summaryrefslogtreecommitdiffstats
path: root/meta/classes/cve-check.bbclass
diff options
context:
space:
mode:
Diffstat (limited to 'meta/classes/cve-check.bbclass')
-rw-r--r--meta/classes/cve-check.bbclass46
1 files changed, 23 insertions, 23 deletions
diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
index 75b8fa9ab9..aad0573ee9 100644
--- a/meta/classes/cve-check.bbclass
+++ b/meta/classes/cve-check.bbclass
@@ -51,7 +51,7 @@ python do_cve_check () {
51 Check recipe for patched and unpatched CVEs 51 Check recipe for patched and unpatched CVEs
52 """ 52 """
53 53
54 if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE", True)): 54 if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE")):
55 patched_cves = get_patches_cves(d) 55 patched_cves = get_patches_cves(d)
56 patched, unpatched = check_cves(d, patched_cves) 56 patched, unpatched = check_cves(d, patched_cves)
57 if patched or unpatched: 57 if patched or unpatched:
@@ -70,7 +70,7 @@ python cve_check_cleanup () {
70 Delete the file used to gather all the CVE information. 70 Delete the file used to gather all the CVE information.
71 """ 71 """
72 72
73 bb.utils.remove(e.data.getVar("CVE_CHECK_TMP_FILE", True)) 73 bb.utils.remove(e.data.getVar("CVE_CHECK_TMP_FILE"))
74} 74}
75 75
76addhandler cve_check_cleanup 76addhandler cve_check_cleanup
@@ -83,12 +83,12 @@ python cve_check_write_rootfs_manifest () {
83 83
84 import shutil 84 import shutil
85 85
86 if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE", True)): 86 if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE")):
87 bb.note("Writing rootfs CVE manifest") 87 bb.note("Writing rootfs CVE manifest")
88 deploy_dir = d.getVar("DEPLOY_DIR_IMAGE", True) 88 deploy_dir = d.getVar("DEPLOY_DIR_IMAGE")
89 link_name = d.getVar("IMAGE_LINK_NAME", True) 89 link_name = d.getVar("IMAGE_LINK_NAME")
90 manifest_name = d.getVar("CVE_CHECK_MANIFEST", True) 90 manifest_name = d.getVar("CVE_CHECK_MANIFEST")
91 cve_tmp_file = d.getVar("CVE_CHECK_TMP_FILE", True) 91 cve_tmp_file = d.getVar("CVE_CHECK_TMP_FILE")
92 92
93 shutil.copyfile(cve_tmp_file, manifest_name) 93 shutil.copyfile(cve_tmp_file, manifest_name)
94 94
@@ -101,7 +101,7 @@ python cve_check_write_rootfs_manifest () {
101 bb.plain("Image CVE report stored in: %s" % manifest_name) 101 bb.plain("Image CVE report stored in: %s" % manifest_name)
102} 102}
103 103
104ROOTFS_POSTPROCESS_COMMAND_prepend = "${@'cve_check_write_rootfs_manifest; ' if d.getVar('CVE_CHECK_CREATE_MANIFEST', True) == '1' else ''}" 104ROOTFS_POSTPROCESS_COMMAND_prepend = "${@'cve_check_write_rootfs_manifest; ' if d.getVar('CVE_CHECK_CREATE_MANIFEST') == '1' else ''}"
105 105
106def get_patches_cves(d): 106def get_patches_cves(d):
107 """ 107 """
@@ -110,7 +110,7 @@ def get_patches_cves(d):
110 110
111 import re 111 import re
112 112
113 pn = d.getVar("PN", True) 113 pn = d.getVar("PN")
114 cve_match = re.compile("CVE:( CVE\-\d{4}\-\d+)+") 114 cve_match = re.compile("CVE:( CVE\-\d{4}\-\d+)+")
115 patched_cves = set() 115 patched_cves = set()
116 bb.debug(2, "Looking for patches that solves CVEs for %s" % pn) 116 bb.debug(2, "Looking for patches that solves CVEs for %s" % pn)
@@ -149,15 +149,15 @@ def check_cves(d, patched_cves):
149 cves_patched = [] 149 cves_patched = []
150 cves_unpatched = [] 150 cves_unpatched = []
151 bpn = d.getVar("CVE_PRODUCT") 151 bpn = d.getVar("CVE_PRODUCT")
152 pv = d.getVar("PV", True).split("git+")[0] 152 pv = d.getVar("PV").split("git+")[0]
153 cves = " ".join(patched_cves) 153 cves = " ".join(patched_cves)
154 cve_db_dir = d.getVar("CVE_CHECK_DB_DIR", True) 154 cve_db_dir = d.getVar("CVE_CHECK_DB_DIR")
