summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* openscap: move to main meta-security layerArmin Kuster2023-06-202-0/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lynis: move to main meta-security layerArmin Kuster2023-06-202-0/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openscap: Drop OE specific recipeArmin Kuster2023-06-202-69/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openscap: Fix native build missing dependsArmin Kuster2023-06-201-6/+54
| | | | | | | Include .inc for pending change New host OS required an addition to the depends file Signed-off-by: Armin Kuster <akuster808@gmail.com>
* oe-scap: Not maintained nor upstreamedArmin Kuster2023-06-206-214/+0
| | | | | | drop Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openscap-daemon: This is now obsoleteArmin Kuster2023-06-202-153/+0
| | | | | | drop pkg Signed-off-by: Armin Kuster <akuster808@gmail.com>
* complicance/isafw: remove oeqa addpylibChen Qi2023-06-202-4/+0
| | | | | | | | | These two layers do not have oeqa lib modules. Remove these two lines. Otherwise, `bitbake-layers add-layer <any_layer>' would fail if either of these two layers are in BBLAYERS. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* scap-security-guide_git: drop oe versionArmin Kuster2023-06-2010-395/+0
| | | | | | This is un-maintained so dropping this version Signed-off-by: Armin Kuster <akuster808@gmail.com>
* scap-security-guide: update to tipArmin Kuster2023-06-201-3/+34
| | | | | | Make default Signed-off-by: Armin Kuster <akuster808@gmail.com>
* scap-security-guide: update to 0.1.67Armin Kuster2023-06-111-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* buck-security: fix missing dependencies to perl modulesSamantha Jalabert2023-06-111-0/+1
| | | | | | | | | | | | | | | | | | Dependencies to perl modules Cwd and Encode were missing. Complete error on buck-security launch : Can't locate Encode/Encoding.pm in @INC (you may need to install the Encode::Encoding module) (@INC contains: /usr/lib/perl5/site_perl/5.36.0/arm-linux /usr/lib/perl5/site_perl/5.36.0 /usr/lib/perl5/vendor_perl/5.36.0/arm-linux /usr/lib/perl5/vendor_perl/5.36.0 /usr/lib/perl5/5.36.0/arm-linux /usr/lib/perl5/5.36.0) at /usr/lib/perl5/5.36.0/parent.pm line 16. BEGIN failed--compilation aborted at /usr/lib/perl5/5.36.0/arm-linux/Encode.pm line 178. Compilation failed in require at /usr/lib/perl5/5.36.0/Pod/Text.pm line 24. BEGIN failed--compilation aborted at /usr/lib/perl5/5.36.0/Pod/Text.pm line 24. Compilation failed in require at (eval 6) line 1. BEGIN failed--compilation aborted at /usr/lib/perl5/5.36.0/Pod/Usage.pm line 30. Compilation failed in require at /usr/bin/buck-security line 12. BEGIN failed--compilation aborted at /usr/bin/buck-security line 12. Signed-off-by: Samantha Jalabert <samantha.jalabert@syslinbit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dmverity: Suppress the realpath errorsKevin Hao2023-06-111-7/+7
| | | | | | | | | | | | | If we use a non PARTUUID root parameter, we would always get a error like below: realpath: /dev/disk/by-partuuid//dev/mmcblk0p2: No such file or directory This seems pretty confusion and it also seems no need to emit this kind of error when we are waiting for the root device. So suppress all the realpath errors. Signed-off-by: Kevin Hao <kexin.hao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* swtpm: fix parser error when using USERADDEXTENSION="useradd-staticids"Ahmed Abdelfattah2023-06-111-1/+1
| | | | | | | | pass the required argument to --home-dir fixes: Bugzilla-15034 Signed-off-by: Ahmed Abdelfattah <a.abfattah@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ibmswtpm2: update to 164-2020-192.1Andrew Geissler2023-06-031-4/+5
| | | | | | | | | | | | | This version supports openssl 3.1 The maintainer changed his tag versions hence the different looking version. The maintainer also has stopped releasing tar files and asked we directly grab from git. Signed-off-by: Andrew Geissler <geissonator@yahoo.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* parsec-tool: fix build errorMikko Rapeli2023-06-031-1/+1
