summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* libseccomp: upgrade 2.5.0 -> 2.5.1Armin Kuster2021-03-022-52/+2
| | | | drop patch merged in update
* fscryptctl: upgrade 0.1.0 -> 1.0.0Armin Kuster2021-03-021-1/+1
|
* ding-libs: upgrade 0.5.0 -> 0.6.1Armin Kuster2021-03-021-2/+1
|
* checksec: upgrade 2.1.0 -> 2.4.0Armin Kuster2021-03-021-2/+2
| | | | LIC_FILES_CHKSUM update do to yr change
* arpwatch: upgrade 3.0 -> 3.1Armin Kuster2021-03-021-2/+2
| | | | LIC_FILES_CHKSUM update do to yr change
* kas-security-base.yml: drop DL_DIRArmin Kuster2021-03-021-1/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas-security-base.yml: build setting updatesArmin Kuster2021-02-231-0/+8
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nikito: Update common-licenses references to match new namesArmin Kuster2021-02-234-4/+4
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* scap-security-guide: Inherit python3targetconfigArmin Kuster2021-02-231-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openscap: Inherit python3targetconfigArmin Kuster2021-02-231-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* python3-suricata-update: Inherit python3targetconfigArmin Kuster2021-02-231-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: Inherit python3targetconfigArmin Kuster2021-02-231-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-rootfs.bbclass: avoid generating /etc/fstab for wicMing Liu2021-02-231-0/+3
| | | | | | | Or else wic will fail without "--no-fstab-update" option. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* initramfs-framework-ima: let ima_enabled return 0Ming Liu2021-02-231-0/+1
| | | | | | | Otherwise, ima script would not run as intended. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* README.md: update according to the refactoring in ima-evm-rootfs.bbclassMing Liu2021-02-231-1/+3
| | | | | Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta: refactor IMA/EVM sign rootfsMing Liu2021-02-231-18/+12
| | | | | | | | | | | | | | | | | | | | | | | | | The current logic in ima-evm-rootfs.bbclass does not guarantee ima_evm_sign_rootfs is the last function in IMAGE_PREPROCESS_COMMAND by appending to it, for instance, if there are other "_append" being used as it's the case in openembedded-core/meta/classes/image.bbclass: | IMAGE_PREPROCESS_COMMAND_append = " ${@ 'systemd_preset_all;' \ | if bb.utils.contains('DISTRO_FEATURES', 'systemd', True, False, d) \ | and not bb.utils.contains('IMAGE_FEATURES', 'stateless-rootfs', True, | False, d) else ''} reproducible_final_image_task; " and ima-evm-rootfs should be in IMAGE_CLASSES instead of in INHERIT since that would impact all recipes but not only image recipes. To fix the above issues, we introduce a ima_evm_sign_handler setting IMA/EVM rootfs signing requirements/dependencies in event bb.event.RecipePreFinalise, it checks 'ima' distro feature to decide if IMA/EVM rootfs signing logic should be applied or not. Also add ima-evm-keys to IMAGE_INSTALL. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* initramfs-framework-ima: RDEPENDS on ima-evm-keysMing Liu2021-02-231-1/+1
| | | | | Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-keys: add recipeMing Liu2021-02-231-0/+16
| | | | | | | Create a recipe to package IMA/EMV public keys. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* initramfs-framework-ima: fix a wrong pathMing Liu2021-02-231-1/+1
| | | | | | | /etc/ima-policy > /etc/ima/ima-policy. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: set native REQUIRED_DISTRO_FEATURES to emptyMing Liu2021-02-231-0/+1
| | | | | | | | 'ima' does not have to be in native DISTRO_FEATURES, unset it to avoid sanity check for ima-evm-utils-native. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* softhsm: drop pkg as meta-oe has itArmin Kuster2021-02-231-30/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* scap-security-guide: Fix openembedded platform tests and buildJate Sujjavanich2021-02-143-0/+82
| | | | | | | | Add patches to fix openembedded nodistro tests and openembedded build within ssg metadata. Signed-Off-By: Jate Sujjavanich <jatedev@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ibmswtpm2: disable camellia algorithmYi Zhao2021-01-231-1/+1
| | | | | | | | | | | | | The openssl in oe-core has disabled several deprecated algorithms including camellia. Disable this algorithm to fix the build error. Fixes: TpmToOsslSym.h:185:42: error: unknown type name 'CAMELLIA_KEY' 185 | #define tpmKeyScheduleCAMELLIA CAMELLIA_KEY | ^~~~~~~~~~~~ Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-pkcs11: build and package python toolsAdrian Ratiu2020-12-241-2/+23
| | | | | Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* .gitlab-ci: drop scriptArmin Kuster2020-11-171-1/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas-security-base: Don't create local SSTATE mirrorArmin Kuster2020-11-151-1/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* scap-security-guide: fix build with Python 3.9Yi Zhao2020-11-154-0/+161
| | | | | | | | | | | | | | | The getchildren and getiterator functions are deprecated in Python 3.9. Backport 3 patches to fix the build issue. Fixes: File "/build/tmp/work/cortexa8hf-neon-poky-linux-gnueabi/scap-security-guide/0.1.44+gitAUTOINC+5fdfdcb2e9-r0/git/ssg/build_stig.py", line 41, in add_references index = rule.getchildren().index(ref) AttributeError: 'xml.etree.ElementTree.Element' object has no attribute 'getchildren' Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* samhain: update to 4.4.2Armin Kuster2020-11-033-52/+42
| | | | | | refresh a few patches too Signed-off-by: Armin Kuster <akuster808@gmail.com>
* clamav: unify volatiles file nameYi Zhao2020-11-031-1/+1
| | | | | | | Make the volatiles file name starts with digital. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: unify volatiles file nameYi Zhao2020-11-031-1/+1
| | | | | | | Make the volatiles file name starts with digital. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gitlab-ci: add building meta-security-compliance pkgsArmin Kuster2020-10-192-0/+16
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gitlab-ci: add meta-hardening build imageArmin Kuster2020-10-193-0/+16
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-security: Add gatesgarth to LAYERSERIES_COMPATArmin Kuster2020-10-196-6/+6
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: use += instead of := to update BBFILESSajjad Ahmed2020-10-191-2/+1
| | | | | | | | Updating BBFILES with := isn't the standard way and can break parsing under certain conditions, instead use += which is widely used. Signed-off-by: Sajjad Ahmed <sajjad_ahmed@mentor.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* scap-security-guide: add expat-native to DEPENDSMingli Yu2020-10-151-1/+1
| | | | | | | | | Add expat-native to DEPENDS to fix the below do_configure error: | CMake Error at CMakeLists.txt:165 (message): | xmlwf is required! Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-pkcs11: update to 1.4.0Armin Kuster2020-10-152-2/+82
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tools: update to 4.3.0Armin Kuster2020-10-152-2/+2
| | | | | | LIC_FILES_CHKSUM changes do to added Copyright Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-abrmd: update to 2.3.3Armin Kuster2020-10-151-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-totp: update to 0.2.1Armin Kuster2020-10-151-3/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss: update to 2.4.3Armin Kuster2020-10-151-3/+1
| | | | | | includes: CVE-2020-24455 Signed-off-by: Armin Kuster <akuster808@gmail.com>
* gitlab-ci: add qemux86 and qemuarm64 musl buildsArmin Kuster2020-10-153-0/+29
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* kas: fixup alt configsArmin Kuster2020-10-153-10/+10
| | | | | | add smack Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: update to 4.1.9Armin Kuster2020-10-103-2/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security: remove clamav from musl imageArmin Kuster2020-10-101-0/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sssd: update to latest ltm 1.16.5Armin Kuster2020-10-102-3/+37
| | | | | | fix musl support Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libest: fix musl build.Armin Kuster2020-10-101-0/+4
| | | | | | | | | fixes est.c:38:10: fatal error: execinfo.h: No such file or directory | 38 | #include <execinfo.h> | | ^~~~~~~~~~~~ Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ecryptfs-utils: fix musl buildArmin Kuster2020-10-102-0/+16
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* apparmor: fix build for on muslArmin Kuster2020-10-106-1/+185
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* qemux86-test: add apparmor backArmin Kuster2020-10-101-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: fix compiling on gcc10Armin Kuster2020-10-091-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-08 23:43:01 +0000