summaryrefslogtreecommitdiffstats
path: root/meta-oe/recipes-security
Commit message (Collapse)AuthorAgeFilesLines
* keyutils: fix ptest failed since "+++ Can't Determine Endianness"Changqing Li2022-12-052-0/+36
| | | | | | | | All the ptest cases are failed since error "+++ Can't Determine Endianness", update the regex for matching the endianness to fix this issue. Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: Inherit python3targetconfigKhem Raj2022-11-301-1/+1
| | | | | | | | | | | It uses python3-config during build to grok the python specific includedirs, therefore its important to ensure that target specific python3-config is used, otherwise currently it defaults to native python3-config which ends up adding native python3 include paths which might work out ok but is exposed when target is 32bit + lfs enabled, the headers don't match between native and target python Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 3.0.8 -> 3.0.9Wang Mingyu2022-11-281-1/+1
| | | | | | | | | | | | | | | Changelog: =========== In auditd, release the async flush lock on stop Don't allow auditd to log directly into /var/log when log_group is non-zero Cleanup krb5 memory leaks on error paths Update auditd.cron to use auditctl --signal In auparse, if too many fields, realloc array bigger (Paul Wolneykien) In auparse, special case kernel module name interpretation If overflow_action is ignore, don't treat as an error Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: Fix compile error for audit_2.8.5Akash Hadke2022-10-213-2/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix below compile errors 1. Fix build with linux 5.17+ audit errors out due to swig munging it does with kernel headers | audit_wrap.c: In function '_wrap_audit_rule_data_buf_set': | audit_wrap.c:4701:17: error: cast specifies array type | 4701 | arg1->buf = (char [])(char *)memcpy(malloc((size)*sizeof(char)), (const char *)(arg2), sizeof(char)*(size)); | | ^ | audit_wrap.c:4701:15: error: invalid use of flexible array member | 4701 | arg1->buf = (char [])(char *)memcpy(malloc((size)*sizeof(char)), (const char *)(arg2), sizeof(char)*(size)); | | ^ | audit_wrap.c:4703:15: error: invalid use of flexible array member | 4703 | arg1->buf = 0; | | ^ These errors are due to VLAIS from kernel headers, so we copy linux/audit.h and make the needed change in local audit.h and make needed arrangements in build to use it when building audit package Take reference of upstream commit ee3c680c3 audit: Upgrade to 3.0.8 and fix build with linux 5.17+ Update 0002-Fixed-swig-host-contamination-issue.patch 2. Fix ipx.h missing file bug for kernel 5.15 ipx.h header file is removed in kernel 5.15 Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/include/net?id=6c9b40844751ea30c72f7a2f92f4d704bc6b2927 which is causing below error for system with kernel equal and higher than 5.15 | ../../git/auparse/interpret.c:48:10: fatal error: linux/ipx.h: No such file or directory | 48 | #include <linux/ipx.h> | | ^~~~~~~~~~~~~ Add below patch to fix this issue. 0001-Make-IPX-packet-interpretation-dependent-on-the-ipx-header.patch Link: https://github.com/linux-audit/audit-userspace/commit/6b09724c69d91668418ddb3af00da6db6755208c Signed-off-by: Akash Hadke <akash.hadke@kpit.com> Signed-off-by: Akash Hadke <hadkeakash4@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* passwdqc: fix the libpasswdqc FILES settingChen Qi2022-09-201-1/+1
| | | | | | | | | | The actual file name is now libpasswdqc.so.1 instead of libpasswdqc.so.0. This fixes the following error when installing passwdqc: nothing provides libpasswdqc needed by passwdqc-2.0.2-r0 Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* passwdqc: Upgrade to 2.0.2Khem Raj2022-09-072-12/+9
| | | | | | | License-Update: install-dependencies.sh and run-build-and-tests.sh are mentioned under GPL-2.0 but they are not included in release tarball Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: Revert the tweak done in configure step in do_installKhem Raj2022-08-171-0/+2
| | | | | | | | | This tweak is needed for building audit but not the interfaces it may expose via the headers, therefore undo the tweak before packaging things up Reported-By: Scott Murray <scott.murray@konsulko.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: Fix build with muslKhem Raj2022-08-102-0/+35
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: Upgrade to 3.0.8 and fix build with linux 5.17+Khem Raj2022-08-082-11/+9
| | | | | | | | | | | | | | | | | | | | | | audit errors out due to swig munging it does with kernel headers | audit_wrap.c: In function '_wrap_audit_rule_data_buf_set': | audit_wrap.c:4701:17: error: cast specifies array type | 4701 | arg1->buf = (char [])(char *)memcpy(malloc((size)*sizeof(char)), (const char *)(arg2), sizeof(char)*(size)); | | ^ | audit_wrap.c:4701:15: error: invalid use of flexible array member | 4701 | arg1->buf = (char [])(char *)memcpy(malloc((size)*sizeof(char)), (const char *)(arg2), sizeof(char)*(size)); | | ^ | audit_wrap.c:4703:15: error: invalid use of flexible array member | 4703 | arg1->buf = 0; | | ^ These errors are due to VLAIS from kernel headers, so we copy linux/audit.h and make the needed change in local audit.h and make needed arrangements in build to use it when building audit package Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Bruce Ashfield <bruce.ashfield@gmail.com>
