linux/meta-secure-core.git/meta-integrity, branch sumo

base-files: only apply the bbappend if ima distro flag set

2018-12-08T01:42:55+00:00

When the meta-integrity layer is included but feature ima is not set, we would get the following error when the system startup: qemux86-64 systemd-remount-fs[81]: mount: /sys/kernel/security: mount point does not exist. qemux86-64 systemd-remount-fs[81]: /bin/mount for /sys/kernel/security exited with exit status 32. Rename base-files_%.bbappend to base-files-integrity.inc and add a new bbappend. Make sure this piece of code should be applied only if the ima feature is set. Signed-off-by: Yi Zhao

Maintain the stable branch sumo

2018-09-21T06:26:49+00:00

The following commits are reverted by the way: - meta-integrity: rpm: Add back in required patches for rocko (5fa9c85) - meta-intel-sgx: Initial support of linux-sgx-driver (7d4f711) The former is applicable to rocko only, and the latter is still experimental. Signed-off-by: Jia Zhang

meta-integrity: rpm: Add back in required patches for rocko

2018-07-31T14:48:35+00:00

In 59a9f43b899c ("meta-integrity: Drop RPM patches that are upstream now") we removed patches to RPM that were not required with a move up to 4.14.0 as they are upstream. However, rocko ships with an older version of RPM and still needs these patches. Add conditional logic to apply these patches only for rocko. Signed-off-by: Tom Rini

layer.conf: Mark as compatible with rocko

2018-07-25T12:41:35+00:00

As we also work with the 'rocko' release list that in our LAYERSERIES_COMPAT. Signed-off-by: Tom Rini

util-linux: allow -static linking for switch_root.static

2018-07-06T06:50:47+00:00

Specify -no-pie to override possible -pie default. Signed-off-by: Joe Slater Signed-off-by: Yi Zhao

sign_rpm_ext.bbclass: fix check_rpm_public_key racing at recipe parsing time

2018-05-31T03:26:13+00:00

All recipe will be parsed which caused lockfile of check_rpm_public_key racing issue. ... |WARNING: meta-secure-core/meta/recipes-core/images/secure-core-image-initramfs.bb: oe-core/bitbake/lib/bb/utils.py:400: ResourceWarning: unclosed file <_io.TextIOWrapper name='tmp-glibc/check_rpm_public_key.lock' mode='a+' encoding='UTF-8'> ... Refer do_package_write_rpm, add check_rpm_public_key to prefunc of do_rootfs, only the running image recipe will invoke check_rpm_public_key. Signed-off-by: Hongxu Jia

layer.conf: add LAYERSERIES_COMPAT

2018-05-26T00:08:58+00:00

see https://patchwork.openembedded.org/patch/140542/ Signed-off-by: Trevor Woerner

sign_rpm_ext.bbclass: check rpm public key at image recipe parsing time

2018-05-23T11:32:55+00:00

While multiple builds share a common sstate, the latter build failed to build image which the public key not found. ... |ERROR: initramfs-ostree-image-1.0-r0 do_rootfs: Importing GPG key failed. Command 'rpmkeys --root=/rootfs --import /rpm-key' returned 1: ... The latter build will not regenerate rpm packages and check_rpm_public_key will not be invoked. Explicitly invoke check_rpm_public_key at image recipe parsing time, which make sure gpg public key be imported. Signed-off-by: Hongxu Jia

meta-integrity, meta-signing-key: Populate the secondary keyring

2018-05-17T12:36:23+00:00

Currently we provide a secondary trusted key that is signed by the primary key. We do not however DER encode this certificate. Update the key-store recipe to also make a DER encoding of this certificate and include it in the same package as the PEM version of the certificate. In the IMA init script, if we have any secondary certificate in a DER encoding, load them into the secondary keyring before we try and load the IMA keys. Signed-off-by: Tom Rini

meta-integrity: init.ima: Switch to using keyctl

2018-05-17T12:36:23+00:00

Rather than parse /proc/keys directly to find out the ID of the keyring that we're using, let keyctl do this for us. In order to do that we need to have /proc available as /proc, so move it around before and after working with keyctl. Signed-off-by: Tom Rini