, please using something like:
'git send-email -1 --to yocto@lists.yoctoproject.org --subject-prefix=meta-security][PATCH'

These values can be set as defaults for this repository:

$ git config sendemail.to yocto@lists.yoctoproject.org
$ git config format.subjectPrefix meta-security][PATCH

Now you can just do 'git send-email origin/master' to send all local patches.

For pull requests, please use create-pull-request and send-pull-request. 

Maintainers:    Armin Kuster <akuster808@gmail.com>


License
=======

All metadata is MIT licensed unless otherwise stated. Source code included
in tree for individual recipes is under the LICENSE stated in each recipe
(.bb file) unless otherwise stated.
S
Description
No description provided
Readme 7.3 MiB
Languages
BitBake 49.8%
Perl 24%
NASL 9.5%
Shell 6%
Python 5.4%
Other 5.3%