* tomoyo-tools: Drop md5sumKhem Raj2022-04-251-1/+0
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* tomoyo-tools: Define SBINDIRKhem Raj2022-04-251-1/+1
| | | | | | | default SBINDIR is hardcoded to /sbin which does not work when using usrmerge Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: Upgrade 3.0.6 -> 3.0.7Alex Kiernan2022-04-181-2/+1
| | | | | | | | Dependency on bash has been removed upstream. Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* usbguard: package simplificationAnu Deepthika, Nandipati2022-03-291-8/+1
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* usbguard: Add inital recipeAnu Deepthika, Nandipati2022-03-242-0/+181
| | | | | | | | | Set one crypto-backend library at a time OpenSSL is the crypto-backend library set for device hashing Override PACKAGECONFIG to replace it with libsodium or libgcrypt Signed-off-by: Anu Deepthika, Nandipati <Nandipati.AnuDeepthika@philips.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* recipes: Update LICENSE variable to use SPDX license identifiersKhem Raj2022-03-045-5/+5
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* recipes: Update SRC_URI branch and protocolsRichard Purdie2021-11-032-2/+2
| | | | | | | | | This patch updates SRC_URIs using git to include branch=master if no branch is set and also to use protocol=https for github urls as generated by the conversion script in OE-Core. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 3.0.5 -> 3.0.6Yi Zhao2021-10-191-1/+1
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* keyutils: fix install pathAlexander Thoma2021-10-141-12/+3
| | | | | | Signed-off-by: Alexander Thoma a.thoma@rational-online.com Signed-off-by: Florian Wühr f.wuehr@rational-online.com Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 3.0.4 -> 3.0.5Yi Zhao2021-08-192-134/+1
| | | | | | | Drop backported patch. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 3.0.3 -> 3.0.4Yi Zhao2021-08-112-1/+134
| | | | | | | Backport a patch to fix the wrong account associations issue. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: fix compile error for 2.8.5Yi Zhao2021-08-064-19/+110
| | | | | | | | | | | | | | * Backport a patch to fix the compile error * Refresh the patches to fix the patch-fuzz warning. * Minor tweaks to the recipe with reference to the 3.0 bb file. Fixes: tmp/work/core2-64-poky-linux/audit/2.8.5-r0/recipe-sysroot-native/usr/bin/x86_64-poky-linux/../../libexec/x86_64-poky-linux/gcc/x86_64-poky-linux/11.1.1/ld: ausearch-checkpt.o:/usr/src/debug/audit/2.8.5-r0/build/src/../../git/src/ausearch-common.h:53: multiple definition of `event_node_list'; ausearch.o:/usr/src/debug/audit/2.8.5-r0/build/src/../../git/src/ausearch-common.h:53: first defined here Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* Convert to new override syntaxMartin Jansa2021-08-037-40/+40
| | | | | | | | | | This is the result of automated script (0.9.1) conversion: oe-core/scripts/contrib/convert-overrides.py . converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* audit: upgrade 3.0.2 -> 3.0.3Yi Zhao2021-08-031-1/+1
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 3.0.1 -> 3.0.2Yi Zhao2021-07-081-1/+1
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: migrate from meta-selinuxArmin Kuster2021-05-127-0/+586
| | | | | | | Move audit to a more common layer to simplify integration. Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: change shebang to python3Changqing Li2021-05-111-3/+5
| | | | | | | | upstream nmap is python2 compatiable now, but this recipe supports python3. Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* softhsm: update to 2.6.1 and alignakuster2021-02-172-18/+30
| | | | | | | | meta-security has this pkg to but newer. Move from meta-sec to meta-oe minor cleanups. Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* passwdqc: remove double modify operationKonrad Weihmann2020-05-311-1/+1
| | | | | | | | It is either += or append but not both - picking append to be the safe bet Signed-off-by: Konrad Weihmann <kweihmann@outlook.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: make ndiff support python3Mingli Yu2020-02-153-2/+1778
| | | | | | | | | | The ndiff is python2 compatible now, backport a patch from debian to make ndiff port to python3. Refer to https://sources.debian.org/data/main/n/nmap/7.80+dfsg1-2/debian/patches/0004-Python3-port-of-ndiff.patch Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: Use py3 in depends/rdependsKhem Raj2020-01-241-2/+2
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* meta-oe: Remove using python2Khem Raj2020-01-221-1/+1
