commit	1fe918a07084c878d72cf8a7d1707f6598cc438f	[log] [tgz]
author	Andrew Geissler <geissonator@yahoo.com>	Fri May 15 14:16:47 2020 -0500
committer	Andrew Geissler <geissonator@yahoo.com>	Thu May 21 15:43:47 2020 -0500
tree	4c68407364bab78c848876a89613f8075f2954f9
parent	c182c62dd929fe69b57a12bc04099fcd09b5d436 [diff]

meta-security: subtree update:b72cc7f87c..95fe86eb98

André Draszik (1):
      linux-yocto: update the bbappend to 5.x

Armin Kuster (36):
      README: add pull request option
      sssd: drop py2 support
      python3-fail2ban: update to latest
      Apparmor: fix some runtime depends
      linux-yocto-dev: remove "+"
      checksecurity: fix runtime issues
      buck-security: fix rdebends and minor style cleanup
      swtpm: fix configure error
      ecryptfs-utils: search nspr header files in ${STAGING_INCDIR}/nspr directory
      bastille: convert to py3
      tpm2-tools: update to 4.1.1
      tpm2-tcti-uefi: fix build issue for i386 machine
      tpm2-tss: update to 2.3.2
      ibmswtpm2: update to 1563
      python3-fail2ban: add 2-3 conversion changes
      google-authenticator-libpam: install module in pam location
      apparmor: update to tip
      clamav: add bison-native to depend
      meta-security-isafw: import layer from Intel
      isafw: fix to work against master
      layer.conf: add zeus
      README.md: update to new maintainer
      clamav-native: missed bison fix
      secuirty*-image: remove dead var and minor cleanup
      libtpm: fix build issue over pod2man
      sssd: python2 not supported
      libseccomp: update to 2.4.3
      lynis: add missing rdepends
      fail2ban: change hardcoded sysklogd to VIRTUAL-RUNTIME_base-utils-syslog
      chkrootkit: add rootkit recipe
      clamav: move to recipes-scanners
      checksec: move to recipe-scanners
      checksecurity: move to recipes-scanners
      buck-security: move to recipes-scanners
      arpwatch: add new recipe
      buck-security: fix runtime issue with missing per module

Bartosz Golaszewski (3):
      linux: drop the bbappend for linux v4.x series
      classes: provide a class for generating dm-verity meta-data images
      dm-verity: add a working example for BeagleBone Black

Haseeb Ashraf (1):
      samhain: dnmalloc hash fix for aarch64 and mips64

Jan Luebbe (2):
      apparmor: fix wrong executable permission on service file
      apparmor: update to 2.13.4

Jonatan Pålsson (10):
      README: Add meta-python to list of layer deps
      sssd: Add PACKAGECONFIG for python2
      sssd: Fix typo in PACKAGECONFIG. cyrpto -> crypto
      sssd: DEPEND on nss if nothing else is chosen
      sssd: Sort PACKAGECONFIG entries
      sssd: Add autofs PACKAGECONFIG
      sssd: Add sudo PACKAGECONFIG
      sssd: Add missing files to SYSTEMD_SERVICE
      sssd: Add missing DEPENDS on jansson
      sssd: Add infopipe PACKAGECONFIG

Kai Kang (1):
      sssd: fix for ldblibdir and systemd etc

Martin Jansa (1):
      layer.conf: update LAYERSERIES_COMPAT for dunfell

Mingli Yu (1):
      linux-yocto: update the bbappend to 5.x

Pierre-Jean Texier via Lists.Yoctoproject.Org (1):
      google-authenticator-libpam: upgrade 1.07 -> 1.08

Yi Zhao (5):
      samhain: fix build with new version attr
      scap-security-guide: fix xml parsing error when build remediation files
      scap-security-guide: pass the correct schema file path to openscap-native
      openscap-daemon: add missing runtime dependencies
      samhain-server: add volatile file for systemd

