meta-security: subtree update:e8c9e69c80..d2ceb5e438
Armin Kuster (2):
samhain: update to 4.4.2
kas-security-base: Don't create local SSTATE mirror
Yi Zhao (3):
suricata: unify volatiles file name
clamav: unify volatiles file name
scap-security-guide: fix build with Python 3.9
Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Change-Id: I60c6ba8c22593542165dbd1af0606e01f6473b33
diff --git a/meta-security/kas/kas-security-base.yml b/meta-security/kas/kas-security-base.yml
index ba0e0f8..94188c8 100644
--- a/meta-security/kas/kas-security-base.yml
+++ b/meta-security/kas/kas-security-base.yml
@@ -34,7 +34,6 @@
CONF_VERSION = "1"
SOURCE_MIRROR_URL = "http://downloads.yoctoproject.org/mirror/sources/"
SSTATE_MIRRORS = "file://.* http://sstate.yoctoproject.org/dev/PATH;downloadfilename=PATH \n"
- SSTATE_DIR = "/home/srv/sstate/master"
DL_DIR = "/home/srv/downloads/master"
BB_HASHSERVE = "auto"
BB_SIGNATURE_HANDLER = "OEEquivHash"
diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-fix-deprecated-instance-of-element.getchildren.patch b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-fix-deprecated-instance-of-element.getchildren.patch
new file mode 100644
index 0000000..01e3dd6
--- /dev/null
+++ b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-fix-deprecated-instance-of-element.getchildren.patch
@@ -0,0 +1,43 @@
+From e435bf2dc59d652710104a1c59332e410b12bb64 Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Mon, 8 Jun 2020 12:33:48 +0200
+Subject: [PATCH] fix deprecated instance of element.getchildren
+
+Upstream-Status: Backport
+[https://github.com/ComplianceAsCode/content/commit/e435bf2dc59d652710104a1c59332e410b12bb64]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ ssg/build_remediations.py | 2 +-
+ ssg/build_stig.py | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py
+index fdde0f268..c18d6bd54 100644
+--- a/ssg/build_remediations.py
++++ b/ssg/build_remediations.py
+@@ -735,7 +735,7 @@ def expand_xccdf_subs(fix, remediation_type, remediation_functions):
+ # First concat output form of modified fix text (including text appended
+ # to all children of the fix)
+ modfix = [fix.text]
+- for child in fix.getchildren():
++ for child in list(fix):
+ if child is not None and child.text is not None:
+ modfix.append(child.text)
+ modfixtext = "".join(modfix)
+diff --git a/ssg/build_stig.py b/ssg/build_stig.py
+index 528285f3d..6122981fc 100644
+--- a/ssg/build_stig.py
++++ b/ssg/build_stig.py
+@@ -38,7 +38,7 @@ def add_references(reference, destination):
+ for ref in refs:
+ if (ref.get('href').startswith(stig_refs) and
+ ref.text in dictionary):
+- index = rule.getchildren().index(ref)
++ index = list(rule).index(ref)
+ new_ref = ET.Element(
+ '{%s}reference' % XCCDF11_NS, {'href': stig_ns})
+ new_ref.text = dictionary[ref.text]
+--
+2.17.1
+
diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-fix-deprecated-getiterator-function.patch b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-fix-deprecated-getiterator-function.patch
new file mode 100644
index 0000000..84271c4
--- /dev/null
+++ b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-fix-deprecated-getiterator-function.patch
@@ -0,0 +1,58 @@
+From b0adc1d53780def4a95e310b6d26bb91ee97177e Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Mon, 8 Jun 2020 13:27:41 +0200
