linux/meta-security.git, branch nanbield

ima,evm: Add two variables to write filenames and signatures into

2023-11-08T12:09:55+00:00

Add two variables IMA_FILE_SIGNATURES_FILE and EVM_FILE_SIGNATURES_FILE for filenames where the ima_evm_sign_rootfs script can write the names of files and their IMA or EVM signatures into. Both variables are optional. The content of the file with IMA signatures may look like this: /usr/bin/gpiodetect ima:0x0302046730eefd... /usr/bin/pwscore ima:0x0302046730eefd004... Having the filenames along with their signatures is useful for signing files in the initrd when the initrd is running out of a tmpfs filesystem that has support for xattrs. This allows to enable an IMA appraisal policy already in the initrd where files must be signed as soon as the policy becomes active. Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

samhain: remove the buildpath

2023-11-08T12:09:51+00:00

Fixes: WARNING: samhain-server-4.4.10-r0 do_package_qa: QA Issue: File /var/lib/samhain/samhain-install.sh in package samhain-server contains reference to TMPDIR [buildpaths] WARNING: samhain-server-4.4.10-r0 do_package_qa: QA Issue: File /usr/share/doc/samhain-server/scripts/samhain.ebuild-light in package samhain-server-doc contains reference to TMPDIR File /usr/share/doc/samhain-server/scripts/samhain.ebuild in package samhain-server-doc contains reference to TMPDIR [buildpaths] Signed-off-by: Mingli Yu Signed-off-by: Armin Kuster

Update parsec recipes

2023-11-03T11:11:49+00:00

Parsec-service and parsec-tool recipes have been updated to use 1.3.0 and 0.7.0 versions respectively. Signed-off-by: Gowtham Suresh Kumar Signed-off-by: Armin Kuster

fail2ban: add useful recommendations

2023-10-08T19:24:38+00:00

On a systemd-based system, one is likely to make use of 'backend=systemd', which requires the systemd module. Both the pyinotify and systemd backends require the distutils module. Signed-off-by: Rasmus Villemoes Signed-off-by: Armin Kuster

fail2ban: change sqlite3 dependency to python3-sqlite3

2023-10-08T19:24:38+00:00

Currently, one gets Unable to import fail2ban database module as sqlite is not available So we need to ensure the sqlite3 python module is available. That will automatically pull in libsqlite3. Since fail2ban does not actually depend on the the CLI which the sqlite3 package provides, drop that dependency. Signed-off-by: Rasmus Villemoes Signed-off-by: Armin Kuster

fail2ban: add systemd support

2023-10-08T19:24:27+00:00

fail2ban ships with a suitable .service file, so install that if systemd is in DISTRO_FEATURES. The logic in rm_sysvinit_initddir in systemd.bbclass will then take care of removing the sysvinit script if sysvinit is not in DISTRO_FEATURES. Signed-off-by: Rasmus Villemoes Signed-off-by: Armin Kuster

scap-security-guide: Drop Poky patch and update to tip

2023-09-25T13:47:15+00:00

The Poky patch has been accepted. Signed-off-by: Armin Kuster

libhoth: Update

2023-09-25T13:45:58+00:00

Changelog: Royce Rajan 0e3eec6 Claim + Release USB connection when running `htool console` b36ebfc bazel: Stamp Git commit as version fd90feb meson: Stamp Git commit as version ba1403d Add get/clear panic record commands (#30) Chris Evans e34e9bd Update README.md for recently-added commands. Daimeng Wang 611381e htool: Implement authz_record read/erase/build/set aaed60f htool: Add authz_record command API ad68019 libhoth: MTD allows zero byte read Pai Peng 101f711 Add the 'statistics' command Signed-off-by: John Broadbent Signed-off-by: Armin Kuster

lynis: Update to 3.0.9

2023-09-25T13:45:46+00:00

Signed-off-by: Armin Kuster

swtpm: update 0.8.1

2023-09-25T13:45:46+00:00

Signed-off-by: Armin Kuster