From a633d83537db50d173eee8ce1594a7a818674d43 Mon Sep 17 00:00:00 2001 From: Armin Kuster Date: Tue, 26 Sep 2017 14:01:46 -0700 Subject: openscap: Add oe specific files Signed-off-by: Armin Kuster --- .../files/OpenEmbedded_nodistro_0.xccdf.xml | 14 ++++ .../oe-scap/files/OpenEmbedded_nodistro_0.xml | 83 ++++++++++++++++++++++ .../oe-scap/files/oval-to-xccdf.xslt | 72 +++++++++++++++++++ .../recipes-openscap/oe-scap/files/run_cve.sh | 7 ++ .../recipes-openscap/oe-scap/files/run_test.sh | 5 ++ .../recipes-openscap/oe-scap/oe-scap_1.0.bb | 34 +++++++++ 6 files changed, 215 insertions(+) create mode 100644 meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xccdf.xml create mode 100644 meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xml create mode 100644 meta-security-compliance/recipes-openscap/oe-scap/files/oval-to-xccdf.xslt create mode 100644 meta-security-compliance/recipes-openscap/oe-scap/files/run_cve.sh create mode 100644 meta-security-compliance/recipes-openscap/oe-scap/files/run_test.sh create mode 100644 meta-security-compliance/recipes-openscap/oe-scap/oe-scap_1.0.bb diff --git a/meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xccdf.xml b/meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xccdf.xml new file mode 100644 index 0000000..d3b2c9a --- /dev/null +++ b/meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xccdf.xml @@ -0,0 +1,14 @@ + + + incomplete + Automatically generated XCCDF from OVAL file: OpenEmbedded_nodistro_0.xml + This file has been generated automatically from oval definitions file. + None, generated from OVAL file. + + CPE-2017:1365: nss security and bug fix update (Important) + CVE-2017-7502 + + + + + diff --git a/meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xml b/meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xml new file mode 100644 index 0000000..a9bf2a0 --- /dev/null +++ b/meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xml @@ -0,0 +1,83 @@ + + + + OpenEmbedded Errata Test System + 5.10.1 + 2017-06-07T04:05:05 + + + + + + CPE-2017:1365: nss security and bug fix update (Important) + + OpenEmbedded Nodistro + + + + Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. + +Security Fix(es): + +* A null pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library. (CVE-2017-7502) + +Bug Fix(es): + +* The Network Security Services (NSS) code and Certificate Authority (CA) list have been updated to meet the recommendations as published with the latest Mozilla Firefox Extended Support Release (ESR). The updated CA list improves compatibility with the certificates that are used in the Internet Public Key Infrastructure (PKI). To avoid certificate validation refusals, Red Hat recommends installing the updated CA list on June 12, 2017. (BZ#1451421) + + + + + Important + NA + + + CVE-2017-7502 + CVE-2017-7502 nss: Null pointer dereference when handling empty SSLv2 messages + + cpe:/o:openembedded:nodistro:0 + + + + + + + + + + + + + + + + + + + + + + + + + + + + nss + + + openembedded-release + + + + + + + ^1[^\d] + + + 0:3.31.4-r0 + + + + diff --git a/meta-security-compliance/recipes-openscap/oe-scap/files/oval-to-xccdf.xslt b/meta-security-compliance/recipes-openscap/oe-scap/files/oval-to-xccdf.xslt new file mode 100644 index 0000000..2243ac4 --- /dev/null +++ b/meta-security-compliance/recipes-openscap/oe-scap/files/oval-to-xccdf.xslt @@ -0,0 +1,72 @@ + + + + + + + + incomplete + + Automatically generated XCCDF from OVAL file: + + + This file has been generated automatically from oval definitions file. + + + + + None, generated from OVAL file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/meta-security-compliance/recipes-openscap/oe-scap/files/run_cve.sh b/meta-security-compliance/recipes-openscap/oe-scap/files/run_cve.sh new file mode 100644 index 0000000..48a7485 --- /dev/null +++ b/meta-security-compliance/recipes-openscap/oe-scap/files/run_cve.sh @@ -0,0 +1,7 @@ +#!/bin/sh + +oscap oval eval \ +--report oval.html \ +--verbose-log-file filedevel.log \ +--verbose DEVEL \ +/usr/share/xml/scap/ssg/content/ssg-openembedded-ds.xml diff --git a/meta-security-compliance/recipes-openscap/oe-scap/files/run_test.sh b/meta-security-compliance/recipes-openscap/oe-scap/files/run_test.sh new file mode 100644 index 0000000..70cd82c --- /dev/null +++ b/meta-security-compliance/recipes-openscap/oe-scap/files/run_test.sh @@ -0,0 +1,5 @@ +#!/bin/sh + +#oscap oval eval --result-file ./myresults.xml ./OpenEmbedded_nodistro_0.xml + +oscap xccdf eval --results results.xml --report report.html OpenEmbedded_nodistro_0.xccdf.xml diff --git a/meta-security-compliance/recipes-openscap/oe-scap/oe-scap_1.0.bb b/meta-security-compliance/recipes-openscap/oe-scap/oe-scap_1.0.bb new file mode 100644 index 0000000..5b61375 --- /dev/null +++ b/meta-security-compliance/recipes-openscap/oe-scap/oe-scap_1.0.bb @@ -0,0 +1,34 @@ +# Copyright (C) 2017 Armin Kuster +# Released under the MIT license (see COPYING.MIT for the terms) + +SUMARRY = "OE SCAP files" +LIC_FILES_CHKSUM = "file://README.md;md5=46dec9f167b6e05986cb4023df6d92f4" +LICENSE = "MIT" + +SRCREV = "7147871d7f37d408c0dd7720ef0fd3ec1b54ad98" +SRC_URI = "git://github.com/akuster/oe-scap.git" +SRC_URI += " \ + file://run_cve.sh \ + file://run_test.sh \ + file://OpenEmbedded_nodistro_0.xml \ + file://OpenEmbedded_nodistro_0.xccdf.xml \ +" + + +S = "${WORKDIR}/git" + +do_configure[noexec] = "1" +do_compile[noexec] = "1" + +do_install () { + install -d ${D}/${datadir}/oe-scap + install ${WORKDIR}/run_cve.sh ${D}/${datadir}/oe-scap/. + install ${WORKDIR}/run_test.sh ${D}/${datadir}/oe-scap/. + install ${WORKDIR}/OpenEmbedded_nodistro_0.xml ${D}/${datadir}/oe-scap/. + install ${WORKDIR}/OpenEmbedded_nodistro_0.xccdf.xml ${D}/${datadir}/oe-scap/. + cp ${S}/* ${D}/${datadir}/oe-scap/. +} + +FILES_${PN} += "${datadir}/oe-scap" + +RDEPENDS_${PN} = "openscap" -- cgit v1.2.3-54-g00ecf