+Subject: [PATCH] fix deprecated getiterator function
+
+Upstream-Status: Backport
+[https://github.com/ComplianceAsCode/content/commit/b0adc1d53780def4a95e310b6d26bb91ee97177e]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ ssg/build_cpe.py | 6 +++---
+ ssg/id_translate.py | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/ssg/build_cpe.py b/ssg/build_cpe.py
+index 2e5d24a5d..8c046777a 100644
+--- a/ssg/build_cpe.py
++++ b/ssg/build_cpe.py
+@@ -17,7 +17,7 @@ def extract_subelement(objects, sub_elem_type):
+ """
+
+ for obj in objects:
+- for subelement in obj.getiterator():
++ for subelement in obj.iter():
+ if subelement.get(sub_elem_type):
+ sub_element = subelement.get(sub_elem_type)
+ return sub_element
+@@ -44,12 +44,12 @@ def extract_referred_nodes(tree_with_refs, tree_with_ids, attrname):
+ reflist = []
+ elementlist = []
+
+- for element in tree_with_refs.getiterator():
++ for element in tree_with_refs.iter():
+ value = element.get(attrname)
+ if value is not None:
+ reflist.append(value)
+
+- for element in tree_with_ids.getiterator():
++ for element in tree_with_ids.iter():
+ if element.get("id") in reflist:
+ elementlist.append(element)
+
+diff --git a/ssg/id_translate.py b/ssg/id_translate.py
+index 72b07be18..ba9225904 100644
+--- a/ssg/id_translate.py
++++ b/ssg/id_translate.py
+@@ -64,7 +64,7 @@ class IDTranslator(object):
+ )
+
+ def translate(self, tree, store_defname=False):
+- for element in tree.getiterator():
++ for element in tree.iter():
+ idname = element.get("id")
+ if idname:
+ # store the old name if requested (for OVAL definitions)
+--
+2.17.1
+
diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0003-fix-remaining-getchildren-and-getiterator-functions.patch b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0003-fix-remaining-getchildren-and-getiterator-functions.patch
new file mode 100644
index 0000000..8162292
--- /dev/null
+++ b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0003-fix-remaining-getchildren-and-getiterator-functions.patch
@@ -0,0 +1,57 @@
+From a0da16c5eeb9a7414f7f2a37a6b270c8d04b2ddf Mon Sep 17 00:00:00 2001
+From: Vojtech Polasek <vpolasek@redhat.com>
+Date: Mon, 8 Jun 2020 14:01:55 +0200
+Subject: [PATCH] fix remaining getchildren and getiterator functions
+
+Upstream-Status: Backport
+[https://github.com/ComplianceAsCode/content/commit/a0da16c5eeb9a7414f7f2a37a6b270c8d04b2ddf]
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ build-scripts/sds_move_ocil_to_checks.py | 2 +-
+ build-scripts/verify_references.py | 2 +-
+ shared/transforms/pcidss/transform_benchmark_to_pcidss.py | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/build-scripts/sds_move_ocil_to_checks.py b/build-scripts/sds_move_ocil_to_checks.py
+index 5f5139659..64dc19084 100755
+--- a/build-scripts/sds_move_ocil_to_checks.py
++++ b/build-scripts/sds_move_ocil_to_checks.py
+@@ -106,7 +106,7 @@ def move_ocil_content_from_ds_extended_component_to_ds_component(datastreamtree,
+ timestamp = extendedcomp.get('timestamp')
+
+ # Get children elements of <ds:extended-component> containing OCIL content
+- extchildren = extendedcomp.getchildren()
++ extchildren = list(extendedcomp)
+ # There should be just one OCIL subcomponent in <ds:extended-component>
+ if len(extchildren) != 1:
+ sys.stderr.write("ds:extended-component contains more than one element!"
