linux/meta-openembedded.git/meta-oe/recipes-security, branch scarthgapMirror of git.openembedded.org/meta-openembeddedhttps://git.enea.com/cgit/linux/meta-openembedded.git/atom?h=scarthgap2026-04-29T04:44:29+00:00kernel-hardening-checker: update 0.6.10.2 -> 0.6.17.12026-04-29T04:44:29+00:00Michael Opdenackermichael.opdenacker@rootcommit.com2026-04-22T10:06:48+00:00urn:sha1:32081787dc12cd372be6e2b134379e735f1bbc08
Following the update on master.
This version reports more hardening issues:
128 "failures" instead of 113 on the same kernel.
Signed-off-by: Michael Opdenacker <michael.opdenacker@rootcommit.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
nmap: rename enum PCAP_SOCKET2026-04-15T08:42:18+00:00Jinfeng Wangjinfeng.wang.cn@windriver.com2026-04-10T07:05:08+00:00urn:sha1:f3e47be00a48203722057ed36d6fc0878a447000
The enum PCAP_SOCKET conflicts with the PCAP_SOCKET macro introduced in
libpcap 1.10.5. Use ifdefs to handle both old and new libpcap versions,
renaming the enum to NM_PCAP_SOCKET when the PCAP_SOCKET macro is defined.
Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
audit: fix build when systemd is enabled.2025-11-17T04:45:06+00:00Armin Kusterakuster808@gmail.com2025-11-13T06:18:56+00:00urn:sha1:ff87862031a66002189206d3855ad94d44b8636e
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e68145b00260fc380242cd67579068427e501c10)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
audit: Fix CVE_PRODUCT2025-11-17T04:45:06+00:00Shinji Matsunagashin.matsunaga@fujitsu.com2025-11-13T06:18:55+00:00urn:sha1:80adc2113cd32ec6fb0ed8f5b0b08ced371d12d3
Fix "audit" set in CVE_PRODUCT to "linux:audit" to detect only vulnerabilities where the vendor is "linux".
Currently, CVE_PRODUCT also detects vulnerabilities where the vendor is "visionsoft",
which are unrelated to the "audit" in this recipe.
https://www.opencve.io/cve?vendor=visionsoft&product=audit
In addition, all the vulnerabilities currently detected in "audit" have the vendor of "visionsoft" or "linux".
Therefore, fix "audit" set in CVE_PRODUCT to "linux:audit".
Signed-off-by: Shinji Matsunaga <shin.matsunaga@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e87e51da49fe121be8f6dd4cec3263a345f2f876)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
audit: upgrade 4.0.1 -> 4.0.22025-11-17T04:45:06+00:00Yi Zhaoyi.zhao@windriver.com2025-11-13T06:18:54+00:00urn:sha1:4fc68d0837c80df3e140966db7bb44680fc69688
ChangeLog:
- Fix musl C builds
- Many code cleanups
- Use atomic variables if available for signal related flags
- Dont rotate audit logs when auditd is in debug mode
- Fix a couple memory leaks on error paths
- Correct output when displaying rules with exe/path/dir
- Fix auparse lookup test to not use the system libaupaurse
- Improve auparse metrics
- Update auparse normalizer for recent syscalls
- Make status report uniform
Drop 0001-Replace-__attribute_malloc__-with-__attribute__-__ma.patch as
the issue has been fixed upstream.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f7e691ff430f05ee958f6d50b5a23e0f74b8588b)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
kernel-hardening-checker: backport recipe2025-09-12T00:15:13+00:00Michael Opdenackermichael.opdenacker@rootcommit.com2025-08-19T20:39:46+00:00urn:sha1:2222925e923f8b151f62a7a5fb343be52aab0b15
This recipe is a Scarthgap backport of kernel-hardening-checker_0.6.10.2.bb
in the master branch as of August 19, 2025.
Tested on qemux86-64 and on beaglebone-yocto
Signed-off-by: Michael Opdenacker <michael.opdenacker@rootcommit.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
softhsm: correct the SRC_URI2025-08-02T17:13:21+00:00Guocai Heguocai.he.cn@windriver.com2025-07-17T00:50:43+00:00urn:sha1:ec1f3712f2e8b725df52a90a65567d57bda7ba9d
The old SRC_URI is not available.
Signed-off-by: Guocai He <guocai.he.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Use PYTHON_SITEPACKAGES_DIR instead of hard-coded site-packages directory path2024-04-21T17:52:39+00:00alperakalperyasinak1@gmail.com2024-04-15T18:19:59+00:00urn:sha1:050286a953034e4b3bd607dae641b0aa7ff765c3
The following paths have been replaced with PYTHON_SITEPACKAGES_DIR:
- "${libdir}/${PYTHON_DIR}/site-packages"
- "${libdir}/python${PYTHON_BASEVERSION}/site-packages"
- "${libdir}/python*/site-packages"
- "${libdir}/python3.*/site-packages"
Signed-off-by: alperak <alperyasinak1@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
audit: upgrade 4.0 -> 4.0.12024-03-22T16:05:47+00:00Yi Zhaoyi.zhao@windriver.com2024-03-22T09:30:44+00:00urn:sha1:831041c60ada1bc995f7fc6ef3b0391ce3ac5124
ChangeLog:
https://github.com/linux-audit/audit-userspace/releases/tag/v4.0.1
Update TRUSTED_APP interpretation to look for known fields;
In auditd plugins, allow variable amount of arguments;
Fix augenrules to work correctly when kernel is in immutable mode;
Add audisp-filter plugin;
Improve sorting speed of aureport --summary reports;
Auditd & audit-rules.service pick up paths automatically.
* Drop backport patch.
* Specify runstatedir.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
keyutils: Add missing rdep for ptests2024-03-02T00:37:55+00:00Khem Rajraj.khem@gmail.com2024-03-01T07:51:00+00:00urn:sha1:14e3fc26481e3447157610d5dab1032b30a825f8
Signed-off-by: Khem Raj <raj.khem@gmail.com>