summaryrefslogtreecommitdiffstats
path: root/meta-oe/recipes-security
Commit message (Collapse)AuthorAgeFilesLines
* nmap: upgrade 7.95 -> 7.99Khem Raj2026-06-151-62/+0
| | | | Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* nmap: upgrade 7.92 -> 7.99Khem Raj2026-06-151-11/+11
| | | | Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* spectre-meltdown-checker: upgrade 26.33.0420460 -> 26.36.0602723Wang Mingyu2026-06-091-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* ssh-audit: Add 3.3.0 of ssh configuration auditing toolJörg Sommer2026-06-071-0/+11
| | | | | Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* spectre-meltdown-checker: upgrade 26.26.0404682 -> 26.33.0420460Wang Mingyu2026-05-121-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* bubblewrap: upgrade 0.11.1 -> 0.11.2Wang Mingyu2026-05-071-1/+1
| | | | | | | | | | | Changelog: =========== - bug fix: CVE-2026-41163 - enhancement : New build option -Dsupport_setuid, which if set to false (which is the default) disables the support for setuid. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* keyutils: Fix build with lld linkerKhem Raj2026-04-131-0/+2
| | | | Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* audit: fix build with autoconf-2.73Martin Jansa2026-04-102-0/+197
| | | | | | | | On hosts with gcc-13 it was trying to use -std=gnu23 and failing with unrecognized command-line option (gnu23 needs gcc-14 and newer) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* spectre-meltdown-checker: upgrade 0.46 -> 26.26.0404682Wang Mingyu2026-04-101-4/+2
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* spdm-emu: use SkipRecipe instead of fatal error for unsupported architecturesPeter Marko2026-04-101-1/+1
| | | | | | | | | | Current code fails to parse meta-oe layer for machine with unsupported architecture. This is too restrictive as it requires downstream layers to play tricks with masking the recipe. Usual way is to skip the recipe instead. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* audit: upgrade 4.1.3 -> 4.1.4Wang Mingyu2026-04-012-6/+6
| | | | | | | | | | | | | | | | | | | | | 0001-Fixed-swig-host-contamination-issue.patch refreshed for 4.1.4 Changelog: =========== - Update syscalls and io_uring tables for the 7.0 kernel - Code cleanups - Avoid blocking auditd while handling disk space alerts - Tighten auditctl permission checks and rule deletion handling - Fix ausearch and auparse parsing for several newer record types - Prevent queue resize races in audisp and oversize records in af_unix - Fix memory safety issues in auparse and the audisp filter plugin - Improve reliability of audisp-remote, auplugin, and the ids plugin - Fix stats collection and parsing in the audisp-statsd plugin - Refresh ausearch and aureport man pages Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* nmap: make python3 RDEPENDS conditional on ndiffPaolo Barbolini2026-03-302-10/+2
| | | | | | | | | | | | | | When ndiff was disabled by default in 51e070301e ("nmap: disable ndiff"), the python3 RDEPENDS were left unconditional on the main package. This causes python3-difflib, python3-asyncio and python3-xml to be pulled into every image that includes nmap, even though ndiff is not built and the core nmap binary (C++) does not need Python. Gate the RDEPENDS behind the ndiff PACKAGECONFIG so that Python is only required when ndiff is actually enabled. Signed-off-by: Paolo Barbolini <paolo.barbolini@m4ss.net> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* bubblewrap: upgrade 0.11.0 -> 0.11.1Wang Mingyu2026-03-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Bug fixes: ========= * Reset disposition of 'SIGCHLD', restoring