linux/meta-security.git, branch dunfell

sssd: CVE-2022-4254 libsss_certmap fails to sanitise certificate data used in LDAP filters

2023-03-23T10:28:09+00:00

Upstream-Status: Backport from https://github.com/SSSD/sssd/commit/1c40208aa1e0f9a17cc4f336c99bcaa6977592d3 & https://github.com/SSSD/sssd/commit/a2b9a84460429181f2a4fa7e2bb5ab49fd561274 Signed-off-by: Hitendra Prajapati Signed-off-by: Armin Kuster

chkrootkit: update SRC_URI

2022-04-17T23:49:37+00:00

0.53 no longer hosted from main source. Use Ubuntu archive Signed-off-by: Armin Kuster

clamav: drop creating cvd package

2022-04-16T15:26:50+00:00

Signed-off-by: Armin Kuster

clamav: disable DB creation.

2022-03-27T16:42:52+00:00

The DB is no longer available, so disable it. remove from pkg group Signed-off-by: Armin Kuster

tpm2-tools: update to 4.1.3

2022-03-20T21:51:06+00:00

Minor version bump from 4.1.1 to 4.1.3, containing two fixes: 4.1.3 - 2020-06-02 * tpm2_create: Fix issue with userauth attribute being cleared if policy is specified. 4.1.2 - 2020-05-18 * Fix missing handle maps for ESY3 handle breaks. See #1994. https://github.com/tpm2-software/tpm2-tools/pull/1994 Details of changes https://github.com/tpm2-software/tpm2-tools/commits/4.1.X Signed-off-by: Ralph Siemsen Signed-off-by: Armin Kuster

tpm2-tools: backport fix for CVE-2021-3565

2022-03-20T21:50:58+00:00

tpm2_import used a fixed AES key for the inner wrapper, which means that a MITM attack would be able to unwrap the imported key. Even the use of an encrypted session will not prevent this. The TPM only encrypts the first parameter which is the fixed symmetric key. To fix this, ensure the key size is 16 bytes or bigger and use OpenSSL to generate a secure random AES key. Upstream commit (with offset adjusted) https://github.com/tpm2-software/tpm2-tools/commit/c069e4f179d5e6653a84fb236816c375dca82515 Signed-off-by: Ralph Siemsen Signed-off-by: Armin Kuster

sssd: re-package to fix QA issues

2021-11-18T22:56:36+00:00

It packages all file in ${libdir} to package sssd, including the .so symlink files. Then it causes QA issues: | ERROR: QA Issue: sssd rdepends on dbus-dev [dev-deps] | ERROR: QA Issue: sssd rdepends on ding-libs-dev [dev-deps] So re-package sssd then the .so symlink files and .pc files are packaged to sssd-dev which should be. File ${libdir}/libsss_sudo.so is not a symlink file but packaged to sssd-dev too. Then causes another QA issue: | ERROR: sssd-2.5.2-r0 do_package_qa: QA Issue: -dev package sssd-dev contains non-symlink .so '/usr/lib/libsss_sudo.so' [dev-elf] So create a new sub-package libsss-sudo to package file libsss_sudo.so and make sssd rdepends on it. JP: Update for version differences. Signed-off-by: Kai Kang Signed-off-by: Armin Kuster (cherry picked from commit e81c15f851ca5396c78c8737967ee38db0ebe0cd) Signed-off-by: Jeremy A. Puhlman Signed-off-by: Armin Kuster

linux-%_5.%.bbappend: drop recipe

2021-09-10T01:48:36+00:00

Signed-off-by: Armin Kuster (cherry picked from commit 833ae34c8f3222358f65e8ee3fdbac565485694e)

tpm-tools: fix build issue

2021-07-10T12:25:40+00:00

This error occurs randomly. /bin/bash: pod2man: command not found [Yocto #14304] minor space/tab cleanup Signed-off-by: Armin Kuster Cc: Ben

initramfs-framework-ima: introduce IMA_FORCE

2021-04-27T14:16:53+00:00

Introduce IMA_FORCE to allow the IMA policy be applied forcely even 'no_ima' boot parameter is available. This ensures the end users have a way to disable 'no_ima' support if they want to, because it may expose a security risk if an attacker can find a way to change kernel arguments, it will easily bypass rootfs authenticity checks. Signed-off-by: Sergio Prado Signed-off-by: Ming Liu Signed-off-by: Armin Kuster