Change-Id: I3d4a4055cb9420e97d3eacf8436d9b048d34733f
Signed-off-by: Andrew Geissler <geissonator@yahoo.com>

meta-security/README[diff]
meta-security/classes/dm-verity-img.bbclass[Added - diff]
meta-security/conf/layer.conf[diff]
meta-security/meta-integrity/conf/layer.conf[diff]
meta-security/meta-security-compliance/conf/layer.conf[diff]
meta-security/meta-security-compliance/recipes-auditors/lynis/lynis_2.7.5.bb[diff]
meta-security/meta-security-compliance/recipes-openscap/openscap-daemon/openscap-daemon_0.1.10.bb[diff]
meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-Fix-XML-parsing-of-the-remediation-functions-file.patch[Added - diff]
meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-Fixed-the-broken-fix-when-greedy-regex-ate-the-whole.patch[Added - diff]
meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide.inc[diff]
meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb[diff]
meta-security/meta-security-isafw/.gitignore[Added - diff]
meta-security/meta-security-isafw/COPYING.MIT[Added - diff]
meta-security/meta-security-isafw/README.md[Added - diff]
meta-security/meta-security-isafw/conf/layer.conf[Added - diff]
meta-security/meta-security-isafw/lib/isafw/__init__.py[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isafw.py[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isaplugins/ISA_cfa_plugin.py[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isaplugins/ISA_cve_plugin.py[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isaplugins/ISA_fsa_plugin.py[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isaplugins/ISA_kca_plugin.py[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isaplugins/ISA_la_plugin.py[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isaplugins/__init__.py[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isaplugins/configs/__init__.py[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isaplugins/configs/kca/__init__.py[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isaplugins/configs/kca/arm.py[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isaplugins/configs/kca/common.py[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isaplugins/configs/kca/x86.py[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isaplugins/configs/la/approved-non-osi[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isaplugins/configs/la/exceptions[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isaplugins/configs/la/licenses[Added - diff]
meta-security/meta-security-isafw/lib/isafw/isaplugins/configs/la/violations[Added - diff]
meta-security/meta-security-isafw/recipes-devtools/checksec/checksec_1.5-1.bb[Added - diff]
meta-security/meta-security-isfafw/classes/isafw.bbclass[Added - diff]
meta-security/meta-tpm/conf/layer.conf[diff]
meta-security/meta-tpm/recipes-kernel/linux/linux-yocto_5.%.bbappend[Renamed from meta-security/meta-tpm/recipes-kernel/linux/linux-yocto_4.%.bbappend - diff]
meta-security/meta-tpm/recipes-tpm/libtpm/libtpm_0.7.0.bb[diff]
meta-security/meta-tpm/recipes-tpm/swtpm/swtpm_0.2.0.bb[diff]
meta-security/meta-tpm/recipes-tpm2/ibmswtpm2/files/remove_optimization.patch[Added - diff]
meta-security/meta-tpm/recipes-tpm2/ibmswtpm2/ibmswtpm2_1332.bb[Deleted - diff]
meta-security/meta-tpm/recipes-tpm2/ibmswtpm2/ibmswtpm2_1563.bb[Added - diff]
meta-security/meta-tpm/recipes-tpm2/tpm2-tcti-uefi/files/fix_header_file.patch[Added - diff]
meta-security/meta-tpm/recipes-tpm2/tpm2-tcti-uefi/files/tpm2-get-caps-fixed.patch[Added - diff]
meta-security/meta-tpm/recipes-tpm2/tpm2-tcti-uefi/tpm2-tcti-uefi/0001-configure.ac-stop-inserting-host-directories-into-co.patch[diff]
meta-security/meta-tpm/recipes-tpm2/tpm2-tcti-uefi/tpm2-tcti-uefi_0.9.9.bb[diff]
meta-security/meta-tpm/recipes-tpm2/tpm2-tools/tpm2-tools_4.0.1.bb[Deleted - diff]
meta-security/meta-tpm/recipes-tpm2/tpm2-tools/tpm2-tools_4.1.1.bb[Added - diff]
meta-security/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_2.3.2.bb[Renamed from meta-security/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_2.3.1.bb - diff]
meta-security/recipes-core/images/dm-verity-image-initramfs.bb[Added - diff]
meta-security/recipes-core/initrdscripts/initramfs-dm-verity.bb[Added - diff]
meta-security/recipes-core/initrdscripts/initramfs-dm-verity/init-dm-verity.sh[Added - diff]
meta-security/recipes-ids/samhain/files/fix-build-with-new-version-attr.patch[Added - diff]
meta-security/recipes-ids/samhain/files/samhain-server-volatiles.conf[Added - diff]
