linux/meta-security.git/meta-tpm, branch dunfell

tpm2-tools: update to 4.1.3

2022-03-20T21:51:06+00:00

Minor version bump from 4.1.1 to 4.1.3, containing two fixes: 4.1.3 - 2020-06-02 * tpm2_create: Fix issue with userauth attribute being cleared if policy is specified. 4.1.2 - 2020-05-18 * Fix missing handle maps for ESY3 handle breaks. See #1994. https://github.com/tpm2-software/tpm2-tools/pull/1994 Details of changes https://github.com/tpm2-software/tpm2-tools/commits/4.1.X Signed-off-by: Ralph Siemsen Signed-off-by: Armin Kuster

tpm2-tools: backport fix for CVE-2021-3565

2022-03-20T21:50:58+00:00

tpm2_import used a fixed AES key for the inner wrapper, which means that a MITM attack would be able to unwrap the imported key. Even the use of an encrypted session will not prevent this. The TPM only encrypts the first parameter which is the fixed symmetric key. To fix this, ensure the key size is 16 bytes or bigger and use OpenSSL to generate a secure random AES key. Upstream commit (with offset adjusted) https://github.com/tpm2-software/tpm2-tools/commit/c069e4f179d5e6653a84fb236816c375dca82515 Signed-off-by: Ralph Siemsen Signed-off-by: Armin Kuster

tpm-tools: fix build issue

2021-07-10T12:25:40+00:00

This error occurs randomly. /bin/bash: pod2man: command not found [Yocto #14304] minor space/tab cleanup Signed-off-by: Armin Kuster Cc: Ben

README: updated branch for Dunfell

2020-10-17T14:16:48+00:00

Signed-off-by: Armin Kuster

ibmswtpm2: fix QA warning

2020-10-17T01:47:51+00:00

ibmswtpm2 doesn't have GNU_HASH (didn't pass LDFLAGS?) [ldflags Signed-off-by: Armin Kuster

trousers: Several Security fixes

2020-08-24T19:18:49+00:00

Source: meta-security MR: 105088 Type: Security Fix Disposition: Backport from http://git.yoctoproject.org/cgit/cgit.cgi/meta-security/commit/?id=787ba6faeaa8823a4d87e5edd15581cb4e12fa70 ChangeID: b55bccb002b9eb2c49dfe380406e2597bb1ade90 Description: Fixes: CVE-2020-24332 CVE-2020-24330 CVE-2020-24331 Signed-off-by: Armin Kuster Signed-off-by: Armin Kuster (cherry picked from commit 787ba6faeaa8823a4d87e5edd15581cb4e12fa70) Signed-off-by: Armin Kuster

packagegroup-security-tpm2: Depend on preferred provider for cryptsetup

2020-07-15T04:27:35+00:00

Signed-off-by: Jeremy Puhlman Signed-off-by: Armin Kuster

cryptsetup-tpm-incubator: RPROVIDES cryptsetup and cryptsetup-dev

2020-07-15T04:27:35+00:00

Without this we get weird conflict when you include dev packages: rror: Transaction check error: file /usr/include/libcryptsetup.h conflicts between attempted installs of cryptsetup-tpm-incubator-dev-0.9.9-r0.corei7_64 and lib32-cryptsetup-dev-2.3.2-r0.1.i586 file /usr/lib64/libcryptsetup.so conflicts between attempted installs of cryptsetup-tpm-incubator-dev-0.9.9-r0.corei7_64 and cryptsetup-dev-2.3.2-r0.1.corei7_64 file /usr/lib64/pkgconfig/libcryptsetup.pc conflicts between attempted installs of cryptsetup-tpm-incubator-dev-0.9.9-r0.corei7_64 and cryptsetup-dev-2.3.2-r0.1.corei7_64 file /usr/lib/libcryptsetup.so conflicts between attempted installs of lib32-cryptsetup-tpm-incubator-dev-0.9.9-r0.i586 and lib32-cryptsetup-dev-2.3.2-r0.1.i586 file /usr/lib/pkgconfig/libcryptsetup.pc conflicts between attempted installs of lib32-cryptsetup-tpm-incubator-dev-0.9.9-r0.i586 and lib32-cryptsetup-dev-2.3.2-r0.1.i586 Signed-off-by: Jeremy Puhlman Signed-off-by: Armin Kuster

layer.conf: update LAYERSERIES_COMPAT for dunfell

2020-03-27T23:53:25+00:00

Signed-off-by: Martin Jansa Signed-off-by: Armin Kuster

linux-yocto: update the bbappend to 5.x

2020-03-08T21:13:07+00:00

As linux-yocto upgraded to 5.x in oe-core, update the bbappend to 5.x to remove the warning ERROR: No recipes available for: .../meta-security/meta-tpm/recipes-kernel/linux/linux-yocto_4.%.bbappend This patch hasn't been verified any further than allowing bitbake to complete with a non-linux-yocto kernel. In particular options could be different, or new ones needed / desired. Signed-off-by: André Draszik Signed-off-by: Armin Kuster