summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* fail2ban: remove Py2 and updatewipArmin Kuster2019-08-286-86/+606
| | | | | | | | remove patch included in update fix issues do to python3 fix init file Signed-off-by: Armin Kuster <akuster808@gmail.com>
* scapy: update to 2.4.3Armin Kuster2019-08-283-25/+12
| | | | | | remove python2 support Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libenv-perl: Remove, moved to meta-perlAdrian Bunk2019-08-282-22/+0
| | | | | Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* xmlsec1: Remove, moved to meta-oeAdrian Bunk2019-08-289-315/+0
| | | | | Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ecryptfs-utils: fix race condition in do_installQi.Chen@windriver.com2019-08-282-0/+33
| | | | | | | | | | | | | | | | | | | | | | The rootsbindir is a self-defined directory. The install-rootsbinPROGRAMS is actually treated as part of install-data instead of install-exec. Do making install-exec-am depend on it actually results in the following Makefile contents. install-data-am: install-rootsbinPROGRAMS install-exec-am: install-binPROGRAMS install-binSCRIPTS @$(NORMAL_INSTALL) $(MAKE) $(AM_MAKEFLAGS) install-exec-hook install-exec-hook: install-rootsbinPROGRAMS And this results in race condition as two install commands of the same file running at the same time. Error message is like below. TOPDIR/tmp-glibc/hosttools/install: cannot create regular file 'TOPDIR/tmp-glibc/work/aarch64-wrs-linux/ecryptfs-utils/111-r0/image/sbin/mount.ecryptfs': File exists Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ecryptfs-utils: remove openssl PACKAGECONFIGQi.Chen@windriver.com2019-08-281-1/+1
| | | | | | | | | | | | | | | | | ecryptfs-utils does not build with openssl1.1. Previously this openssl PACKAGECONFIG is disabled by default, so we are not getting build failures by default. But if we enable it, we get do_compile failure. This package is from ubuntu source, and the one ubuntu ships does not depend on openssl. The development of this package has stopped for about 3 years. I don't see it will fix the build offically. So remove this PACKAGECONFIG and use '--disable-openssl' directly. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* integrity-image: IMA_EVM_KEY_DIR has no affect, removeArmin Kuster2019-08-241-1/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: update to 2.13.3Armin Kuster2019-08-241-1/+7
| | | | | | create the cache dir at install time Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: fix RDPENDSArmin Kuster2019-08-241-1/+1
| | | | | | apparmor-2.13.2-r0 do_package_qa: QA Issue: /usr/bin/aa-easyprof contained in package apparmor requires /usr/bin/python3, but no providers found in RDEPENDS_apparmor? [file-rdeps] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openscap: add runtime dependency on bash and python3-coreYi Zhao2019-08-241-1/+1
| | | | | | | | | Fixes: ERROR: QA Issue: /usr/bin/oscap-ssh contained in package openscap requires /bin/bash, but no providers found in RDEPENDS_openscap? [file-rdeps] ERROR: QA Issue: /usr/bin/scap-as-rpm contained in package openscap requires /usr/bin/python3, but no providers found in RDEPENDS_openscap? [file-rdeps] Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-stable: rename to more generic bbappendArmin Kuster2019-08-241-0/+0
| | | | | | use wildcards Signed-off-by: Armin Kuster <akuster808@gmail.com>
* smack: add runtime dependency on python3-coreMartin Jansa2019-08-241-1/+1
| | | | | | | | * fixes: ERROR: QA Issue: /usr/share/smack/smack_rules_gen contained in package smack requires /usr/bin/python3, but no providers found in RDEPENDS_smack? [file-rdeps] Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openscap: fix scap-security-guide build errorYi Zhao2019-08-241-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It would fail to build scap-security-guide when use openscap-native sstate cache. Steps to reproduce: Create a new build project: $ bitbake openscap-native $ bitbake openscap-native -c clean $ bitbake scap-security-guide Error message: OpenSCAP Error: Schema file 'xccdf/1.1/xccdf-schema.xsd' not found in path '/buildarea/build/tmp/work-shared/openscap/oscap-build-artifacts/usr/share/openscap/schemas' when trying to validate '/buildarea/build/tmp/work/core2-64-poky-linux/scap-security-guide/0.1.44+gitAUTOINC+5fdfdcb2e9-r0/git/build/chromium/xccdf-unlinked-resolved.xml' [/buildarea/build/tmp/work/x86_64-linux/openscap-native/1.3.1+gitAUTOINC+4bbdb46ff6-r0/git/src/source/validate.c:104] Invalid XCCDF Checklist (1.1) content in /buildarea/build/tmp/work/core2-64-poky-linux/scap-security-guide/0.1.44+gitAUTOINC+5fdfdcb2e9-r0/git/build/chromium/xccdf-unlinked-resolved.xml. [/buildarea/build/tmp/work/x86_64-linux/openscap-native/1.3.1+gitAUTOINC+4bbdb46ff6-r0/git/src/source/oscap_source.c:346] chromium/CMakeFiles/generate-internal-chromium-xccdf-unlinked-resolved.xml.dir/build.make:63: recipe for target 'chromium/xccdf-unlinked-resolved.xml' failed When using sstate cache, the openscap-native doesn't install the artifacts to work-shared/openscap/oscap-build-artifacts when prepare recipe sysroot for scap-security-guide. Set do_install[nostamp] to 1 to ensure the openscap-native artifacts are installed to work-shared/openscap/oscap-build-artifacts even if using sstate cache. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-yocto-dev: update to use kernel cacheArmin Kuster2019-08-151-11/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-yocto: use 4.19 kernel cache nowArmin Kuster2019-08-156-38/+2
| | | | | | | | | remove kernel fragments now that they are in the kernel-cache for 4.19 update bbappend accordingly. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-stable/5.2: add stable bbappendArmin Kuster2019-08-151-0/+4
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: remove kernel fragments now in cacheArmin Kuster2019-08-155-33/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-%: remove kernel fragments now in cacheArmin Kuster2019-08-155-28/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* xmlsec1: upgrade 1.2.27 -> 1.2.28Yi Zhao2019-08-111-2/+2
| | | | | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: switch to keyutils from meta-oeDmitry Eremin-Solenikov2019-08-071-2/+2
| | | | | | | | As pointer by Martin Jansa, keyutils package is now a part of meta-oe, so switch to using keyutils from that layer. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* scap-security-guide: fix typoYi Zhao2019-08-071-1/+1
| | | | | | | Fix typo: RDEPNEDS_${PN} -> RDEPENDS_${PN} Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openscap: cleanup DEPENDSYi Zhao2019-08-071-2/+2
| | | | | | | | | Remove autoconf-archive from DEPENDS because it is using CMake/Ninjia build now. Also remove unused dpkg-native dependency from DEPENDS_class-native. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux: add support for kernel modules signingDmitry Eremin-Solenikov2019-08-073-0/+12
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* kernel-modsign.bbclass: add support for kernel modules signingDmitry Eremin-Solenikov2019-08-073-0/+79
| | | | | | | | | | Add bbclass responsible for handling signing of kernel modules. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> fixup class to avoid including in every configure task Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: bump to release 1.2.1Dmitry Eremin-Solenikov2019-08-045-182/+3
| | | | | Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-integrity: rename IMA_EVM_BASE to INTEGRITY_BASEDmitry Eremin-Solenikov2019-08-044-11/+11
| | | | | | | data/debug-keys will be reused for demo modsign keys, so rename IMA_EVM_BASE to more generic INTEGRITY_BASE. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
* scap-security-guide: update recipeYi Zhao2019-08-042-27/+7
| | | | | | | | | | | * Set B="${S}/build" to fix the build failure for out of source directory * Remove do_complile and do_install. Use the default functions from cmake.bbclass. * Install the artifacts to /usr/share rather than /usr/local/share Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openscap: update recipeYi Zhao2019-08-045-71/+30
| | | | | | | | | | | | | * Add PACKAGECONFIG for gcrypt, nss3 and selinux * Use EXTRA_OECMAKE rather than EXTRA_OECONF * Set CMAKE_SKIP_RPATH and CMAKE_SKIP_INSTALL_RPATH instead of chrpath * Remove ptest since there are many host contamination issues on target. We will add it back when these issues are solved. * Drop the unused patch * Add PV Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tcti-uefi: build and install examplesDmitry Eremin-Solenikov2019-08-041-0/+13