normal subprocess management if bwrap was run from a process that was ignoring that signal, such as Erlang or volumeicon * Don't ignore '--userns 0', '--userns2 0' or '--pidns 0' if used Note that using a fd number >= 3 for these purposes is still preferred, to avoid confusion with the stdin, stdout, stderr that will be inherited by the command inside the container. * Fix grammar in an error message * Fix a broken link in the documentation Internal changes: ================== * Enable user namespaces in Github Actions configuration, fixing a CI regression with newer Ubuntu * Clarify comments Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* libspdm & spdm-emu: update arch mapKai Kang2026-03-241-0/+1
| | | | | | | | | | | | | | It fails to run `bitbake -p` for qemuppc64 with errors: ERROR: /path_to/meta-oe/recipes-security/spdm-emu/spdm-emu_git.bb: unsupported architecture 'powerpc64le' ERROR: /path_to/meta-oe/recipes-support/libspdm/libspdm_3.8.2.bb: unsupported architecture 'powerpc64le' Add qemuppc64 default TARGET_ARCH to the arch map. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
* spectre-meltdown-checker: Update 0.46 -> gitJörg Sommer2026-03-201-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The git repo gained some bugfixes, esp. for arm32. But there was no release since mid 2023. So, use the git repo. a20641f fix: handle non-numeric ARM CPU architecture values d550ea8 fix: harmless 'dmesg: write error' that could happen on some systems 8e33a1d fix: set cpu_* vars to a default value 68b4617 update: fwdb from v345+i20251110+4df2 to v347+i20251110+615b, 2 microcode changes 9fed5ce update: fwdb from v344+i20250811+1523 to v345+i20251110+4df2, 45 microcode changes 72bce72 chore: really fix autoupdate workflow to avoid useless PRs 5f18e67 chore: fix autoupdate workflow a8466b7 fix CVE-2017-5715 reporting when IBRS_FW is enabled b99be23 update: fwdb from v296+i20240514+988c to v344+i20250811+1523, 128 microcode changes ee4cfd0 chore: add autoupdate workflow for fwdb c2c60e0 chore: fix recent shellcheck warnings bae43d8 Replace head -1 by head -n1 34c6095 fix: Linux 6.9+ changed some config options names (#490) e806e4b chore: docker compose v2 388d44e Fix Retpoline detection for Linux 6.9+ (issue #490) bd0c7c9 fix: typo introduced by #483, fixes #486 d70e4c2 fwdb: update to v296+i20240514+988c 4e29fb5 fix: ucode_platformid_mask is hexa (fixes #485) 0f2edb1 feat: blacklist some more microcodes (fixes #475) 8ac2539 fix: microcode check now supports pf_mask (fixes #482) 97f4d5f feat(reptar): add detection and mitigation of Reptar 9b7b09a fix(inception): continued mitigation detection c94811e fix(inception): Zen1/2 results based on kernel mitigations 3e67047 feat(inception): README ecee757 feat(inception): kernel checks + sbpb support detection fb6933d feat(inception): Zen1/2 IBPB and SMT checks dc6921a feat(inception): handle sysfs interface 3167762 feat(inception): start supporting AMD inception 44223c5 fix: bsd: kernel version detection dbe208f enh: downfall: detect kernel mitigation without sysfs aca4e2a enh: move root warning to the bottom c1c1ac4 feat(downfall): detection of the kernel mitigation relying on dmesg ba0daa6 feat: downfall: add kernel soft mitigation support check 227c0aa feat(downfall): add downfall checks 8ba3751 fwdb: update to latest Intel ucode versions d013c0a doc: add kernel src as additional ucode version source cbe8ba1 fix: inteldb: cpuid 0x00090660 and 0x000A0680 9c2587b enh: when CPUID can't be read, built it by ourselves 2a5ddc8 feat: add Intel known affected processors DB 2ef6c1c enh: factorize file download func 3c22401 chore: update disclaimer and FAQ Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* passwdqc: upgrade 2.0.3 -> 2.1.0Wang Mingyu2026-03-171-1/+1
