linux/meta-security.git, branch honister

kas/kas-security-base.yml: update to honister

2021-11-05T23:39:18+00:00

Signed-off-by: Armin Kuster

recipes: Update SRC_URI branch and protocols

2021-11-04T15:20:25+00:00

This patch updates SRC_URIs using git to include branch=master if no branch is set and also to use protocol=https for github urls as generated by the conversion script in OE-Core. Signed-off-by: Armin Kuster (cherry picked from commit 7e27eb5fca7a22e82251f79103bb12d2b70307fb)

sssd: re-package to fix QA issues

2021-10-19T04:50:22+00:00

It packages all file in ${libdir} to package sssd, including the .so symlink files. Then it causes QA issues: | ERROR: QA Issue: sssd rdepends on dbus-dev [dev-deps] | ERROR: QA Issue: sssd rdepends on ding-libs-dev [dev-deps] So re-package sssd then the .so symlink files and .pc files are packaged to sssd-dev which should be. File ${libdir}/libsss_sudo.so is not a symlink file but packaged to sssd-dev too. Then causes another QA issue: | ERROR: sssd-2.5.2-r0 do_package_qa: QA Issue: -dev package sssd-dev contains non-symlink .so '/usr/lib/libsss_sudo.so' [dev-elf] So create a new sub-package libsss-sudo to package file libsss_sudo.so and make sssd rdepends on it. Signed-off-by: Kai Kang Signed-off-by: Armin Kuster

python3-fail2ban: fix build failure and cleanup

2021-10-19T04:50:22+00:00

Fixes: error in fail2ban setup command: use_2to3 is invalid. ERROR: 'python3 setup.py build ' execution failed. drop custom fail2ban_setup.py remove pyhton-fail2ban as its a symlink to python3 Update to tip for 11.2 branch Signed-off-by: Armin Kuster

recipes-security/chipsec: platform security assessment framework

2021-10-19T04:50:22+00:00

Add chipsec, tools to dump and analyzing hardware, system firmware components, like PCH register, ioport or iomem configuration space. Signed-off-by: Liwei Song Signed-off-by: Armin Kuster

swtpm: update to 0.6.1

2021-10-19T04:50:13+00:00

swtpm no longer depends on Python[1] so the dependencies have been removed. "inherit perlnative" has been added due to (in oe-core): deda455b3c ("bitbake.conf: drop pod2man from hosttools") Some leftover dependencies have also been removed, ex: tpm-tools required in the past by swtpm_setup.sh (<0.4.0)[2]. [1] https://github.com/stefanberger/swtpm/issues/437 [2] https://github.com/stefanberger/swtpm/commit/eee8cb5dfb13f87140dddda38f65bf61aff19508 Signed-off-by: Kristian Klausen Signed-off-by: Armin Kuster

Upgrade parsec-service 0.8.1 and parsec-tool 0.4.0

2021-09-28T23:19:38+00:00

Signed-off-by: Anton Antonov Signed-off-by: Armin Kuster

libtpm: update to 0.8.7

2021-09-28T23:19:27+00:00

Signed-off-by: Kristian Klausen Signed-off-by: Armin Kuster

clamav: Set clamav:clamav ownership on /var/lib/clamav in do_install

2021-09-28T23:18:59+00:00

Also, rearrange the runtime-dependencies a little so clamav-freshclam is installed later than clamav. The issue is that clamav-freshclam ships /var/lib/clamav and the main clamav package uses chown in pkg_postinst to set the ownership of this directory. But pkg_postinst is not marked as "ontarget" so this chown only took effect when upgrading or reinstalling the package. So when clamav is part of an OS image out of the box, freshclamd cannot populate this directory since it's running under the clamav user. Fix this by creating /var/lib/clamav with the proper ownership in do_install and rearrange runtime-dependencies, so clamav-freshclam RDEPENDS on clamav and clamav relaxes its runtime-dependency into RRECOMMENDS so clamav-freshclam is installed later than clamav, avoiding these warnings: Installing : clamav-freshclam-... 487/1954 warning: user clamav does not exist - using root warning: group clamav does not exist - using root Signed-off-by: Zoltán Böszörményi Signed-off-by: Armin Kuster

dmverity: Make use of DATA_BLOCK_SIZE variable in initrdscript.

2021-09-28T23:18:41+00:00

DATA_BLOCK_SIZE variable was set in dm-verity-img.bbclass at build time but the initrdscript was not updated to pass the DATA_BLOCK_SIZE to the veritysetup. Now the functionality is complete. Signed-off-by: Paulo Neves Signed-off-by: Armin Kuster