| | | | | | | | Examples are usefull to actually check TPM2 from UEFI shell. Add them to tpm2-tcti-uefi package. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tcti-uefi: stop inserting host directories into build pathDmitry Eremin-Solenikov2019-08-042-0/+28
| | | | | | | Do not insert /usr/lib and /usr/lib64 into LDFLAGS. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tcti-uefi: fix configure argumentsDmitry Eremin-Solenikov2019-08-041-1/+8
| | | | | | | Pass correct location of EFI's crt0 and ld script. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tcti-uefi: add autoconf-archive-native dependencyDmitry Eremin-Solenikov2019-08-041-1/+1
| | | | | | | Add dependency on autoconf-archive-native to receive AX_* macro definitions. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss: fix compilation when using updated AX_CODE_COVERAGE macroDmitry Eremin-Solenikov2019-08-042-1/+86
| | | | | | | | | New autoconf-archive comes with updated AX_CODE_COVERAGE macro, which is not compatible with current tpm2-tss source base. Apply upstream patch to fix this incompatibility. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-security-tpm2: stop including tpm2-tcti-uefiDmitry Eremin-Solenikov2019-08-041-3/+0
| | | | | | | | tpm2-tcti-uefi is a EFI module, so it should not be included in the rootfs. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: refresh xattr patchlumag2019-08-041-2/+2
| | | | | Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: bump versionlumag2019-08-041-1/+1
| | | | | | | | Currently selected SRCREV (782224f33cd711050cbf6146a12122cd73f9136b) comes after 1.1 ima-evm-utils release, so bump PV accordingly. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: add dependency on meta-securitylumag2019-08-041-0/+2
| | | | | | | | ima-evm-utils recipe depends on keyutils recipe which is a part of meta-security layer. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* keyutils: remove from meta-securityArmin Kuster2019-08-045-167/+0
| | | | | | now in meta-oe Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samhain: update to 4.3.3Armin Kuster2019-08-045-54/+3
| | | | | | | | | | remove PV from recipes names to make package update easier. PV set in include file now drop samhain-cross-compile.patch as stripping appears to have been removed. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* waf-cross-answers: remove filesArmin Kuster2019-08-0415-557/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libldb: remove recipeArmin Kuster2019-08-044-328/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-security-compliance: add meta-pythonArmin Kuster2019-07-171-3/+1
| | | | | | with some for the recipe updates, more pyton support is needed Signed-off-by: Armin Kuster <akuster808@gmail.com>
* scap-security-guide: update to 0.1.44Armin Kuster2019-07-173-55/+63
| | | | | | | create a PV version to track upstream git version includes OE changes Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openscap: add 1.3.1 recipes for upstream sourceArmin Kuster2019-07-173-8/+17
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openscap_git: update to 1.3.0Armin Kuster2019-07-173-116/+78
| | | | | | | | | removed unneeded patch convert over to cmake refactor files Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openscap/scap-security-guide: use _git instead of versioned filenamesMark Asselstine2019-07-072-0/+2
| | | | | | | | | | | In order to facilate the reuse of the recipe code via layer or distro specific bbappends rename the recipe files to use _git instead of versined filenames. Specifically this allows for minimal bbappends in additional layers which may use the upstream, non-forked, repos that can be version skewed when compared to what is present in this repo. Signed-off-by: Mark Asselstine <mark.asselstine@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-security-compliance: update READMEArmin Kuster2019-07-071-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lynis: update to 2.7.5Armin Kuster2019-07-071-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kernel: Add conditional inclusion of fragments for linux-yocto-devHe Zhe2019-06-261-0/+11
| | | | | Signed-off-by: He Zhe <zhe.he@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* clamav: minor recipe cleanupArmin Kuster2019-06-261-4/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-05 04:30:06 +0000