summaryrefslogtreecommitdiffstats
path: root/documentation/dev-manual/vulnerabilities.rst
diff options
context:
space:
mode:
authorMichael Opdenacker <michael.opdenacker@bootlin.com>2023-01-05 08:34:26 +0100
committerRichard Purdie <richard.purdie@linuxfoundation.org>2023-01-06 17:39:09 +0000
commit8b1909aa6f7a51a878dc3d4a9223403ad3e164a9 (patch)
treee1418f545ad6640afb5fde004696eef2a9e6e67b /documentation/dev-manual/vulnerabilities.rst
parentae280972ffba62d7ed839b692957f61b0955cbca (diff)
downloadpoky-8b1909aa6f7a51a878dc3d4a9223403ad3e164a9.tar.gz
manuals: simplify references to classes
Now that .bbclass is removed from class section titles. We can now have, for example, :ref:`ref-classes-insane` instead of :ref:`insane <ref-classes-insane>`. Then, when necessary, rework paragraphs so that they have lines of even length, not exceeding 80 characters. (From yocto-docs rev: e76190e3be78c1e483bec0469f1e437dbf8f3791) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Suggested-by: Quentin Schulz <foss+yocto@0leil.net> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'documentation/dev-manual/vulnerabilities.rst')
-rw-r--r--documentation/dev-manual/vulnerabilities.rst10
1 files changed, 5 insertions, 5 deletions
diff --git a/documentation/dev-manual/vulnerabilities.rst b/documentation/dev-manual/vulnerabilities.rst
index f8dac5edc6..0ee3ec52c5 100644
--- a/documentation/dev-manual/vulnerabilities.rst
+++ b/documentation/dev-manual/vulnerabilities.rst
@@ -27,8 +27,9 @@ patches to fix them, see ":ref:`dev-manual/changes:submitting a change to the yo
27Vulnerability check at build time 27Vulnerability check at build time
28================================= 28=================================
29 29
30To enable a check for CVE security vulnerabilities using :ref:`cve-check <ref-classes-cve-check>` in the specific image 30To enable a check for CVE security vulnerabilities using
31or target you are building, add the following setting to your configuration:: 31:ref:`ref-classes-cve-check` in the specific image or target you are building,
32add the following setting to your configuration::
32 33
33 INHERIT += "cve-check" 34 INHERIT += "cve-check"
34 35
@@ -100,7 +101,7 @@ It is also possible to check the CVE status of individual packages as follows::
100Fixing CVE product name and version mappings 101Fixing CVE product name and version mappings
101============================================ 102============================================
102 103
103By default, :ref:`cve-check <ref-classes-cve-check>` uses the recipe name :term:`BPN` as CVE 104By default, :ref:`ref-classes-cve-check` uses the recipe name :term:`BPN` as CVE
104product name when querying the CVE database. If this mapping contains false positives, e.g. 105product name when querying the CVE database. If this mapping contains false positives, e.g.
105some reported CVEs are not for the software component in question, or false negatives like 106some reported CVEs are not for the software component in question, or false negatives like
106some CVEs are not found to impact the recipe when they should, then the problems can be 107some CVEs are not found to impact the recipe when they should, then the problems can be
@@ -167,8 +168,7 @@ the :term:`CVE_CHECK_SKIP_RECIPE` variable.
167Implementation details 168Implementation details
168====================== 169======================
169 170
170Here's what the :ref:`cve-check <ref-classes-cve-check>` class does to 171Here's what the :ref:`ref-classes-cve-check` class does to find unpatched CVE IDs.
171find unpatched CVE IDs.
172 172
173First the code goes through each patch file provided by a recipe. If a valid CVE ID 173First the code goes through each patch file provided by a recipe. If a valid CVE ID
174is found in the name of the file, the corresponding CVE is considered as patched. 174is found in the name of the file, the corresponding CVE is considered as patched.