linux/meta-secure-core.git, branch rocko

base-files: only apply the bbappend if ima distro flag set

2018-12-08T01:42:41+00:00

When the meta-integrity layer is included but feature ima is not set, we would get the following error when the system startup: qemux86-64 systemd-remount-fs[81]: mount: /sys/kernel/security: mount point does not exist. qemux86-64 systemd-remount-fs[81]: /bin/mount for /sys/kernel/security exited with exit status 32. Rename base-files_%.bbappend to base-files-integrity.inc and add a new bbappend. Make sure this piece of code should be applied only if the ima feature is set. Signed-off-by: Yi Zhao

kernel-initramfs: only apply the bbappend if efi-secure-boot distro flag set

2018-12-08T01:42:41+00:00

When the meta-efi-secure-boot layer is included but feature efi-secure-boot is not set. We got the following error with kernel-initramfs building: ERROR: kernel-initramfs-1.0-r0 do_deploy: Function failed: do_deploy (log file is located at /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/log.do_deploy.16995) ERROR: Logfile of failure stored in: /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/log.do_deploy.16995 Log data follows: | DEBUG: Executing python function sstate_task_prefunc | DEBUG: Python function sstate_task_prefunc finished | DEBUG: Executing shell function do_deploy | install: cannot stat '/buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/image/boot/*.p7b': No such file or directory | WARNING: /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/run.do_deploy.16995:1 exit 1 from 'install -m 0644 ${SIG} /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/deploy-kernel-initramfs' | ERROR: Function failed: do_deploy (log file is located at /buildarea/build/tmp/work/genericx86_64-poky-linux/kernel-initramfs/1.0-r0/temp/log.do_deploy.16995) ERROR: Task (/buildarea/poky/meta-secure-core/meta/recipes-core/images/kernel-initramfs.bb:do_deploy) failed with exit code '1' Rename kernel-initramfs.bbappend to kernel-initramfs-efi-secure-boot.inc and add a new bbappend. Make sure this piece of code should be applied only if the efi-secure-boot feature is set. Signed-off-by: Yi Zhao

kernel-initramfs: fix inconsistent indentation

2018-12-08T01:42:41+00:00

Use spaces consistently to indent do_install() Signed-off-by: Yi Zhao

meta-efi-secure-boot: Ensure openssl-native exists when we need it

2018-12-08T01:42:41+00:00

In order to deploy our secure boot keys in DER format we need to use openssl. This must be listed in our DEPENDS line in order for the sysroot to be populated correctly when we run do_sign. Also drop the explicit fakeroot on our empty grub-efi do_sign as we may not have globally populated virtual/fakeroot-native at that point in time. Fixes: 92316d4b402b ("meta-signing-key: When deploying keys UEFI keys, deploy DER format") Signed-off-by: Tom Rini

meta-signing-key: When deploying keys UEFI keys, deploy DER format

2018-10-25T15:06:56+00:00

Generally speaking, for firmware to import PK/KEK/DB keys they need to be in the binary "DER" format and typically have the "cer" file extension. When deploying our keys, convert what we have to that format and deploy as well for ease of use. Signed-off-by: Tom Rini

Maintain the stable branch rocko

2018-09-21T07:20:23+00:00

The modifications based on the following commits are made by the way: - seloader: Fix building for rocko (bc6bbe2) - meta-integrity: rpm: Add back in required patches for rocko (5fa9c85) Because the sanity check for rocko now becomes unnecessary. In addition, the meta-intel-sgx is removed because it is still experimental. - meta-intel-sgx: Initial support of linux-sgx-driver (7d4f711) Signed-off-by: Jia Zhang

libsign: Fix build faiure due to -fstack-protector-strong

2018-09-20T14:10:48+00:00

SECURITY_LDFLAGS includes -fstack-protector-strong which cannot work with CCLD. To work around this issue, filter out it from LDFLAGS. Signed-off-by: Jia Zhang

libsign: Update to the latest

2018-09-20T14:10:31+00:00

- Use CCLD to build executable and library. Signed-off-by: Jia Zhang

cryptfs-tpm2: Fix build faiure due to -fstack-protector-strong

2018-09-17T13:31:31+00:00

SECURITY_LDFLAGS includes -fstack-protector-strong which cannot work with CCLD. To work around this issue, filter out it from LDFLAGS. Signed-off-by: Jia Zhang

cryptfs-tpm2: Update to the latest

2018-09-17T13:29:52+00:00

- Follow up the regular way to include header file. - Use CCLD to build executable and library. Signed-off-by: Jia Zhang