+diff --git a/build-scripts/verify_references.py b/build-scripts/verify_references.py
+index 69b3e2d1f..95d387f46 100755
+--- a/build-scripts/verify_references.py
++++ b/build-scripts/verify_references.py
+@@ -179,7 +179,7 @@ def main():
+ check_content_refs = xccdftree.findall(".//{%s}check-content-ref"
+ % xccdf_ns)
+
+- xccdf_parent_map = dict((c, p) for p in xccdftree.getiterator() for c in p)
++ xccdf_parent_map = dict((c, p) for p in xccdftree.iter() for c in p)
+ # now we can actually do the verification work here
+ if options.rules_with_invalid_checks or options.all_checks:
+ for check_content_ref in check_content_refs:
+diff --git a/shared/transforms/pcidss/transform_benchmark_to_pcidss.py b/shared/transforms/pcidss/transform_benchmark_to_pcidss.py
+index 0ceaf727d..c94b12c45 100755
+--- a/shared/transforms/pcidss/transform_benchmark_to_pcidss.py
++++ b/shared/transforms/pcidss/transform_benchmark_to_pcidss.py
+@@ -111,7 +111,7 @@ def main():
+ benchmark.findall(".//{%s}Value" % (XCCDF_NAMESPACE)):
+ values.append(value)
+
+- parent_map = dict((c, p) for p in benchmark.getiterator() for c in p)
++ parent_map = dict((c, p) for p in benchmark.iter() for c in p)
+ for rule in \
+ benchmark.findall(".//{%s}Rule" % (XCCDF_NAMESPACE)):
+ parent_map[rule].remove(rule)
+--
+2.17.1
+
diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb
index f35d769..6e7180f 100644
--- a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb
+++ b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb
@@ -4,6 +4,9 @@
SRC_URI = "git://github.com/akuster/scap-security-guide.git;branch=oe-0.1.44; \
file://0001-Fix-XML-parsing-of-the-remediation-functions-file.patch \
file://0002-Fixed-the-broken-fix-when-greedy-regex-ate-the-whole.patch \
+ file://0001-fix-deprecated-instance-of-element.getchildren.patch \
+ file://0002-fix-deprecated-getiterator-function.patch \
+ file://0003-fix-remaining-getchildren-and-getiterator-functions.patch \
"
PV = "0.1.44+git${SRCPV}"
diff --git a/meta-security/recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch b/meta-security/recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch
index 6bf67e0..a84229e 100644
--- a/meta-security/recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch
+++ b/meta-security/recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch
@@ -10,11 +10,11 @@
configure.ac | 101 +++--------------------------------------------------------
1 file changed, 5 insertions(+), 96 deletions(-)
-diff --git a/configure.ac b/configure.ac
-index a224c68..f658d53 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1278,90 +1278,11 @@ AC_ARG_WITH(database,
+Index: samhain-4.4.2/configure.ac
+===================================================================
+--- samhain-4.4.2.orig/configure.ac
++++ samhain-4.4.2/configure.ac
+@@ -1290,90 +1290,11 @@ AC_ARG_WITH(database,
AC_DEFINE(WITH_POSTGRES)
AC_DEFINE(WITH_DATABASE)
#
@@ -110,7 +110,7 @@
LIBS="$LIBS -L${PGSQL_LIB_DIR} -lpq -lm"
if test x"$enable_static" = xyes; then
LIBS="$LIBS -L${PGSQL_LIB_DIR} -lpq -lcrypt -lm"
-@@ -1370,18 +1291,6 @@ AC_ARG_WITH(database,
+@@ -1382,18 +1303,6 @@ AC_ARG_WITH(database,
fi
# CFLAGS="$CFLAGS -I${PGSQL_INC_DIR}"
CPPFLAGS="$CPPFLAGS -I${PGSQL_INC_DIR}"
@@ -129,6 +129,3 @@
fi
elif test "x${withval}" = "xodbc"; then
AC_MSG_CHECKING(for odbc in /usr /usr/local ODBC_HOME)
---
-2.11.0
-
diff --git a/meta-security/recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch b/meta-security/recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch
index 8de0735..7e7f86e 100644
--- a/meta-security/recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch
+++ b/meta-security/recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch
@@ -14,29 +14,14 @@
Upstream-Status: Inappropriate [cross compile specific]
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
----
- aclocal.m4 | 2 +-
- configure.ac | 60 ++++++++++--------------------------------------------------
- 2 files changed, 11 insertions(+), 51 deletions(-)
+[AK: refactored for 4.4.3]
+Signed-off-by: Armin Kuster <akuster808@gmail.com>
-diff --git a/aclocal.m4 b/aclocal.m4
-index a2e59a6..cd20a2f 100644
---- a/aclocal.m4
-+++ b/aclocal.m4
-@@ -409,7 +409,7 @@ x_includes=NONE
- x_libraries=NONE
- DESTDIR=
- SH_ENABLE_OPTS="selinux posix-acl asm ssp db-reload xml-log message-queue login-watch process-check port-check mounts-check logfile-monitor userfiles debug ptrace static network udp nocl stealth micro-stealth install-name identity khide suidcheck base largefile mail external-scripts encrypt srp dnmalloc ipv6 shellexpand suid"
--SH_WITH_OPTS="prelude libprelude-prefix database libwrap cflags libs console altconsole timeserver alttimeserver rnd egd-socket port logserver altlogserver kcheck gpg keyid checksum fp recipient sender trusted tmp-dir config-file log-file pid-file state-dir data-file html-file"
-+SH_WITH_OPTS="prelude libprelude-prefix database libwrap cflags libs console altconsole timeserver alttimeserver rnd egd-socket port logserver altlogserver kcheck gpg keyid checksum fp recipient sender trusted tmp-dir config-file log-file pid-file state-dir data-file html-file ps-path"
-
- # Installation directory options.