| | | | | | | | | | | | Currently build fails with: | error: manifest path `/home/builder/build/tmp_qemuarm64/work/cortexa57-linux/parsec-tool/0.6.0-r0/cargo_home/bitbake/parsec-tool-0.6.0//Cargo.toml` does not exist Normal source directory has Cargo.toml so only set ${B} to the new path. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* parsec-service: fix build errorMikko Rapeli2023-06-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After latest changes to ${S}, parsec-service fails to apply systemd.patch: ERROR: parsec-service-1.2.0-r0 do_patch: Applying patch 'systemd.patch' on target directory '/home/builder/build/tmp_trs-qemuarm64/work/cortexa57-trs-linux/parsec-service/1.2.0-r0/cargo_home/bitbake/parsec-service-1.2.0' CmdError('quilt --quiltrc /home/builder/build/tmp_qemuarm64/work/cortexa57-linux/parsec-service/1.2.0-r0/recipe-sysroot-native/etc/quiltrc push', 0, "stdout: Applying patch systemd.patch can't find file to patch at input line 11 Perhaps you used the wrong -p or --strip option? The text leading up to this was: -------------------------- | |Run the Parsec service as parsec user in /var/lib/parsec/ working directory. | |Signed-off-by: Anton Antonov <Anton.Antonov@arm.com> |Upstream-Status: Inappropriate [deployment configuration] | |diff --git a/systemd-daemon/parsec.service b/systemd-daemon/parsec.service |index c07c3b9..a6fe6a3 100644 |--- a/systemd-daemon/parsec.service |+++ b/systemd-daemon/parsec.service -------------------------- No file to patch. Skipping patch. 1 out of 1 hunk ignored Patch systemd.patch does not apply (enforce with -f) stderr: ") ERROR: Logfile of failure stored in: /home/builder/build/tmp_qemuarm64/work/cortexa57-linux/parsec-service/1.2.0-r0/temp/log.do_patch.218884 Instead of changing S, it seems to be sufficient to switch build directory B to ${CARGO_VENDORING_DIRECTORY}/${BP}. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-yocto: remove tpm_x86.cfgMikko Rapeli2023-06-031-4/+0
| | | | | | | It's not used by linux-yocto bbappends in any configuration. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux-yocto: support tpm and tpm2 on all architecturesMikko Rapeli2023-06-031-10/+1
| | | | | | | | arm, arm64 and other machines can also have tpm and tpm2 devices and the config snippets tpm.scc and tpm2.scc work there too. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libhoth_git.bb:SRCREV bump 1622e8a04..d769296220dJohn Edward Broadbent2023-05-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Updating libhoth to match version in openbmc https://gerrit.openbmc.org/c/openbmc/openbmc/+/63424 libhoth detailed changes: Willy Tu Expose header files expose USB APIs aranikam Add flash_spi_info command Add address mode flag for spi update/read Chris Evans Rename ec_ commands; permit old command names as an alias. Apply clang-format, and enable it as a check action. (#24) Sui Chen Add payload status Add console snapshot Daimeng Wang libhoth: automated mtd mailbox discovery libhoth: implement MTD transport libhoth: add MTD backend boilerplate API Yoan Andreev Dont check for non-snapshot console params Extern c wrap (#22) Build improvements (#18) Add basic abstraction to libhoth and SPIDEV support (#17) Vidya Satyamsetti Add extern Kor Nielsen htool console: Don't leave O_NONBLOCK set on stdin [fix] In legacy mailbox protocol, look at response size. [fix] Support legacy response buffers larger than 62 bytes. [feat] htool: Support Hoth-B devices. Add --baud_rate flag to "htool console". Setup github workflow to build project. Rename "htool console -l" to "htool console -n". Add --onlcr flag to "htool console". Make example visibility public. Fix BUILD file formatting. Remove out-of-date :enumerate and :ec_hello. Add libusb to bazel WORKSPACE. Fix undefined behavior in htool command handling. Signed-off-by: John Edward Broadbent <jebr@google.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: Insert addpylib declarationArmin Kuster2023-05-225-0/+9
| | | | | | | | | | | Yocto mickledore introduced the addpylib directive for explicitly adding layer paths to the PYTHONPATH. Standalone OEQA test suite discovery does not require this directive but it is required to import test cases from other layers, e.g. to extend and modify the test cases. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samhain: Update to 4.4.10Armin Kuster2023-05-221-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity: add x86-64 systemd based example instructionsPaul Gortmaker2023-05-131-0/+77
