linux/meta-security.git/recipes-core, branch walnascar

packagegroup-core-security: drop firejail for musl

2025-01-07T01:01:40+00:00

appears to be a known issue: https://bugs.gentoo.org/937374 Signed-off-by: Armin Kuster

dm-verity-image-initramfs: drop lvm2-udevrules

2024-11-25T01:19:50+00:00

Drop lvm2-udevrules as it has been removed in meta-openembedded commit[1]. [1] https://git.openembedded.org/meta-openembedded/commit/?h=master&id=c37c867e1adddd6fa39cf3f3d4c6688ea6dc825a Signed-off-by: Yi Zhao Signed-off-by: Armin Kuster

recipes: WORKDIR -> UNPACKDIR transition

2024-06-17T12:25:25+00:00

* WORKDIR -> UNPACKDIR transition * Switch away from S = WORKDIR Signed-off-by: Changqing Li [Fixed up the smack changes due to prior patch] Signed-off-by: Armin Kuster

packagegroup-core-security: update libseccomp dependencies

2024-05-09T02:03:13+00:00

libseccomp requires DISTRO_FEATURE seccomp enabled. This one is automatically removed for riscv, so we do not need to add an additional condition. This change is necessary for cve-check on world with meta-security Signed-off-by: Marta Rybczynska Signed-off-by: Armin Kuster

dm-verity-image-initramfs: Set IMAGE_NAME_SUFFIX to empty

2024-03-27T16:36:58+00:00

According to the Yocto reference manual [1], the IMAGE_NAME_SUFFIX should be set to empty for the initramfs image. Otherwise, we may incur a build error like following due to the initrd check in live-vm-common.bbclass: ERROR: core-image-minimal-1.0-r0 do_bootimg: build-test/tmp/deploy/images/genericx86-64/dm-verity-image-initramfs-genericx86-64.cpio.gz is invalid. initrd image creation failed. ERROR: core-image-minimal-1.0-r0 do_bootimg: ExecutionError('build-test/tmp/work/genericx86_64-poky-linux/core-image-minimal/1.0/temp/run.build_hddimg.1961965', 1, None, None) ERROR: Logfile of failure stored in: build-test/tmp/work/genericx86_64-poky-linux/core-image-minimal/1.0/temp/log.do_bootimg.1961965 ERROR: Task (poky/meta/recipes-core/images/core-image-minimal.bb:do_bootimg) failed with exit code '1' [1] https://docs.yoctoproject.org/ref-manual/variables.html#term-IMAGE_NAME_SUFFIX Signed-off-by: Kevin Hao Signed-off-by: Armin Kuster

dm-verity-image-initramfs: Allow compressed image types

2023-08-06T15:31:18+00:00

Using in the depends variable does not work for compressed image types like squashfs-zst, as the resulting task dependency still contains the incompatible dash. Replacing the dash by an underscore resolves this issue. Signed-off-by: Stephan Wurm Signed-off-by: Armin Kuster

packagegroup-core-security: only include firejail x86-64 and arch64

2023-07-31T10:18:52+00:00

Signed-off-by: Armin Kuster

qemu: move qemu setting to image and out of layer.conf

2023-07-31T10:18:52+00:00

I suspect its better form to have these in the image definition. Signed-off-by: Armin Kuster

packagegroup-core-security: add os-release

2023-06-25T19:05:28+00:00

Exclude openscap and scap-security-guide if musl Fix RDEPENDS list to include compliance packages. Signed-off-by: Armin Kuster

dm-verity: hook separate hash into initramfs framework

2023-06-25T19:05:28+00:00

The prior commits create the separate hash so now it is time to update the initramfs framework so that veritysetup, which is responsible for binding the data and hash, is aware of when separate hash is in use, and can react accordingly. The added code follows the existing appended hash code style, but is considerably smaller because it doesn't have the large case statement that supports all possible identification schemes (label, UUID, ...). With the root hash split in two to create the respective partition UUIDs, we know exactly how to identify it, and the UUIDs used. Signed-off-by: Paul Gortmaker Signed-off-by: Armin Kuster