linux/meta-security.git, branch whinlatter-next

dm-verity-img.bbclass: filter units from value part

2026-01-18T14:48:52+00:00

This is necessary for cryptsetup starting from v2.8.0 which introduced "[units]" in its output breaking the parsing of veritysetup output. VERITY header information for image-poky-20250701085433.squashfs-zst.verity. UUID: 5dc16c55-79b8-4988-9d79-900f8e143f98 Hash type: 1 Data blocks: 40091 Data block size: 4096 [bytes] Hash blocks: 318 Hash block size: 4096 [bytes] Hash algorithm: sha256 Salt: f670bf67a32f4f5a22e052d7bf84830f8d35ea24e2d52f585f6275207899153b Root hash: a7eab55b7933e347650671611e4b2a10571f2a28a1fb0fc8eae409f7a0d86693 This extends the value filter to remove the "[units]" from the .env file, while retaining compatibility to older cryptsetup releases. Signed-off-by: Stephan Wurm Signed-off-by: Scott Murray

suricata: add PACKAGECONFIG[seccomp] - MemoryDenyWriteExecute

2026-01-18T14:48:45+00:00

Add option to prevent memory mappings that are both writable and executable. https://www.freedesktop.org/software/systemd/man/255/systemd.exec.html#MemoryDenyWriteExecute= Core Suricata developer: https://github.com/jasonish/suricata-rpms/blob/a606a810325dd0a4f3ee45b2756b96bda28e590b/7.0/suricata-4.1.1-service.patch#L23 Fedora: https://src.fedoraproject.org/rpms/suricata/c/cfb3b996f54d28018cd01f9c6b9ecb77e59f344d Resolve SELinux AVC denial: type=PROCTITLE proctitle=/usr/bin/suricata -c /etc/suricata/suricata.yaml -i eth0 type=SYSCALL arch=aarch64 syscall=mprotect success=no exit=EACCES(Permission denied) a0=0x7fffa7d04000 a1=0x4000 a2=PROT_READ|PROT_WRITE|PROT_EXEC a3=0x21 items=0 ppid=1 pid=283 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=Suricata-Main exe=/usr/bin/suricata subj=system_u:system_r:initrc_t:s0 key=(null) type=AVC avc: denied { execmem } for pid=283 comm=Suricata-Main scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=process Signed-off-by: Clayton Casciato Signed-off-by: Scott Murray

lynis: upgrade to 3.1.6

2026-01-18T14:48:38+00:00

Release notes: https://github.com/CISOfy/lynis/releases/tag/3.1.6 Signed-off-by: Scott Murray

Update CI configuration for whinlatter

2026-01-07T15:04:56+00:00

Update kas configuration for CI to use whinlatter branch. Signed-off-by: Scott Murray

Update kas configuration

2026-01-07T14:50:08+00:00

Changes to catch up with current kas and future-proof a bit: * Update the kas configuration file versions to 19 to match kas 4.8.x. * Change refspec to branch to remove deprecation warnings. * Add quoting around URLs to match upstream examples. Signed-off-by: Scott Murray

meta-parsec: Remove meta-clang dependency

2026-01-07T14:49:29+00:00

Since clang is in openembedded-core now, meta-parsec no longer needs meta-clang. Also updated maintainers in meta-parsec README.md since it had previously been missed. Signed-off-by: Scott Murray

suricata: update PACKAGECONFIG[jansson] option to required

2025-12-31T20:26:10+00:00

jansson is required as of Suricata 5.0: https://github.com/OISF/suricata/commit/e49c40428e1b9f7e5dcdb5857c3978d5cb859fd9 This is still required in the latest release: https://github.com/OISF/suricata/blob/suricata-8.0.2/configure.ac#L828 On exclusion attempt: [...] | checking for jansson.h... no | checking for json_dump_callback in -ljansson... no | | ERROR: Jansson is now required. | | Go get it from your distribution or from: | http://www.digip.org/jansson/ | | Ubuntu/Debian: apt install libjansson-dev | CentOS: yum install jansson-devel | Fedora: dnf install jansson-devel | | NOTE: The following config.log files may provide further information. | NOTE: [...]/poky-whinlatter/build/tmp/work/cortexa57-poky-linux/suricata/7.0.13/sources/suricata-7.0.13/config.log | ERROR: configure failed | WARNING: exit code 1 from a shell command. ERROR: Task ([...]/poky-whinlatter/layers/meta-security/recipes-ids/suricata/suricata_7.0.13.bb:do_configure) failed with exit code '1' Signed-off-by: Clayton Casciato Signed-off-by: Scott Murray

suricata: drop trailing whitespace

2025-12-31T20:25:06+00:00

Signed-off-by: Clayton Casciato Signed-off-by: Scott Murray

suricata: drop deprecated nss, nspr PACKAGECONFIGs

2025-12-22T04:37:23+00:00

Default add in 3f95047ae1e1d ("suricata: package update to 2.0.8") https://docs.suricata.io/en/suricata-8.0.1/upgrade.html#id7 As of 7.0, "NSS is no longer required. File hashing and JA3 can now be used without the NSS compile time dependency." Removed in 8.0: https://github.com/OISF/suricata/blob/suricata-8.0.1/ChangeLog#L647 Signed-off-by: Clayton Casciato

openscap: switch to libpcre2

2025-12-22T04:35:47+00:00

The openscap added PCRE2 library since 2023 [1] [1] https://github.com/OpenSCAP/openscap/commit/cd1d4289581fa15527e516ddd07be814af7cba55 Signed-off-by: Hongxu Jia