meta-security/recipes-ids/samhain/samhain-server.bb[diff]
meta-security/recipes-ids/samhain/samhain.inc[diff]
meta-security/recipes-kernel/linux/linux-yocto-dev.bbappend[diff]
meta-security/recipes-kernel/linux/linux-yocto_5.%.bbappend[Renamed from meta-security/recipes-kernel/linux/linux-yocto_4.%.bbappend - diff]
meta-security/recipes-mac/AppArmor/apparmor_2.13.4.bb[Renamed from meta-security/recipes-mac/AppArmor/apparmor_2.13.3.bb - diff]
meta-security/recipes-scanners/arpwatch/arpwatch_3.0.bb[Added - diff]
meta-security/recipes-scanners/arpwatch/files/arpwatch.conf[Added - diff]
meta-security/recipes-scanners/arpwatch/files/arpwatch.default[Added - diff]
meta-security/recipes-scanners/arpwatch/files/arpwatch_init[Added - diff]
meta-security/recipes-scanners/arpwatch/files/host_contam_fix.patch[Added - diff]
meta-security/recipes-scanners/arpwatch/files/postfix_workaround.patch[Added - diff]
meta-security/recipes-scanners/buck-security/buck-security_0.7.bb[Added - diff]
meta-security/recipes-scanners/checksec/checksec_2.1.0.bb[Renamed from meta-security/recipes-security/checksec/checksec_2.1.0.bb - diff]
meta-security/recipes-scanners/checksecurity/checksecurity_2.0.15.bb[Renamed from meta-security/recipes-security/checksecurity/checksecurity_2.0.15.bb - diff]
meta-security/recipes-scanners/checksecurity/files/check-setuid-use-more-portable-find-args.patch[Renamed from meta-security/recipes-security/checksecurity/files/check-setuid-use-more-portable-find-args.patch - diff]
meta-security/recipes-scanners/checksecurity/files/setuid-log-folder.patch[Renamed from meta-security/recipes-security/checksecurity/files/setuid-log-folder.patch - diff]
meta-security/recipes-scanners/clamav/clamav_0.101.5.bb[Renamed from meta-security/recipes-security/clamav/clamav_0.101.5.bb - diff]
meta-security/recipes-scanners/clamav/files/clamav-freshclam.service[Renamed from meta-security/recipes-security/clamav/files/clamav-freshclam.service - diff]
meta-security/recipes-scanners/clamav/files/clamav-milter.conf.sample[Renamed from meta-security/recipes-security/clamav/files/clamav-milter.conf.sample - diff]
meta-security/recipes-scanners/clamav/files/clamav.service[Renamed from meta-security/recipes-security/clamav/files/clamav.service - diff]
meta-security/recipes-scanners/clamav/files/clamd.conf[Renamed from meta-security/recipes-security/clamav/files/clamd.conf - diff]
meta-security/recipes-scanners/clamav/files/freshclam-native.conf[Renamed from meta-security/recipes-security/clamav/files/freshclam-native.conf - diff]
meta-security/recipes-scanners/clamav/files/freshclam.conf[Renamed from meta-security/recipes-security/clamav/files/freshclam.conf - diff]
meta-security/recipes-scanners/clamav/files/tmpfiles.clamav[Renamed from meta-security/recipes-security/clamav/files/tmpfiles.clamav - diff]
meta-security/recipes-scanners/clamav/files/volatiles.03_clamav[Renamed from meta-security/recipes-security/clamav/files/volatiles.03_clamav - diff]
meta-security/recipes-scanners/rootkits/chkrootkit_0.53.bb[Added - diff]
meta-security/recipes-security/bastille/files/set_required_questions.py[diff]
meta-security/recipes-security/buck-security/buck-security_0.7.bb[Deleted - diff]
meta-security/recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb[diff]
meta-security/recipes-security/fail2ban/files/0001-python3-fail2ban-2-3-conversion.patch[Added - diff]
meta-security/recipes-security/fail2ban/files/fail2ban_setup.py[diff]
meta-security/recipes-security/fail2ban/python3-fail2ban_0.10.4.0.bb[diff]
meta-security/recipes-security/google-authenticator-libpam/google-authenticator-libpam_1.08.bb[Renamed from meta-security/recipes-security/google-authenticator-libpam/google-authenticator-libpam_1.07.bb - diff]
meta-security/recipes-security/images/security-client-image.bb[diff]
meta-security/recipes-security/images/security-server-image.bb[diff]
meta-security/recipes-security/libseccomp/files/0001-tests-rely-on-__SNR_xxx-instead-of-__NR_xxx-for-sysc.patch[Deleted - diff]
meta-security/recipes-security/libseccomp/libseccomp_2.4.3.bb[Renamed from meta-security/recipes-security/libseccomp/libseccomp_2.4.2.bb - diff]
meta-security/recipes-security/sssd/files/fix-ldblibdir.patch[Added - diff]
meta-security/recipes-security/sssd/files/volatiles.99_sssd[Added - diff]
meta-security/recipes-security/sssd/sssd_1.16.4.bb[diff]
meta-security/wic/beaglebone-yocto-verity.wks.in[Added - diff]