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* spdm-emu: add recipe for SPDM emulatorJino Abraham2026-03-171-0/+75
| | | | | | | | | | | SPDM emulator implementation based on libspdm. It provides requester and responder tools used for testing SPDM protocol communication. Upstream: https://github.com/DMTF/spdm-emu Signed-off-by: Jino Abraham <jinoabraham26@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 4.1.2 -> 4.1.3Yi Zhao2026-03-032-40/+1
| | | | | | | | ChangeLog: https://github.com/linux-audit/audit-userspace/releases/tag/v4.1.3 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* softhsm: upgrade 2.6.1 -> 2.7.0Wang Mingyu2026-01-302-42/+1
| | | | | | | | 0001-avoid-unnecessary-check-for-sqlite3-binary.patch removed since it's included in 2.7.0 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* bubblewrap: upgrade 0.10.0 -> 0.11.0Gyorgy Sarvari2025-12-282-639/+4
| | | | | | | | | | | | | One big change that comes with this update is the build system change: the project removed autotools and now uses meson. Dropped 0001-Use-stdbool.h-for-booleans.patch because it is included in this release. Changelog: https://github.com/containers/bubblewrap/releases/tag/v0.11.0 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* tomoyo-utils: upgrade 2.6.1-20210910 -> 2.6.1-20250707Gyorgy Sarvari2025-12-281-2/+4
| | | | | | | | | | | | | Also update the SRC_URI, the previous one became inaccessible. Changelog: - Update project's website. - /usr/lib/tomoyo/init_policy Remove rewrite rules handled by commit bdc35f164b0f ("tomoyo: use better patterns for procfs in learning mode"). Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* softhsm: fix SRC_URI branchGyorgy Sarvari2025-12-261-1/+1
| | | | | | | | The "develop" branch doesn't exist anymore, the used revision can be found on the "main" branch. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* kernel-hardening-checker: upgrade 0.6.10.2 -> 0.6.17.1Wang Mingyu2025-11-111-2/+2
| | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* gensio,audit,syslog-ng: Disable and remove tcp-wrappers supportKhem Raj2025-11-111-2/+1
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 4.0.5 -> 4.1.2Yi Zhao2025-09-062-1/+40
| | | | | | | | | | | | | ChangeLog: https://github.com/linux-audit/audit-userspace/releases/tag/v4.1.0 https://github.com/linux-audit/audit-userspace/releases/tag/v4.1.1 https://github.com/linux-audit/audit-userspace/releases/tag/v4.1.2 Disable some test cases in auparse/test as they can not be built with --disable-static configuration. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* softhsm: switch source to GitHub repositoryJiaying Song2025-08-261-2/+2
| | | | | | | | The original source URL is unavailable, so it has been replaced with the official GitHub repository. Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* passwdqc: correct the SRC_URIJiaying Song2025-08-251-1/+1
| | | | | Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* kernel-hardening-checker: upgrade to 0.6.10.2Michael Opdenacker2025-08-181-3/+4
| | | | | | | | | | | | | Major upstream changes (not a minor release update in terms of features): - RISCV support - New "-a" option: autodetect and check the security hardening options of the running kernel You can now just run "kernel-hardening-checker -a" - Require Python 3.9 - Replace setup.py by pyproject.toml - Many fixes and new features Signed-off-by: Michael Opdenacker <michael.opdenacker@rootcommit.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* usbguard: upgrade 1.1.3 -> 1.1.4Wang Mingyu2025-07-302-93/+3