- # These are left unexpanded so users can "make install exec_prefix=/foo"
-diff --git a/configure.ac b/configure.ac
-index 5910b1f..8c3e087 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -730,56 +730,16 @@ then
+Index: samhain-4.4.2/configure.ac
+===================================================================
+--- samhain-4.4.2.orig/configure.ac
++++ samhain-4.4.2/configure.ac
+@@ -743,56 +743,16 @@ then
fi
AC_CHECK_HEADERS(gmp.h)
@@ -55,7 +40,16 @@
- AC_MSG_ERROR([Cannot find ps in any of /usr/ucb /bin /usr/bin])
-fi
-AC_DEFINE_UNQUOTED([PSPATH], _("$PS"), [Path to ps])
--
++AC_ARG_WITH(ps-path,
++ [ --with-ps-path=PATH set path to ps command ],
++ [
++ if test "x${withval}" != xno; then
++ pspath="${withval}"
++ AC_DEFINE_UNQUOTED([PSPATH], _("${pspath}"), [Path to ps])
++ AC_DEFINE_UNQUOTED([PSARG], _("ax"), [Argument for ps])
++ fi
++ ])
+
-AC_MSG_CHECKING([how to use ps])
-$PS ax >/dev/null 2>&1
-if test $? -eq 0; then
@@ -90,19 +84,19 @@
- PSARG="-e"
-fi
-AC_DEFINE_UNQUOTED([PSARG], _("$PSARG"), [Argument for ps])
-+AC_ARG_WITH(ps-path,
-+ [ --with-ps-path=PATH set path to ps command ],
-+ [
-+ if test "x${withval}" != xno; then
-+ pspath="${withval}"
-+ AC_DEFINE_UNQUOTED([PSPATH], _("${pspath}"), [Path to ps])
-+ AC_DEFINE_UNQUOTED([PSARG], _("ax"), [Argument for ps])
-+ fi
-+ ])
-+
AC_MSG_RESULT([$PS $PSARG])
dnl *****************************************
---
-1.9.1
-
+Index: samhain-4.4.2/aclocal.m4
+===================================================================
+--- samhain-4.4.2.orig/aclocal.m4
++++ samhain-4.4.2/aclocal.m4
+@@ -409,7 +409,7 @@ x_includes=NONE
+ x_libraries=NONE
+ DESTDIR=
+ SH_ENABLE_OPTS="selinux posix-acl asm ssp db-reload xml-log message-queue login-watch process-check port-check mounts-check logfile-monitor userfiles debug ptrace static network udp nocl stealth micro-stealth install-name identity khide suidcheck base largefile mail external-scripts encrypt srp dnmalloc ipv6 shellexpand suid"
+-SH_WITH_OPTS="prelude libprelude-prefix database libwrap cflags libs console altconsole timeserver alttimeserver rnd egd-socket port logserver altlogserver signify pubkey-checksum gpg keyid checksum fp recipient sender trusted tmp-dir config-file log-file pid-file state-dir data-file html-file"
++SH_WITH_OPTS="prelude libprelude-prefix database libwrap cflags libs console altconsole timeserver alttimeserver rnd egd-socket port logserver altlogserver kcheck gpg keyid checksum fp recipient sender trusted tmp-dir config-file log-file pid-file state-dir data-file html-file ps-path"
+
+ # Installation directory options.
