linux/meta-security.git/recipes-ids, branch master-next

samhain: upgrade 4.5.2 -> 4.5.3

2026-05-17T14:45:41+00:00

Update samhain-client, samhain-server, and samhain-standalone to 4.5.3. Release notes: https://www.la-samhna.de/samhain/archive.html Signed-off-by: Bin Cao Signed-off-by: Scott Murray

aide: fix pkg_postinst_ontarget shell script

2026-05-17T14:45:41+00:00

- Fix conditional checks for AIDE_SCAN_POSTINIT and AIDE_RESCAN_POSTINIT: '[ 0 ]' always evaluates to true since it's a non-empty string. Use string comparison '= "1"' instead. - Fix invalid use of '&&' inside '[ ]' test brackets. Use separate test expressions joined by shell '&&'. Signed-off-by: Haitao Liu (reworked for 0.19.3, fixed indentation) Signed-off-by: Scott Murray

aide: Upgrade to 0.19.3

2026-04-27T18:47:27+00:00

Release notes: https://github.com/aide/aide/releases/tag/v0.19 https://github.com/aide/aide/releases/tag/v0.19.1 https://github.com/aide/aide/releases/tag/v0.19.2 https://github.com/aide/aide/releases/tag/v0.19.3 Signed-off-by: Scott Murray

crowdsec: Upgrade to v1.7.7

2026-04-27T18:47:27+00:00

The crowdsec recipes has seemingly been broken since soon after its addition, rewrite it to build the latest version with the go-mod bbclass. Signed-off-by: Scott Murray

suricata: update 7.0.13 -> 8.0.4

2026-04-27T18:46:41+00:00

8.0.0 [1]: Increased Rust use (including libhtp, suricatactl, and suricatasc) More protocols Lua sandboxed and available by default 8.0.4 [2]: security, performance, accuracy, and stability fixes Resolve startup warning [3]: W: af-packet: eth0: AF_PACKET tpacket-v3 is recommended for non-inline operation Add "ja4" option for fingerprinting TLS and QUIC clients [4] CFLAGS modification for (see [5]): do_package_qa: QA Issue: File /usr/bin/.debug/suricata in package suricata-dbg contains reference to TMPDIR [buildpaths] SURICATA_LUA_SYS_HEADER_DST [6] [1] https://suricata.io/2025/07/08/suricata-8-0-0-released/ [2] https://suricata.io/2026/03/17/suricata-8-0-4-and-7-0-15-released/ [3] https://docs.suricata.io/en/suricata-8.0.4/upgrade.html#id1 [4] https://github.com/OISF/suricata/pull/10836 [5] https://git.openembedded.org/openembedded-core/commit/?id=3239961e35434592c06ec2cae2885ab464d35744 [6] https://github.com/OISF/suricata/commit/3a7eef812198118fa0b96059e70074bec5a8cdbe Signed-off-by: Clayton Casciato (added musl libunwind fix) Signed-off-by: Scott Murray

suricata: improve PACKAGECONFIG[unittests] control

2026-03-04T10:12:43+00:00

Allow downstream users to explicitly select desired PACKAGECONFIG options (e.g. via "="). Users are currently forced to use ":remove" (with "ptest"). Signed-off-by: Clayton Casciato Signed-off-by: Scott Murray

suricata: add PACKAGECONFIG[seccomp] - MemoryDenyWriteExecute

2026-01-16T21:24:59+00:00

Add option to prevent memory mappings that are both writable and executable. https://www.freedesktop.org/software/systemd/man/255/systemd.exec.html#MemoryDenyWriteExecute= Core Suricata developer: https://github.com/jasonish/suricata-rpms/blob/a606a810325dd0a4f3ee45b2756b96bda28e590b/7.0/suricata-4.1.1-service.patch#L23 Fedora: https://src.fedoraproject.org/rpms/suricata/c/cfb3b996f54d28018cd01f9c6b9ecb77e59f344d Resolve SELinux AVC denial: type=PROCTITLE proctitle=/usr/bin/suricata -c /etc/suricata/suricata.yaml -i eth0 type=SYSCALL arch=aarch64 syscall=mprotect success=no exit=EACCES(Permission denied) a0=0x7fffa7d04000 a1=0x4000 a2=PROT_READ|PROT_WRITE|PROT_EXEC a3=0x21 items=0 ppid=1 pid=283 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=Suricata-Main exe=/usr/bin/suricata subj=system_u:system_r:initrc_t:s0 key=(null) type=AVC avc: denied { execmem } for pid=283 comm=Suricata-Main scontext=system_u:system_r:initrc_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=process Signed-off-by: Clayton Casciato Signed-off-by: Scott Murray

suricata: update PACKAGECONFIG[jansson] option to required

2025-12-31T20:26:10+00:00

jansson is required as of Suricata 5.0: https://github.com/OISF/suricata/commit/e49c40428e1b9f7e5dcdb5857c3978d5cb859fd9 This is still required in the latest release: https://github.com/OISF/suricata/blob/suricata-8.0.2/configure.ac#L828 On exclusion attempt: [...] | checking for jansson.h... no | checking for json_dump_callback in -ljansson... no | | ERROR: Jansson is now required. | | Go get it from your distribution or from: | http://www.digip.org/jansson/ | | Ubuntu/Debian: apt install libjansson-dev | CentOS: yum install jansson-devel | Fedora: dnf install jansson-devel | | NOTE: The following config.log files may provide further information. | NOTE: [...]/poky-whinlatter/build/tmp/work/cortexa57-poky-linux/suricata/7.0.13/sources/suricata-7.0.13/config.log | ERROR: configure failed | WARNING: exit code 1 from a shell command. ERROR: Task ([...]/poky-whinlatter/layers/meta-security/recipes-ids/suricata/suricata_7.0.13.bb:do_configure) failed with exit code '1' Signed-off-by: Clayton Casciato Signed-off-by: Scott Murray

suricata: drop trailing whitespace

2025-12-31T20:25:06+00:00

Signed-off-by: Clayton Casciato Signed-off-by: Scott Murray

suricata: drop deprecated nss, nspr PACKAGECONFIGs

2025-12-22T04:37:23+00:00

Default add in 3f95047ae1e1d ("suricata: package update to 2.0.8") https://docs.suricata.io/en/suricata-8.0.1/upgrade.html#id7 As of 7.0, "NSS is no longer required. File hashing and JA3 can now be used without the NSS compile time dependency." Removed in 8.0: https://github.com/OISF/suricata/blob/suricata-8.0.1/ChangeLog#L647 Signed-off-by: Clayton Casciato