linux/meta-security.git/meta-integrity/recipes-kernel, branch styhead

linux-yocto%.bbappend: Add audit.cfg

2024-02-20T12:40:39+00:00

Add audit.cfg configuration fragment. By default it is not appended to SRC_URI. It allows enabling the audit kernel subsystem which may help to debug appraisal issues. Boot with "integrity_audit=1" to capture a more complete set of events in /var/log/audit/. Previously the same configuration fragment was provided by layer meta-security-framework but it is no longer maintained therefore it makes sense to have audit.cfg in layer meta-integrity. Signed-off-by: Leon Anavi Signed-off-by: Armin Kuster

meta-integrity: drop ima.cfg in favor of new k-cache

2023-07-31T10:18:52+00:00

The upstream ima.cfg kernel-cache has been updated. Use it instead. Signed-off-by: Armin Kuster

integrity: Rename linux-%.bbappend to linux-yocto%.bbappend

2023-05-13T10:06:29+00:00

To avoid having linux-%.bbappend included in targets unrelated to the linux kernel, rename linux-%.bbappend to linux-yocto%.bbappend. Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

integrity: Fix the do_configure function

2023-05-13T10:06:29+00:00

Append ':append' to do_configure so it does not replace all existing do_configure's. Only run 'sed' when DISTRO_FEATURES contains 'ima' and the .config file exists. Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

ima: Drop kernel config option CONFIG_SQUASHFS_XATTR=y from ima.cfg

2023-05-13T10:06:29+00:00

Drop the kernel config option CONFIG_SQUASHFS_XATTR=y from ima.cfg. Instead, require projects that use squashfs to set this option. Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

linux: overlayfs: Drop kernel patch resolving a file change notification issue

2023-05-13T10:06:29+00:00

Revert the patch resolving a file change notitfication issue (for IMA appraisal) since this patch fails in 'many downstream kernels'. - https://lists.yoctoproject.org/g/yocto/message/59928 - https://lists.yoctoproject.org/g/yocto/message/59929 Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

linux: overlayfs: Add kernel patch resolving a file change notification issue

2023-05-06T11:54:09+00:00

Add a temporary patch that resolves a file change notification issue with overlayfs where IMA did not become aware of the file changes since the 'lower' inode's i_version had not changed. The issue will be resolved in later kernels with the following patch that builds on newly addd feature (support for STATX_CHANGE_COOKIE) in v6.3-rc1: https://lore.kernel.org/linux-integrity/20230418-engste-gastwirtschaft-601fb389bba5@brauner/T/#m3bf84296fe9e6499abb6e3191693948add2ff459 Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

ima: Fix the IMA kernel feature

2023-05-06T11:54:09+00:00

Fix the IMA kernel feature. Remove outdated patches and add ima.cfg holding kernel configuration options for IMA and EVM. Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

meta-integrity: Convert to new override syntax

2021-08-01T15:47:08+00:00

Signed-off-by: Armin Kuster

meta-integrity/recipe-kernel: use sanity check

2021-06-06T20:03:37+00:00

Signed-off-by: Armin Kuster