+ # These are left unexpanded so users can "make install exec_prefix=/foo"
diff --git a/meta-security/recipes-ids/samhain/samhain.inc b/meta-security/recipes-ids/samhain/samhain.inc
index b867bbc..3b4aab9 100644
--- a/meta-security/recipes-ids/samhain/samhain.inc
+++ b/meta-security/recipes-ids/samhain/samhain.inc
@@ -3,9 +3,12 @@
LICENSE = "GPLv2"
LIC_FILES_CHKSUM = "file://LICENSE;md5=8ca43cbc842c2336e835926c2166c28b"
-PV = "4.3.3"
+PV = "4.4.2"
-SRC_URI = "http://la-samhna.de/archive/samhain_signed-${PV}.tar.gz \
+SRC_URI = "https://la-samhna.de/archive/samhain_signed-${PV}.tar.gz \
+ file://${INITSCRIPT_NAME}.init \
+ file://${INITSCRIPT_NAME}.default \
+ file://samhain.service \
file://samhain-mips64-aarch64-dnmalloc-hash-fix.patch \
file://samhain-samhainrc.patch \
file://samhain-samhainrc-fix-files-dirs-path.patch \
@@ -15,13 +18,9 @@
file://samhain-avoid-searching-host-for-postgresql.patch \
file://samhain-add-LDFLAGS-variable-for-samhain_setpwd.patch \
file://fix-build-with-new-version-attr.patch \
- file://${INITSCRIPT_NAME}.init \
- file://${INITSCRIPT_NAME}.default \
- file://samhain.service \
"
-SRC_URI[md5sum] = "7be46ae7d03f53ba21afafd41cff8926"
-SRC_URI[sha256sum] = "33ad4bc3dad4699694553bd9635a6b5827939f965d1f0f05fce0b4e9cdadf21b"
+SRC_URI[sha256sum] = "2bb2750b32646be32517d0b2259402559c72b96979800f6c33774fcdea327fff"
UPSTREAM_CHECK_URI = "https://www.la-samhna.de/samhain/archive.html"
UPSTREAM_CHECK_REGEX = "samhain_signed-(?P<pver>(\d+(\.\d+)+))\.tar"
diff --git a/meta-security/recipes-ids/suricata/suricata_4.1.9.bb b/meta-security/recipes-ids/suricata/suricata_4.1.9.bb
index 135871c..3f7beaa 100644
--- a/meta-security/recipes-ids/suricata/suricata_4.1.9.bb
+++ b/meta-security/recipes-ids/suricata/suricata_4.1.9.bb
@@ -55,7 +55,7 @@
oe_runmake install-rules DESTDIR=${D}
install -d ${D}${sysconfdir}/suricata ${D}${sysconfdir}/default/volatiles
- install -m 0644 ${WORKDIR}/volatiles.03_suricata ${D}${sysconfdir}/default/volatiles/volatiles.03_suricata
+ install -m 0644 ${WORKDIR}/volatiles.03_suricata ${D}${sysconfdir}/default/volatiles/03_suricata
install -m 0644 ${S}/threshold.config ${D}${sysconfdir}/suricata
diff --git a/meta-security/recipes-scanners/clamav/clamav_0.101.5.bb b/meta-security/recipes-scanners/clamav/clamav_0.101.5.bb
index 47fbae4..7dad263 100644
--- a/meta-security/recipes-scanners/clamav/clamav_0.101.5.bb
+++ b/meta-security/recipes-scanners/clamav/clamav_0.101.5.bb
@@ -86,7 +86,7 @@
install -m 644 ${WORKDIR}/clamd.conf ${D}/${sysconfdir}
install -m 644 ${WORKDIR}/freshclam.conf ${D}/${sysconfdir}
- install -m 0644 ${WORKDIR}/volatiles.03_clamav ${D}${sysconfdir}/default/volatiles/volatiles.03_clamav
+ install -m 0644 ${WORKDIR}/volatiles.03_clamav ${D}${sysconfdir}/default/volatiles/03_clamav
sed -i -e 's#${STAGING_DIR_HOST}##g' ${D}${libdir}/pkgconfig/libclamav.pc
rm ${D}/${libdir}/libclamav.so
if [ "${INSTALL_CLAMAV_CVD}" = "1" ]; then