94 files changed

tree: 4c68407364bab78c848876a89613f8075f2954f9

README.md

OpenBMC

The OpenBMC project can be described as a Linux distribution for embedded devices that have a BMC; typically, but not limited to, things like servers, top of rack switches or RAID appliances. The OpenBMC stack uses technologies such as Yocto, OpenEmbedded, systemd, and D-Bus to allow easy customization for your server platform.

Setting up your OpenBMC project

1) Prerequisite

Ubuntu 14.04

sudo apt-get install -y git build-essential libsdl1.2-dev texinfo gawk chrpath diffstat

Fedora 28

sudo dnf install -y git patch diffstat texinfo chrpath SDL-devel bitbake \
    rpcgen perl-Thread-Queue perl-bignum perl-Crypt-OpenSSL-Bignum
sudo dnf groupinstall "C Development Tools and Libraries"

2) Download the source

git clone git@github.com:openbmc/openbmc.git
cd openbmc

3) Target your hardware

Any build requires an environment variable known as TEMPLATECONF to be set to a hardware target. You can see all of the known targets with find meta-* -name local.conf.sample. Choose the hardware target and then move to the next step. Additional examples can be found in the OpenBMC Cheatsheet

Machine	TEMPLATECONF
Palmetto	`meta-ibm/meta-palmetto/conf`
Zaius	`meta-ingrasys/meta-zaius/conf`
Witherspoon	`meta-ibm/meta-witherspoon/conf`
Romulus	`meta-ibm/meta-romulus/conf`

As an example target Romulus

export TEMPLATECONF=meta-ibm/meta-romulus/conf

4) Build

. openbmc-env
bitbake obmc-phosphor-image

Additional details can be found in the docs repository.

OpenBMC Development

The OpenBMC community maintains a set of tutorials new users can go through to get up to speed on OpenBMC development out here

Build Validation and Testing

Commits submitted by members of the OpenBMC GitHub community are compiled and tested via our Jenkins server. Commits are run through two levels of testing. At the repository level the makefile make check directive is run. At the system level, the commit is built into a firmware image and run with an arm-softmmu QEMU model against a barrage of CI tests.

Commits submitted by non-members do not automatically proceed through CI testing. After visual inspection of the commit, a CI run can be manually performed by the reviewer.

Automated testing against the QEMU model along with supported systems are performed. The OpenBMC project uses the Robot Framework for all automation. Our complete test repository can be found here.

Submitting Patches

Support of additional hardware and software packages is always welcome. Please follow the contributing guidelines when making a submission. It is expected that contributions contain test cases.

Bug Reporting

Issues are managed on GitHub. It is recommended you search through the issues before opening a new one.

Questions

First, please do a search on the internet. There's a good chance your question has already been asked.

For general questions, please use the openbmc tag on Stack Overflow. Please review the discussion on Stack Overflow licensing before posting any code.

For technical discussions, please see contact info below for IRC and mailing list information. Please don't file an issue to ask a question. You'll get faster results by using the mailing list or IRC.

Features of OpenBMC

Feature List

Host management: Power, Cooling, LEDs, Inventory, Events, Watchdog
Full IPMI 2.0 Compliance with DCMI
Code Update Support for multiple BMC/BIOS images
Web-based user interface
REST interfaces
D-Bus based interfaces
SSH based SOL
Remote KVM
Hardware Simulation
Automated Testing
User management
Virtual media

Features In Progress

OpenCompute Redfish Compliance
Verified Boot

Features Requested but need help

OpenBMC performance monitoring

Finding out more

Dive deeper into OpenBMC by opening the docs repository.

Technical Steering Committee

The Technical Steering Committee (TSC) guides the project. Members are:

Brad Bishop (chair), IBM
Nancy Yuen, Google
Sai Dasari, Facebook
James Mihm, Intel
Sagar Dharia, Microsoft
Supreeth Venkatesh, Arm

Contact

Mail: openbmc@lists.ozlabs.org https://lists.ozlabs.org/listinfo/openbmc
IRC: #openbmc on freenode.net
Riot: #openbmc:matrix.org