| | | | | | | | 0001-Adapt-for-protobuf-30.0-API-changes.patch removed since it's included in 1.1.4 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* meta-openembedded/all: adapt to UNPACKDIR changesAlexander Kanavin2025-06-255-5/+1
| | | | | | | | | | | | | Please see https://git.yoctoproject.org/poky/commit/?id=4dd321f8b83afecd962393101b2a6861275b5265 for what changes are needed, and sed commands that can be used to make them en masse. I've verified that bitbake -c patch world works with these, but did not run a world build; the majority of recipes shouldn't need further fixups, but if there are some that still fall out, they can be fixed in followups. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 4.0.4 -> 4.0.5Wang Mingyu2025-06-092-9/+6
| | | | | | | | | | | | | | | | | | 0001-Fixed-swig-host-contamination-issue.patch refreshed for 4.0.5 Changelog: ============ - Rework audisp queue to be lockless - Fix missing delete command in auditctl - Allow plus addresses (rfc5233) to auditd email. - Reduce memory churn in auditd event dispatching - Add configurable recurring state report in auditd - Switch audisp-statsd to stop sending signals - Add glibc memory stats to audisp-statsd Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 4.0.3 -> 4.0.4Yi Zhao2025-06-021-1/+1
| | | | | | | | | | | | | | | | | | ChangeLog: - auditctl: update io_uring operations table - update syscall table for 6.15 - auditd.cron.5: Describe time-based log rotation setup - auditd: Broadcast a warning on startup if a system halt is possible - Fix audisp-remote segfault on connection error - Improve locating last event if ausearch is using checkpointing - af_unix plugin: fix string mode support - Remove const from audit_rule_fieldpair_data & audit_rule_interfield_comp_data - Add various updates to the experimental ids plugin - Add glibc memory statistics to auditd state report Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* kernel-hardening-checker: Set recipe as machine specificChris Paterson2025-05-221-0/+2
| | | | | | | | | | | | | | | | | | This fixes an issue where running the test_machine_signatures yocto-layer-check tst case fails when using a BSP layer that depends on meta-oe. e.g. bitbake-diffsigs -t kernel-hardening-checker do_create_package_spdx -s 6397093de4edf0eb568d56526704b178944f788bf0d0bdc8f6ce1b181ee00baa 8adadf9e2c0461de5c377b9a0590f6c05b03ff8c1b8eb89fff94e5c3235a0c9a Hash for task dependency linux-cip:do_create_spdx changed from 4db4e1b424d7969ba80c8e03450ec70e88bab266b1e43054381ab1c572cf580a to bfebcc3195aa0106630e2d3cf7fc8335df8768ad059143d54f715b399eea8b69 Hash for task dependency linux-cip:do_collect_spdx_deps changed from ae22171bab2f456b4743fb0ca05de91a16b65fe6bbddd4cb97d2ed04e5d4f651 to e43ed3f2cee8198d91535ce38057d996cdb8e72c10d7509c2542e6676782ebdc Hash for task dependency linux-cip:do_unpack changed from 6cf2e7fd1e1d67578f6bed761378953f91a8a58df0107698cc259c1989674da1 to 5d98fa31606f06f0e4416f9df82f97fdc6f63799b65486912dc4a3fc7f871f3c basehash changed from 556fad4e4426a9390de6ccdcc631aeb35d391ccc9676f6a4810237e2f501cf85 to 72beced62420cc92f276f8a31cd4de3d6f9e3877b14fff9d82ff7d863855b7da Variable MACHINE value changed from 'hihope-rzg2h' to 'hihope-rzg2m' Link: https://lists.openembedded.org/g/openembedded-devel/topic/issue_meta_oe_walnascar/113168928 Signed-off-by: Chris Paterson <chris.paterson2@renesas.