| | | | | | | | | | | | | | | | | We have systemd-bootdisk-dmverity.wks.in as an example template but no mention of it in docs or config files. Similar to the beaglebone black insructions added earlier, we do the same for (qemu)x86-64. This hopefully walks through getting things configured for building a systemd based dm-verity image and booting it on qemux86-64 --filling in a lot of blanks and assumptions so that someone relatively new to the feature can get off the ground more quickly by using qemu as a stepping stone towards their final physical implementation. Finally, the full image is deployed and booted on real hardware. Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity: document the meta-intel dependency in the systemd examplePaul Gortmaker2023-05-131-0/+1
| | | | | | | The dependency might not be obvious to everyone, so leave a hint. Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity: don't make read-only-rootfs sound like a requirementPaul Gortmaker2023-05-131-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | Adding to your local.conf right out of the gate: EXTRA_IMAGE_FEATURES = "read-only-rootfs" while you are trying to sort out other things can be just another complication to an already steep learning curve. For example, I found simply enabling this with systemd caused: systemd[1]: Failed to fork off sandboxing environment for executing generators: Protocol error [!!!!!!] Failed to start up manager. systemd[1]: Freezing execution. While I'd like to get to the root cause of that, it doesn't change that things boot fine w/o adding to EXTRA_IMAGE_FEATURES, even though the rootfs is still read-only courtesy of dm-verity. Reword things so as to make it clear it isn't strictly a hard requirement and hence can be delayed as people work through their implementation. Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity: ensure people don't ignore the DISTRO_FEATURES warningPaul Gortmaker2023-05-131-0/+2
| | | | | | | | | | | | | | | Some platform creators tend to list a whole bunch of layers by default in conf/bblayers.conf. Without getting into the debate of whether that is a good idea, it can tend to have the effect of people seeing the meta-security DISTRO_FEATURES warning time and time again and becoming essentially numb to it. After having fallen into this trap myself, I figured it was worth the extra mention in the dm-verity doc so there is a better chance of users realizing "hey - this applies to me!". Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* integrity: Rename linux-%.bbappend to linux-yocto%.bbappendStefan Berger2023-05-131-0/+0
| | | | | | | | To avoid having linux-%.bbappend included in targets unrelated to the linux kernel, rename linux-%.bbappend to linux-yocto%.bbappend. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* integrity: Fix the do_configure functionStefan Berger2023-05-131-2/+4
| | | | | | | | | | | Append ':append' to do_configure so it does not replace all existing do_configure's. Only run 'sed' when DISTRO_FEATURES contains 'ima' and the .config file exists. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Drop kernel config option CONFIG_SQUASHFS_XATTR=y from ima.cfgStefan Berger2023-05-131-1/+0
| | | | | | | | Drop the kernel config option CONFIG_SQUASHFS_XATTR=y from ima.cfg. Instead, require projects that use squashfs to set this option. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux: overlayfs: Drop kernel patch resolving a file change notification issueStefan Berger2023-05-132-43/+0
| | | | | | | | | | | Revert the patch resolving a file change notitfication issue (for IMA appraisal) since this patch fails in 'many downstream kernels'. - https://lists.yoctoproject.org/g/yocto/message/59928 - https://lists.yoctoproject.org/g/yocto/message/59929 Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-security-tpm2: restore pkgs removed earlierArmin Kuster2023-05-061-0/+5
| | | | | | | | | commit: 0594aee packagegroup-security-tpm2.bb: remove dynamic pkgs is causing an issue with some users. Restore the packages and opted to fix via PACKAGE_ARCH = "${TUNE_PKGARCH}" Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-parsec/layer.conf: Insert addpylib declarationPeter Hoyes2023-05-061-0/+2
| | | | | | | | | | | | Yocto mickledore introduced the addpylib directive for explicitly adding layer paths to the PYTHONPATH. Standalone OEQA test suite discovery does not require this directive but it is required to import test cases from other layers, e.g. to extend and modify the test cases. Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss: drop vendor from PACKAGECONFIGArmin Kuster2023-05-061-1/+1
