summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* .gitlab-ci: work on pipelimeArmin Kuster2021-04-191-21/+76
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gitlab-ci: move tpm buildArmin Kuster2021-04-191-11/+3
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* *-tpm.yml: drop tpms jobsArmin Kuster2021-04-193-30/+0
| | | | | | way too many jobs. TPM have there own images, use that Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas-security-base: Move some DISTRO_FEATURES aroundArmin Kuster2021-04-192-1/+2
| | | | | | Move FEATURES that affect kernel configuation to minimize rebuilds Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gitlab-ci: Move all parsec builds into a separate jobAnton Antonov2021-04-171-5/+9
| | | | | Signed-off-by: Anton Antonov <Anton.Antonov@arm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lkrg-module: Add Linux Kernel Runtime GuardArmin Kuster2021-04-142-0/+106
| | | | | | | | | | | | | | | | | | For more info see: https://github.com/openwall/lkrg Add to local.conf: IMAGE_INSTALL_append = " kernel-module-lkrg" Need these kconfig options enabled: CONFIG_KALLSYMS_ALL=y CONFIG_JUMP_LABEL=y CONFIG_DEBUG_KERNEL=y To invoke module: sudo insmod {path-to-modules}/p_lkrg.ko kint_enforce=1 Signed-off-by: Armin Kuster <akuster808@gmail.com>
* clamav: remove rest of mirror.dat refArmin Kuster2021-04-141-4/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* Clearly define clang toolchain in Parsec recipesAnton Antonov2021-04-142-4/+3
| | | | | Signed-off-by: Anton Antonov <Anton.Antonov@arm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gitlab-ci: fine tune orderArmin Kuster2021-04-141-6/+6
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas-security-base.yml: tweek build varsArmin Kuster2021-04-121-1/+1
| | | | | | add meta-filesystems Signed-off-by: Armin Kuster <akuster808@gmail.com>
* .gitlab-ci.yml: reorder to speed up buildsArmin Kuster2021-04-121-80/+31
| | | | | | Also clean up extra spaces Signed-off-by: Armin Kuster <akuster808@gmail.com>
* initramfs-framework-ima: introduce IMA_FORCEMing Liu2021-04-122-2/+12
| | | | | | | | | | | | | | Introduce IMA_FORCE to allow the IMA policy be applied forcely even 'no_ima' boot parameter is available. This ensures the end users have a way to disable 'no_ima' support if they want to, because it may expose a security risk if an attacker can find a way to change kernel arguments, it will easily bypass rootfs authenticity checks. Signed-off-by: Sergio Prado <sergio.prado@toradex.com> Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* Define secure images with parsec-service and parsec-tool included and add ↵Anton Antonov2021-04-127-0/+76
| | | | | | | the images into gitlab CI Signed-off-by: Anton Antonov <Anton.Antonov@arm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* Add meta-parsec layer into meta-security.Anton Antonov2021-04-1210-0/+661
| | | | | | | The layer contains recipes for Parsec service version 0.7.0 and parsec-tool version 0.3.0. The Parsec service is built with all supported providers and deployed with the MbedCrypto provider enabled. Both systemd and sysv-init are supported. Signed-off-by: Anton Antonov <Anton.Antonov@arm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* README: cleanupArmin Kuster2021-04-121-12/+15
| | | | | | Add note about rust. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: add dynamic-layer for rust pkgArmin Kuster2021-04-121-0/+4
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: update to 6.0.2Armin Kuster2021-04-129-0/+1613
| | | | | | needs rust Signed-off-by: Armin Kuster <akuster808@gmail.com>
* Use libest "main" branch instead of "master".Anton Antonov2021-04-121-1/+1
| | | | | | | | | | | This patch fixes the issue: WARNING: libest-3.2.0-r0 do_fetch: Failed to fetch URL git://github.com/cisco/libest, attempting MIRRORS if available ERROR: libest-3.2.0-r0 do_fetch: Fetcher failure: Unable to find revision 4ca02c6d7540f2b1bcea278a4fbe373daac7103b in branch master even from upstream ERROR: libest-3.2.0-r0 do_fetch: Fetcher failure for URL: 'git://github.com/cisco/libest'. Unable to fetch URL from any source. Signed-off-by: Anton Antonov <Anton.Antonov@arm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-suricata-update: update to 1.2.1Armin Kuster2021-04-121-3/+5
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* swtpm: fix check for tscd deamon on hostArmin Kuster2021-04-122-0/+66
| | | | | | Found a few places that tscd check was trying to run the hosts. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* swtpm: file pip3 issueArmin Kuster2021-04-021-3/+3
| | | | | | | | | | | need native pip3, was using host's Signed-off-by: Armin Kuster <akuster808@gmail.com> -- V2] add python3-cryptography-native to DEPENDS forgot to add changes.