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* spectre-meltdown-checker: Set recipe as machine specificChris Paterson2025-05-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | This fixes an issue where running the test_machine_signatures yocto-layer-check tst case fails when using a BSP layer that depends on meta-oe. e.g. bitbake-diffsigs -t spectre-meltdown-checker do_package_write_rpm -s 3efb5226ab4e83ef90cf33f0a474314d345c675707b3476dde1d3c42f79cc3d0 e268e68c02265542bf80fd51f8c4f26f63b668746639826fbdb870d91e2ba2fd Hash for task dependency linux-cip:do_packagedata changed from 7feeecd5cbda152da452be41a8b0babe91e48f3097c4e5bb33f6dc426dd203e3 to f466574a3f8a32b23393fe4154b4fb6d172bb75d82ea5424405386d00c30b57d Hash for task dependency linux-cip:do_package changed from 2281027d1d4da253d371c2c0aebb829aa262b9b2a563247a3bd95621621abdb6 to a8d245eb965ab2f20b4a9d620e5c3af1e4437a5e08665b05f5c52706454642eb Hash for task dependency linux-cip:do_install changed from 75e91702bbcdd891ada3b08d884f6842fa94c01dcb52917dc0d0e85239799569 to 2cb117e47f68e5e1ba21b19934e1be2a14501d9ec72e0565f409dbbdd024ff24 Hash for task dependency linux-cip:do_compile changed from 015e60756358bf4b46b1c2570d70c334285b38c54d8c515c1fd301044a73e123 to ce97c36a37c0438254ad429e9c53a7520abade5e513180bc52850b683de4df5c Hash for task dependency linux-cip:do_configure changed from 188050940f59e4ec4a20bea82f6a9b8261126e716fec07bacbeadbb9f5989882 to 111fa8c18085e992ce52a0bb1ee53276e36720092288dead4f70cf3a64f8fb05 Hash for task dependency linux-cip:do_deploy_source_date_epoch changed from 5e39db86fcde43fb0d0afd08e2d22c4c2e6b2fbf1e2e9017f1cc6f541c6798b0 to f621317487884d32348672899270c7841f7d4739140e35eb09d2378fccd90213 Hash for task dependency linux-cip:do_patch changed from a8da5639ab6a39a57122a59758aad964d199a10ce0ae5a3e36f17e6830ee3f97 to 77fbb8bbb5e3c0141b731b3afc001370f28ba796f09b6361de04c93ec2f165b9 Hash for task dependency linux-cip:do_kernel_metadata changed from 0099cc1d4d35547ff1e4b1d448934304c1708ecfc42abaf38de23abdaf986310 to 08b1d5c2fe80e6a074b8ac8a27370caf0f8713eae85ca0d861140d28e443c59c Hash for task dependency linux-cip:do_kernel_checkout changed from aa1bb0aeef7b4aa5ec2d01d3a99d7addd3a262b496962c9bfea9345bbccfac1e to ffb0021b913cdad6ab0bdd7e7a51c49c4afbc24087d4b410aa097faa73bf2e8b Hash for task dependency linux-cip:do_symlink_kernsrc changed from 14695f6b8d892af536305c58a130d67fdca751a0dabeba2edf708787d067c8ba to 9d9d7511d5feed853c5e450dd93994e0f0b263c9e6d5d389e8c85471696e5df2 Hash for task dependency linux-cip:do_unpack changed from 6cf2e7fd1e1d67578f6bed761378953f91a8a58df0107698cc259c1989674da1 to 5d98fa31606f06f0e4416f9df82f97fdc6f63799b65486912dc4a3fc7f871f3c basehash changed from 556fad4e4426a9390de6ccdcc631aeb35d391ccc9676f6a4810237e2f501cf85 to 72beced62420cc92f276f8a31cd4de3d6f9e3877b14fff9d82ff7d863855b7da Variable MACHINE value changed from 'hihope-rzg2h' to 'hihope-rzg2m' Link: https://lists.openembedded.org/g/openembedded-devel/topic/issue_meta_oe_walnascar/113168928 Signed-off-by: Chris Paterson <chris.paterson2@renesas.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: add recipe for 7.92Yi Zhao2025-05-057-0/+392
| | | | | | | | | | | | | | | | | | | | | | | | The nmap has changed its license to NPSL (Nmap Public Source License) since 7.90[1][2]. See [3] for a discussion of this license. According to [1] and [4], 7.92 is the last dual-licensed (GPL-2.0 and NPSL)version: "Note that some releases of Nmap may fall under a previous version of this license, or a different license entirely. The exact terms for a given version of Nmap can be found in the included LICENSE or COPYING file. To ease the transition to the NPSL, the first three Nmap releases made under that license (Nmap 7.90, 7.91, and 7.92) may also be used under the previous Nmap license terms by anyone who prefers those. " Add 7.92 recipe with GPLv2 license. [1] https://nmap.org/npsl/ [2] https://lwn.net/Articles/842436/ [3] https://github.com/nmap/nmap/issues/2199 [4] https://nmap.org/changelog.html#7.92 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: set correct licenseGyorgy Sarvari2025-04-281-1/+1
