mirror of
https://git.yoctoproject.org/meta-security
synced 2026-01-11 15:00:34 +00:00
a043f0b8ed
Add basic openscap test. This looks for an existing profile and run a basic scan. Openscap scans return 1 in case of failure, 0 in case of success and 2 when a vulnerability has been found. As this does not aim to check openscap reports, 2 is considered as a successful test. Signed-off-by: Louis Rannou <louis.rannou@non.se.com> (added to test image) Signed-off-by: Scott Murray <scott.murray@konsulko.com>
28 lines
1.0 KiB
BlitzBasic
28 lines
1.0 KiB
BlitzBasic
DESCRIPTION = "A small image for testing meta-security packages"
|
|
|
|
require security-build-image.bb
|
|
|
|
IMAGE_FEATURES += "ssh-server-openssh"
|
|
|
|
IMAGE_INSTALL:append = "\
|
|
${@bb.utils.contains("DISTRO_FEATURES", "smack", "smack-test", "",d)} \
|
|
${@bb.utils.contains("BBFILE_COLLECTIONS", "tpm-layer", "packagegroup-security-tpm","", d)} \
|
|
${@bb.utils.contains("BBFILE_COLLECTIONS", "tpm-layer", "packagegroup-security-tpm2","", d)} \
|
|
${@bb.utils.contains("BBFILE_COLLECTIONS", "parsec-layer", "packagegroup-security-parsec","", d)} \
|
|
${@bb.utils.contains("BBFILE_COLLECTIONS", "integrity", "packagegroup-ima-evm-utils","", d)} \
|
|
"
|
|
|
|
TEST_SUITES = "ssh ping apparmor clamav openscap samhain sssd checksec smack suricata aide firejail"
|
|
TEST_SUITES:append = " parsec tpm2 swtpm ima"
|
|
|
|
INSTALL_CLAMAV_CVD = "1"
|
|
|
|
IMAGE_OVERHEAD_FACTOR = "1.0"
|
|
IMAGE_ROOTFS_EXTRA_SPACE = "1124288"
|
|
|
|
# ptests need more memory than standard to avoid the OOM killer
|
|
# also lttng-tools needs /tmp that has at least 1G
|
|
QB_MEM = "-m 2048"
|
|
|
|
PTEST_EXPECT_FAILURE = "1"
|