* swtpm: now need python-cryptography, pull in layerArmin Kuster2021-04-021-0/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* clamav: fix systemd service installArmin Kuster2021-04-021-1/+4
| | | | | | | | ERROR: clamav-0.104.0-r0 do_package: QA Issue: clamav: Files/directories were installed but not shipped in any package: /lib/systemd/system/clamav-daemon.service /lib/systemd/system/clamav-clamonacc.service Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-privacyidea: upgrade 3.5.1 -> 3.5.2Armin Kuster2021-04-021-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta: drop IMA_POLICY from policy recipesMing Liu2021-04-023-21/+6
| | | | | | | | | | | | IMA_POLICY is being referred as policy recipe name in some places and it is also being referred as policy file in other places, they are conflicting with each other which make it impossible to set a IMA_POLICY global variable in config file. Fix it by dropping IMA_POLICY definitions from policy recipes Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* clamav: upgrade 104.0Armin Kuster2021-04-023-64/+134
| | | | | | | | | | | | | | | convert to cmake and general cleanup include on oe env patch and glibc 2.33 header fixup if running w/in qemu, need to add qemuparams="-m 2048" to allow freshclam not to oom Signed-off-by: Armin Kuster <akuster808@gmail.com> --- V2] Bump PV to match what is being d/l
* packagegroup-core-security: drop clamav-cvdArmin Kuster2021-04-021-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* swtpm: update to 0.5.2Armin Kuster2021-03-251-8/+9
| | | | | | Add python package Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss-engine: update 1.1.0Armin Kuster2021-03-251-3/+3
| | | | | | LIC_FILES_CHKSUM hash changed between branches. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: Add hardknott to LAYERSERIES_COMPATArmin Kuster2021-03-186-6/+6
| | | | | | Thats codename for 3.3 Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-keys: add file-checksums to IMA_EVM_X509Ming Liu2021-03-181-0/+1
| | | | | | | | This ensures when a end user change the IMA_EVM_X509 key file, ima-evm-keys recipe will be rebuilt. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samhain: fix compile error on powerpcKai Kang2021-03-182-0/+29
| | | | | | | | | | | | | | It fails to comile samhain for powerpc(qemuppc): | x_sh_dbIO.c: In function 'swap_short': | x_sh_dbIO.c:229:36: error: initializer element is not constant | 229 | static unsigned short ooop = *iptr; | | ^ Assign after initialization of the static variable to avoid the failure. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* fscryptctl: Fix installation pathlukasz plachno2021-03-181-1/+1
| | | | | | | - Without the patch fscryptctl is installed in /usr/bin/usr/local/bin instead of /usr/bin. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-fail2ban: fix building with ptest enabledArmin Kuster2021-03-092-2/+3
| | | | | | Use new structure for testing. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm-tools: update to 1.3.9.1Armin Kuster2021-03-092-112/+1
| | | | | | drop patch included in update Signed-off-by: Armin Kuster <akuster808@gmail.com>
* trousers: update to 0.3.15Armin Kuster2021-03-091-2/+2
| | | | | | includes: CVE-2020-24332, CVE-2020-24330, CVE-2020-24331 Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-topt: update 0.3.0Armin Kuster2021-03-091-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-pkcs11: update to 1.5.0Armin Kuster2021-03-091-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss: update to 3.0.3Armin Kuster2021-03-092-2/+52
| | | | | | include automate 2.70 fix Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tools: update to 5.0Armin Kuster2021-03-091-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-abrmd: update to 2.4.0Armin Kuster2021-03-091-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ibmtpm2tss: update to 1.6.0Armin Kuster2021-03-092-18/+14
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libtpm: update to 0.8.2Armin Kuster2021-03-091-2/+2
| | | | | | | | Signed-off-by: Armin Kuster <akuster808@gmail.com> -- V2] let include the updated changes
* ima-policy-hashed: add CGROUP2_SUPER_MAGIC fsmagicMing Liu2021-03-021-0/+3
| | | | | | | | | | | This fixes following systemd boot issues: [ 7.455580] systemd[1]: Failed to create /init.scope control group: Permission denied [ 7.457677] systemd[1]: Failed to allocate manager object: Permission denied [!!!!!!] Failed to allocate manager object. [ 7.459270] systemd[1]: Freezing execution. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-fail2ban: update to 0.11.2Armin Kuster2021-03-022-2530/+4
| | | | | | drop hard python3 patch and create it dufing compile. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: update to 4.10.0Armin Kuster2021-03-023-2/+2
| | | | | | This is the last 4.x. Will need rust support to move to 6.x Signed-off-by: Armin Kuster <akuster808@gmail.com>
* opendnssec: update to 2.1.8Armin Kuster2021-03-023-53/+24
| | | | | | | refresh libdns_conf_fix.patch Drop fix_fprint.patch includd in update Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samhain: update to 4.4.3Armin Kuster2021-03-021-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-scapy: upgrade 2.4.3 -> 2.4.4Armin Kuster2021-03-021-1/+1
|
* python3-privacyidea: upgrade 3.3 -> 3.5.1Armin Kuster2021-03-021-1/+1
|
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-08 18:29:59 +0000