| | | | | | | | | | | Nmap has switched from GPLv2 to their own "Nmap Public Source License" since a few release. Set it in the recipe accordingly. The NPSL file in the license firectory has been downloaded directly from https://svn.nmap.org/nmap/LICENSE Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: set UPSTREAM_CHECK_REGEXYi Zhao2025-04-121-0/+3
| | | | | | | | | | | | | | | | | Set UPSTREAM_CHECK_REGEX to check the correct latest stable verison. Before the fix: $ devtool latest-version nmap INFO: Current version: 7.95 INFO: Latest version: 7.95-1 After the fix: $ devtool latest-version nmap INFO: Current version: 7.95 INFO: Latest version: 7.95 Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* bubblewrap: fix error with gcc-15mark.yang2025-04-082-1/+637
| | | | | | | | | | | | | | | | | | * backport fix from: https://github.com/containers/bubblewrap/pull/660 But patch rework for this version. In gcc 15, bool became a reserved keyword in C23, causing conflicts with our custom bool definition. See also, https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=55e3bd376b2214e200fa76d12b67ff259b06c212 * to fix: http://errors.yoctoproject.org/Errors/Details/851183/ ../bubblewrap-0.10.0/utils.h:46:13: error: 'bool' cannot be defined via 'typedef' 46 | typedef int bool; | ^~~~ Signed-off-by: mark.yang <mark.yang@lge.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* usbguard: Patch for protobuf 30.0 API changesKhem Raj2025-03-132-1/+92
| | | | Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: remove empty directoryYi Zhao2025-02-241-0/+3
| | | | | | | | | | | | Remove empty directory when enable multilib. Fixes: ERROR: audit-4.0.3-r0 do_package: QA Issue: audit: Files/directories were installed but not shipped in any package: /usr/lib Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: add missing dependencyGyorgy Sarvari2025-02-151-1/+1
| | | | | | | | | | | | | Building with ndiff PACKAGECONFIG failed with the following error: | File "/yocto/sandbox/build/tmp/work/cortexa53-poky-linux/nmap/7.95/nmap-7.95/ndiff/setup.py", line 11, in <module> | import setuptools.command.install | ModuleNotFoundError: No module named 'setuptools' Fix it by adding the missing dependency. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: fix racing issue at do_compileHongxu Jia2025-02-122-0/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are two build-lua rules, one in Makefile.in, another in ncat/Makefile.in which is required by build-ncat Build them may cause potential racing $ bitbake lib32-nmap $ grep -e "Compiling liblua" -e 'nmap-7.95/liblua' -e ": error" -n patch-to/temp/log.do_compile Compiling liblua make[1]: Entering directory 'path-to/build/tmp/work/corei7-32-wrsmllib32-linux/lib32-nmap/7.95/nmap-7.95/liblua' Compiling liblua make[2]: Entering directory 'path-to/build/tmp/work/corei7-32-wrsmllib32-linux/lib32-nmap/7.95/nmap-7.95/liblua' make[2]: Leaving directory 'path-to/tmp/work/corei7-32-wrsmllib32-linux/lib32-nmap/7.95/nmap-7.95/liblua' path-to/tmp/work/corei7-32-wrsmllib32-linux/lib32-nmap/7.95/recipe-sysroot-native/usr/bin/i686-wrsmllib32-linux/../../libexec/i686-wrsmllib32-linux/gcc/i686-wrsmllib32-linux/14.2.0/ld: ./../liblua/liblua.a: error adding symbols: no more archived files collect2: error: ld returned 1 exit status make[1]: Leaving directory 'path-to/tmp/work/corei7-32-wrsmllib32-linux/lib32-nmap/7.95/nmap-7.95/liblua' Explicitly make build-ncat depends on build-lua to avoid racing, after applying the patch ... Compiling liblua make[1]: Entering directory 'path-to/tmp/work/corei7-32-wrsmllib32-linux/lib32-nmap/7.95/nmap-7.95/liblua' make[1]: Leaving directory 'path-to/tmp/work/corei7-32-wrsmllib32-linux/lib32-nmap/7.95/nmap-7.95/liblua' Compiling liblua make[2]: Entering directory 'path-to/tmp/work/corei7-32-wrsmllib32-linux/lib32-nmap/7.95/nmap-7.95/liblua' make[2]: Leaving directory 'path-to/tmp/work/corei7-32-wrsmllib32-linux/lib32-nmap/7.95/nmap-7.95/liblua' ... Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* spectre-meltdown-checker: fix script nameMartin Jansa2025-02-061-1/+1