| | | | | | | fixes: WARNING: tpm2-tss-4.0.1-r0 do_configure: QA Issue: tpm2-tss: invalid PACKAGECONFIG: vendor [invalid-packageconfig] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openembedded-release: drop as os-release does this nowArmin Kuster2023-05-061-32/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* os-release.bbappend: drop now CPE_NAME is in coreArmin Kuster2023-05-061-1/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lynis: Add decoding OE and PokyArmin Kuster2023-05-062-1/+54
| | | | | | Patch sent upstream. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libmhash: fix multilib header conflict - mutils/mhash_config.hAdrian Zaharia2023-05-061-1/+5
| | | | | | | Header file conflict between 32-bit and 64-bit versions Signed-off-by: Adrian Zaharia <Adrian.Zaharia@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* integrity-image-minimal: adapt QEMU cmdline to new changesArmin Kuster2023-05-061-1/+1
| | | | | | Signed-off-by: Armin Kuster <akuster808@gmail.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* oeqa: fix hash test to match new changesArmin Kuster2023-05-061-6/+4
| | | | | | Signed-off-by: Armin Kuster <akuster808@gmail.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: Update ima-evm-utils to v1.5 and add a patchStefan Berger2023-05-062-2/+42
| | | | | Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux: overlayfs: Add kernel patch resolving a file change notification issueStefan Berger2023-05-062-0/+43
| | | | | | | | | | | | | Add a temporary patch that resolves a file change notification issue with overlayfs where IMA did not become aware of the file changes since the 'lower' inode's i_version had not changed. The issue will be resolved in later kernels with the following patch that builds on newly addd feature (support for STATX_CHANGE_COOKIE) in v6.3-rc1: https://lore.kernel.org/linux-integrity/20230418-engste-gastwirtschaft-601fb389bba5@brauner/T/#m3bf84296fe9e6499abb6e3191693948add2ff459 Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* integrity: Update the README for IMA supportStefan Berger2023-05-061-9/+11
| | | | | | | Update the README describing how IMA support can be used. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Sign all executables and the ima-policy in the root filesystemStefan Berger2023-05-061-5/+20
| | | | | Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Rename IMA_EVM_POLICY_SYSTEMD to IMA_EVM_POLICYStefan Berger2023-05-062-3/+3
| | | | | | | | | The IMA policy will be specified using the IMA_EVM_POLICY variable since systemd will not be involved in loading the policy but the init script will load it. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Fix the IMA kernel featureStefan Berger2023-05-067-251/+63
| | | | | | | | Fix the IMA kernel feature. Remove outdated patches and add ima.cfg holding kernel configuration options for IMA and EVM. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Fix the ima_policy_appraise_all to appraise executables & librariesStefan Berger2023-05-061-1/+8
| | | | | | | | | Fix the ima_policy_appraise_all policy to appraise all executables and libraries. Also update the list of files that are not appraised to not appraise cgroup related files. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Document and replace keys and adapt scripts for EC keysStefan Berger2023-05-068-62/+50
| | | | | | | | | | For shorted file signatures use EC keys rather than RSA keys. Document the debug keys and their purpose. Adapt the scripts for creating these types of keys to now create EC keys. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* maintainers.inc: rename to avoid clashes with oe-coreAlexander Kanavin2023-05-062-0/+0
| | | | | | | | | | Additional maintainer entries should be added to ones provided by oe-core, but not be replacing them, as that breaks oe-core tests. Another option is to place them directly into recipes. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* fscryptctl: update to 1.0.1Armin Kuster2023-05-061-1/+6
| | | | | | Don't build man as it needs pandoc Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: update to 6.0.11Armin Kuster2023-05-061-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libhtp: update to 0.5.43Armin Kuster2023-05-061-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-04 08:46:05 +0000