Mirror of git.yoctoproject.org/meta-security.git https://git.enea.com/cgit/linux/meta-security.git/atom?h=mickledore 2022-07-05T23:26:50+00:00 2022-07-05T23:26:50+00:00 Jose Quaresma quaresma.jose@gmail.com 2022-06-27T12:02:47+00:00 urn:sha1:c1c80cf0c0f26215fb252242f0d70f8870916734 Starting with [1] kernel modules symbols is being slipped in OE-core and this breaks the kernel modules sign, so disable it. [1] https://git.openembedded.org/openembedded-core/commit/?id=e09a8fa931fe617afc05bd5e00dca5dd3fe386e8 Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Armin Kuster <akuster808@gmail.com> 2021-08-27T04:43:35+00:00 Daiane Angolini daiane.angolini@foundries.io 2021-08-26T17:14:41+00:00 urn:sha1:ab90741aa2de75bf8afc4ce99a4f8f412781024a Assign a weak default value for MODSIGN_KEY_DIR so the other layers can set a default value for them as well. Signed-off-by: Daiane Angolini <daiane.angolini@foundries.io> Signed-off-by: Armin Kuster <akuster808@gmail.com> 2021-08-01T15:47:08+00:00 Armin Kuster akuster808@gmail.com 2021-07-29T23:32:05+00:00 urn:sha1:b8554aae23cb66378866bff7d5ef6c6324fa486a Signed-off-by: Armin Kuster <akuster808@gmail.com> 2021-06-06T20:03:37+00:00 Armin Kuster akuster808@gmail.com 2021-06-02T01:59:22+00:00 urn:sha1:6e75e751ff1a0e1c45545a032a598a9098fa75f2 Signed-off-by: Armin Kuster <akuster808@gmail.com> 2021-02-24T04:34:51+00:00 Ming Liu liu.ming50@gmail.com 2021-02-20T12:18:22+00:00 urn:sha1:6612bf719f0ecf6b040e493481ffacc553a3ff26 Or else wic will fail without "--no-fstab-update" option. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> 2021-02-24T04:34:51+00:00 Ming Liu liu.ming50@gmail.com 2021-02-20T12:18:19+00:00 urn:sha1:76d1e3ecad77ecd38c1c99171d5f2497d1258644 The current logic in ima-evm-rootfs.bbclass does not guarantee ima_evm_sign_rootfs is the last function in IMAGE_PREPROCESS_COMMAND by appending to it, for instance, if there are other "_append" being used as it's the case in openembedded-core/meta/classes/image.bbclass: | IMAGE_PREPROCESS_COMMAND_append = " ${@ 'systemd_preset_all;' \ | if bb.utils.contains('DISTRO_FEATURES', 'systemd', True, False, d) \ | and not bb.utils.contains('IMAGE_FEATURES', 'stateless-rootfs', True, | False, d) else ''} reproducible_final_image_task; " and ima-evm-rootfs should be in IMAGE_CLASSES instead of in INHERIT since that would impact all recipes but not only image recipes. To fix the above issues, we introduce a ima_evm_sign_handler setting IMA/EVM rootfs signing requirements/dependencies in event bb.event.RecipePreFinalise, it checks 'ima' distro feature to decide if IMA/EVM rootfs signing logic should be applied or not. Also add ima-evm-keys to IMAGE_INSTALL. Signed-off-by: Ming Liu <liu.ming50@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> 2019-08-07T14:09:43+00:00 Dmitry Eremin-Solenikov dmitry_eremin-solenikov@mentor.com 2019-07-28T15:31:49+00:00 urn:sha1:79bc2559fef750dda6301e4c3ed891850d3244a1 Add bbclass responsible for handling signing of kernel modules. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> fixup class to avoid including in every configure task Signed-off-by: Armin Kuster <akuster808@gmail.com> 2019-08-04T20:12:41+00:00 Dmitry Eremin-Solenikov dmitry_eremin-solenikov@mentor.com 2019-07-28T15:31:48+00:00 urn:sha1:c9c4e6c228556cc2054a4b49f85b282fd69fc25c data/debug-keys will be reused for demo modsign keys, so rename IMA_EVM_BASE to more generic INTEGRITY_BASE. Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com> 2019-05-28T14:38:41+00:00 Armin Kuster akuster808@gmail.com 2019-05-16T22:41:49+00:00 urn:sha1:6680225c05bb0834280307c223c3a545b088cbd3 Signed-off-by: Armin Kuster <akuster808@gmail.com>