155 cve_whitelist = ast.literal_eval(d.getVar("CVE_CHECK_CVE_WHITELIST", True)) 155 cve_whitelist = ast.literal_eval(d.getVar("CVE_CHECK_CVE_WHITELIST"))
156 cve_cmd = "cve-check-tool" 156 cve_cmd = "cve-check-tool"
157 cmd = [cve_cmd, "--no-html", "--csv", "--not-affected", "-t", "faux", "-d", cve_db_dir] 157 cmd = [cve_cmd, "--no-html", "--csv", "--not-affected", "-t", "faux", "-d", cve_db_dir]
158 158
159 # If the recipe has been whitlisted we return empty lists 159 # If the recipe has been whitlisted we return empty lists
160 if d.getVar("PN", True) in d.getVar("CVE_CHECK_PN_WHITELIST", True).split(): 160 if d.getVar("PN") in d.getVar("CVE_CHECK_PN_WHITELIST").split():
161 bb.note("Recipe has been whitelisted, skipping check") 161 bb.note("Recipe has been whitelisted, skipping check")
162 return ([], []) 162 return ([], [])
163 163
@@ -210,7 +210,7 @@ def get_cve_info(d, cves):
210 from pysqlite2 import dbapi2 as sqlite3 210 from pysqlite2 import dbapi2 as sqlite3
211 211
212 cve_data = {} 212 cve_data = {}
213 db_file = d.getVar("CVE_CHECK_DB_FILE", True) 213 db_file = d.getVar("CVE_CHECK_DB_FILE")
214 placeholder = ",".join("?" * len(cves)) 214 placeholder = ",".join("?" * len(cves))
215 query = "SELECT * FROM NVD WHERE id IN (%s)" % placeholder 215 query = "SELECT * FROM NVD WHERE id IN (%s)" % placeholder
216 conn = sqlite3.connect(db_file) 216 conn = sqlite3.connect(db_file)
@@ -231,15 +231,15 @@ def cve_write_data(d, patched, unpatched, cve_data):
231 CVE manifest if enabled. 231 CVE manifest if enabled.
232 """ 232 """
233 233
234 cve_file = d.getVar("CVE_CHECK_LOCAL_FILE", True) 234 cve_file = d.getVar("CVE_CHECK_LOCAL_FILE")
235 nvd_link = "https://web.nvd.nist.gov/view/vuln/detail?vulnId=" 235 nvd_link = "https://web.nvd.nist.gov/view/vuln/detail?vulnId="
236 write_string = "" 236 write_string = ""
237 first_alert = True 237 first_alert = True
238 bb.utils.mkdirhier(d.getVar("CVE_CHECK_LOCAL_DIR", True)) 238 bb.utils.mkdirhier(d.getVar("CVE_CHECK_LOCAL_DIR"))
239 239
240 for cve in sorted(cve_data): 240 for cve in sorted(cve_data):
241 write_string += "PACKAGE NAME: %s\n" % d.getVar("PN", True) 241 write_string += "PACKAGE NAME: %s\n" % d.getVar("PN")
242 write_string += "PACKAGE VERSION: %s\n" % d.getVar("PV", True) 242 write_string += "PACKAGE VERSION: %s\n" % d.getVar("PV")
243 write_string += "CVE: %s\n" % cve 243 write_string += "CVE: %s\n" % cve
244 if cve in patched: 244 if cve in patched:
245 write_string += "CVE STATUS: Patched\n" 245 write_string += "CVE STATUS: Patched\n"
@@ -257,13 +257,13 @@ def cve_write_data(d, patched, unpatched, cve_data):
257 bb.note("Writing file %s with CVE information" % cve_file) 257 bb.note("Writing file %s with CVE information" % cve_file)
258 f.write(write_string) 258 f.write(write_string)
259 259
260 if d.getVar("CVE_CHECK_COPY_FILES", True) == "1": 260 if d.getVar("CVE_CHECK_COPY_FILES") == "1":
261 cve_dir = d.getVar("CVE_CHECK_DIR", True) 261 cve_dir = d.getVar("CVE_CHECK_DIR")
262 bb.utils.mkdirhier(cve_dir) 262 bb.utils.mkdirhier(cve_dir)
263 deploy_file = os.path.join(cve_dir, d.getVar("PN", True)) 263 deploy_file = os.path.join(cve_dir, d.getVar("PN"))
264 with open(deploy_file, "w") as f: 264 with open(deploy_file, "w") as f:
265 f.write(write_string) 265 f.write(write_string)
266 266
267 if d.getVar("CVE_CHECK_CREATE_MANIFEST", True) == "1": 267 if d.getVar("CVE_CHECK_CREATE_MANIFEST") == "1":
268 with open(d.getVar("CVE_CHECK_TMP_FILE", True), "a") as f: 268 with open(d.getVar("CVE_CHECK_TMP_FILE"), "a") as f:
269 f.write("%s" % write_string) 269 f.write("%s" % write_string)