linux/meta-security.git/meta-integrity, branch scarthgap

meta-security: Remove True option to getVar calls

2025-11-24T17:04:14+00:00

getVar() now defaults to expanding by default, thus remove the True option from getVar() calls with a regex search and replace. Signed-off-by: Akash Hadke Signed-off-by: Scott Murray

ima-evm-utils: remove unnecessary FILESEXTRAPATHS tweak

2025-11-24T17:04:14+00:00

It was pointed out that the recipe was wrongly doing FILESEXTRAPATHS:append, but on inspection the recipe does not need it at all, so just remove. Reported-by: Robert P. J. Day (cherry picked from commit 5770a76fc0d78a645ab254979986f572fd18b3ec) Signed-off-by: Scott Murray

Update maintainers

2025-11-22T06:40:12+00:00

Add Marta and myself as maintainers for meta-security and the other embedded layers that Armin had been maintaining. To avoid Armin getting bugged about individual recipes, set the RECIPE_MAINTAINER variables to myself. (backport from master) Signed-off-by: Scott Murray Signed-off-by: Richard Purdie

README.md: update to new patches mailing list

2024-04-09T15:31:35+00:00

Signed-off-by: Armin Kuster

layer.conf: Update for the scarthgap release series

2024-03-27T16:36:58+00:00

Signed-off-by: Max Krummenacher Signed-off-by: Armin Kuster

integrity-image-minimal: Fix IMAGE_INSTALL

2024-02-20T12:40:39+00:00

Append to IMAGE_INSTALL rather than directly setting the variable and does it after inheriting core-image.bbclass because in it IMAGE_INSTALL is set with a default value CORE_IMAGE_BASE_INSTALL. Variable CORE_IMAGE_BASE_INSTALL includes CORE_IMAGE_EXTRA_INSTALL so the change allows adding auditd to CORE_IMAGE_EXTRA_INSTALL as per the instructions in meta-integrity/README.md. Signed-off-by: Leon Anavi Signed-off-by: Armin Kuster

linux-yocto%.bbappend: Add audit.cfg

2024-02-20T12:40:39+00:00

Add audit.cfg configuration fragment. By default it is not appended to SRC_URI. It allows enabling the audit kernel subsystem which may help to debug appraisal issues. Boot with "integrity_audit=1" to capture a more complete set of events in /var/log/audit/. Previously the same configuration fragment was provided by layer meta-security-framework but it is no longer maintained therefore it makes sense to have audit.cfg in layer meta-integrity. Signed-off-by: Leon Anavi Signed-off-by: Armin Kuster

ima,evm: Add two variables to write filenames and signatures into

2023-11-08T12:09:28+00:00

Add two variables IMA_FILE_SIGNATURES_FILE and EVM_FILE_SIGNATURES_FILE for filenames where the ima_evm_sign_rootfs script can write the names of files and their IMA or EVM signatures into. Both variables are optional. The content of the file with IMA signatures may look like this: /usr/bin/gpiodetect ima:0x0302046730eefd... /usr/bin/pwscore ima:0x0302046730eefd004... Having the filenames along with their signatures is useful for signing files in the initrd when the initrd is running out of a tmpfs filesystem that has support for xattrs. This allows to enable an IMA appraisal policy already in the initrd where files must be signed as soon as the policy becomes active. Signed-off-by: Stefan Berger Signed-off-by: Armin Kuster

layer.conf: update LAYERSERIES_COMPAT for nanbield

2023-09-11T11:18:19+00:00

* oe-core switched to nanbield in: https://git.openembedded.org/openembedded-core/commit/?id=f212cb12a0db9c9de5afd3cc89b1331d386e55f6 Signed-off-by: Martin Jansa Signed-off-by: Armin Kuster

layer: add QA_WARNINGS to all layers

2023-08-06T15:31:18+00:00

Signed-off-by: Armin Kuster