| | | | | | | This change makes the parsing go though, we still might have build issues, which will be reported in world builds seprately Signed-off-by: Khem Raj <raj.khem@gmail.com>
* keyutils: upgrade 1.6 -> 1.6.1Mingde (Matthew) Zeng2020-01-151-2/+2
| | | | | Signed-off-by: Matthew Zeng <Matthew.Zeng@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* softhsm: add recipeJan Luebbe2019-11-221-0/+18
| | | | | | | | | | This is useful for consolidation of code-signing interfaces when building an image with verified boot mechanisms or signed update artifacts. It can also be used on the target as a backend for software which uses the PKCS#11 API to access private key material. Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* recipes: rename distro_features_check to features_checkDenys Dmytriyenko2019-11-211-1/+1
| | | | | | | Avoid warning due to the class rename in OE-Core. Signed-off-by: Denys Dmytriyenko <denys@ti.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* passwdqc: Clarify BSD license variantChristophe PRIOUZEAU2019-10-251-1/+1
| | | | | | The License of passwdqc is BSD-1-Clause. Signed-off-by: Khem Raj <raj.khem@gmail.com>
* keyutils: Fix installed-vs-shipped for nativesdkRobert Yang2019-09-251-0/+12
| | | | | | | | | | | | | | | | | Fixed: $ bitbake nativesdk-keyutils ERROR: nativesdk-keyutils-1.6-r0 do_package: QA Issue: nativesdk-keyutils: Files/directories were installed but not shipped in any package: /usr /etc /usr/share /usr/share/man /usr/share/keyutils [snip] /etc/request-key.conf /etc/request-key.d Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: Update to 7.80Peiran Hong2019-09-232-36/+31
| | | | | | | | | | | | | | | | Updates nmap to v7.80, this solves the following CVEs: - CVE-2017-18594 - CVE-2018-15173 and addressed numerous bugs as well. The patch '0001-include-time.h-for-time-structure-definition.patch' is modified to be applicable to the new version while serving for the same purpose. The license changed in the commit https://github.com/nmap/nmap/commit/d639a53 and is only a date bump without modification of any content in the license. Signed-off-by: Peiran Hong <peiran.hong@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* Adapt to the lsb -> lsb-release change in OE-coreAdrian Bunk2019-08-291-1/+1
| | | | | Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* keyutils: move recipe and patches from meta-security to meta-oeYongxin Liu2019-07-105-0/+167
| | | | | | | | keyutils is originally in https://git.yoctoproject.org/git/meta-security. Move it to meta-oe since other recipes in OE depend on it. Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: Fix build on RISC-VKhem Raj2019-03-071-0/+2
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: Include additional FILES path for certsScott Ellis2019-02-031-1/+1
| | | | | | | | | | If both ncat and ssl are in PACKAGECONFIG then the installer adds a cert bundle to /usr/share/ncat/ca-bundle.crt Signed-off-by: Scott Ellis <scott@jumpnowtek.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: Fix typo in pcre PACKAGECONFIGScott Ellis2019-02-031-1/+1
| | | | | Signed-off-by: Scott Ellis <scott@jumpnowtek.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: Fix build with clang8/musl/libc++Khem Raj2019-01-283-1/+157
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: install ndiffMingli Yu2018-08-221-1/+3
| | | | | | | | | | | | | | | | | | | Currently, the ndiff isn't built and installed as ndiff is python2 compatible script and it checks PYTHON_VERSION to determine whether build and install ndiff in configure phase. Update to inherit pythonnative to let the PYTHON_VERSION to be 2 to let ndiff be built and installed. Apart from ndiff python script, there is another script named ndiff.py used by ndiff, export PYTHON_SITEPACKAGES_DIR to make ndiff.py installed in the correct place. Signed-off-by: Mingli Yu <Mingli.Yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: update to 7.70Armin Kuster2018-07-121-3/+3
| | | | | | | Update LIC_FILES_CHKSUM for yr change Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: move recipe from meta-security to meta-oeArmin Kuster2018-06-013-0/+131
| | | | | | | | | [V2] Remove obsolete sed operations Remove zenmap as python-pygtk was obsoleted in core Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* leveldb: move to recipes-dbsArmin Kuster2018-03-294-151/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samba, openwsman, pam-ssh-agent-auth, sblim-sfcb, passwdqc, python-pam, ↵Martin Jansa2018-03-051-0/+3
| | | | | | | | | | | smbnetfs: require pam in DISTRO_FEATURES * there is explicit dependency on libpam without respecting pam in DISTRO_FEATURES so add the check to prevent people building it against broken libpam Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
* passwdqc: move to recipes-securityArmin Kuster2018-03-012-0/+94
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* leveldb: move to recipes-securityArmin Kuster2018-03-014-0/+151
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-14 23:00:46 +0000