| | | | | | | | multilib builds fail with: install: cannot stat 'lib32-spectre-meltdown-checker/0.46/sources-unpack/git/lib32-spectre-meltdown-checker.sh': No such file or directory Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: upgrade 4.0.2 -> 4.0.3Yi Zhao2025-01-262-12/+7
| | | | | | | | | | | | | | | | | | | | | | | ChangeLog: - Remove a RHEL4 flag table since it's been unsupported for a while - Change dependency from Requires to Wants for audit-rules.service - Disable ProtectKernelModules by default in auditd.service - Skip plugin configs that do not have .conf suffix - audisp-filter: iterate records correctly when forwarding - Update syscall table for missing syscalls - Modify ausearch checkpoint code to address 64 inode and device numbers - Fix potential segfault interpreting relative paths - Add audit_set_enabled & audit_is_enabled back to the libaudit python bindings - Log runlevel changes to console during boot - Add audit-tmpfiles.conf to ensure /var/log/audit exists - Propagate event format to the audisp-af_unix plugin - Add support for RISC-V - riscv32, riscv64 * Enable riscv support * Use its own volatile file for systemd. Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* spectre-meltdown-checker: New recipe to check hardware vulnerabilityJörg Sommer2025-01-131-0/+35
| | | | | Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* kernel-hardening-checker: New recipe to check security optionsJörg Sommer2025-01-061-0/+33
| | | | | Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* nmap: Fix off-by-one overflow in the IP protocol table.Wang Mingyu2024-10-142-0/+166
| | | | | | | Add patch to fix core dumped error when using "nmap -sO" Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: fix build when systemd is enabled.Armin Kuster2024-10-131-0/+6
| | | | | Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* softhsm: add destroyed global access prevention patchRouven Czerwinski2024-09-272-0/+673
| | | | | | | | | | | | | | Currently softhsm will try to access deleted obejcts due to the order of atexit handler implementations. Add a patch which adds a global variable to track whether objects are deleted and prevents access if this is the case. This fixes a failure with the signing.bbclass where when signing multiple fitimage configurations the second signing operation will lead to a segfault. Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de> Signed-off-by: Khem Raj <raj.khem@gmail.com>
* audit: Fix CVE_PRODUCTShinji Matsunaga2024-09-241-0/+2
| | | | | | | | | | | | | | Fix "audit" set in CVE_PRODUCT to "linux:audit" to detect only vulnerabilities where the vendor is "linux". Currently, CVE_PRODUCT also detects vulnerabilities where the vendor is "visionsoft", which are unrelated to the "audit" in this recipe. https://www.opencve.io/cve?vendor=visionsoft&product=audit In addition, all the vulnerabilities currently detected in "audit" have the vendor of "visionsoft" or "linux". Therefore, fix "audit" set in CVE_PRODUCT to "linux:audit". Signed-off-by: Shinji Matsunaga <shin.matsunaga@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-08-14 23:19:08 +0000