subtree updates
meta-openembedded: 64974b8779..c95842cdca:
Adrian Bunk (46):
modemmanager: Remove the obsolete dependency on dbus-glib
gpsd: Remove the obsolete dependency on dbus-glib
eggdbus: Remove this obsolete package
sanity-meta-gnome: Remove obsolete class
gssdp: Merge inc
vlc: notify switched to GTK+3 some time ago
tremor: Upgrade 20150107 -> 20180319
vlc: Remove the obsolete dependency on dbus-glib
blueman: Enable thunar support by default but don't rdepend on it
gnome-bluetooth: Drop bluez4 support
networkmanager: Drop bluez4 support
packagegroup-meta-networking-connectivity: Correct a DISTRO_FEATURES check
packagegroup-tools-bluetooth: Remove bluez4 support
cpprest: Fix build failure with gcc 8
packagegroup-basic: Remove bluez4 support
packagegroup-meta-oe: Remove bogus bluez4 DISTRO_FEATURES checks
esound: Remove this obsolete package
gpsd: Remove obsolete musl patch
gpsd: Don't build without optimization
zeromq: Upgrade 4.3.1 -> 4.3.2
obex-data-server: Drop bluez4 support
openobex: Drop bluez4 support
gpsd: Drop bluez4 support
libao: Remove the non-default esound PACKAGECONFIG
gpsd: Disable manpage building by config option instead of patching
gpsd: Upgrade 3.18.1 -> 3.19
gnome-desktop3: Fix REQUIRED_DISTRO_FEATURES
meta-gnome: Remove GNOME_COMPRESS_TYPE = "xz" in recipes
jasper: Use the new upstream GitHub location instead of the defunct tarball URL
fluidsynth: Add PACKAGECONFIG for readline
meta-multimedia: Remove GNOME_COMPRESS_TYPE = "xz" in recipes
udisks: Remove this obsolete version
gpsd: Switch from python-scons-native to python3-scons-native
meta-gnome: Inherit gnomebase instead of gnome
meta-oe: Inherit gnomebase instead of gnome
libgsf: Drop the obsolete inherit gconf
gnome-system-monitor: Add DEPENDS on polkit
meta-oe: Change some ftp:// URIs to http(s)://
meta-oe: Use GNU_MIRROR in more recipes
wireshark: Use an upstream URL that stays valid longer
modemmanager: Use a simpler workaround for the clang build
network-manager-applet: Remove obsolete do_configure_append
network-manager-applet: Remove the obsolete DEPENDS on gconf
wv: Remove, abiword was the only user
gtkmathview: Remove, abiword was the last user
t1lib: Remove, gtkmathview was the last user
Alex Kiernan (6):
keyutils: Fix build with usrmerge
iwd: update to 0.18
libzip: Upgrade 1.5.1 -> 1.5.2
zstd: New recipe
zstd: Update 1.4.0 -> 1.4.2
iwd: Upgrade 0.18 -> 0.19
Alexander Kanavin (3):
python-matplotlib: remove the python 2.x version of the recipe
python-oauthlib: remove the 2.x version of the recipe
python-pandas: remove the python 2.x version of the recipe
Alistair Francis (3):
gpsd: Upgrade from 3.17 to 3.18.1
gpsd: Fix the systemd service run paths
python: pypi: Add python3-term
Anatol Belski (1):
gperftools: separate off libtcmalloc-minimal
Andreas Müller (2):
meta-xfce: Make Kai Kang layer maintainer
abiword: remove
Andrej Valek (2):
nodejs: 10.15.3 -> 10.16.0
nodejs: 10.16.0 -> 10.16.2
André Draszik (1):
layer.conf: ignore wireless-regdb->crda dep for siggen purposes
Ankit Navik (1):
safec: Remove aarch64 from COMPATIBLE_HOST
Anuj Mittal (2):
xterm: upgrade 330 -> 347
libsdl: import from OE-Core
Armin Kuster (5):
keyutils: update to 1.6
keyutils: improve ptests
keyutils: fix QA WARNING
keyutils: fix pulling in glibc when musl enabled
keyutils: fix library install path
Arturo Buzarra (1):
lvm2: Fix RDEPEND on lvm2 to lvm2-udevrules
Ayoub Zaki (1):
pegtl: Initial recipe
Bartosz Golaszewski (2):
bats: new package
libgpiod: bump version to v1.4.1
Beniamin Sandu (1):
unbound: create recipe for version 1.9.2
Callaghan, Dan (1):
unixodbc: mysql5 is not required but readline is
Changqing Li (15):
python-pygobject: fix install dir for python2
dlm: upgrade 4.0.7 -> 4.0.9
uthash: remove uthash-ptest dependencies
waf-samba: switch to python3
libtevent: upgrade 0.9.37 -> 0.10.0
libtdb: upgrade 1.3.17 -> 1.4.0
libtalloc: upgrade 2.1.14 -> 2.2.0
samba: upgrade 4.8.12 -> 4.10.5
libldb: upgrade 1.4.1 -> 1.5.4
volume-key: fix "Nothing RPROVIDES" when multilib enabled
isomd5sum: fix "Nothing RPROVIDES" when multilib enabled
satyr: fix "Nothing RPROVIDES" when multilib enabled
libtevent: fix do_package_qa issue
libtdb: fix do_package_qa issue
fio: Delete redundant tag
Chin Huat Ang (1):
opencv: 3.4.5 -> 4.1.0
Denys Dmytriyenko (1):
ufs-tool: add tool to access UFS (Universal Flash Storage) devices
Douglas Royds (2):
grpc: DEPENDS on googletest
packagegroup-meta-oe: RDEPENDS on googletest
Drew Moseley (1):
networkmanager: Use ALTERNATIVES for resolv-conf handling.
Erik Botö (1):
paho-mqtt-c: enable SSL
Fabian Klemp (1):
openvpn: respect pid file in init.d service start
Gianfranco Costamagna (3):
iniparser: add initial recipe
cpprest: update to 2.10.14
cpprest: Do not export Werror from build system instead of adding -Wno-error to the same build command
He Zhe (1):
drbd-utils: Fix netlink failure with nested attributes for kernel v5.2
Hongxu Jia (24):
packagegroup-xfce-extended: conditional runtime recommends on xfce-polkit
xfce-polkit: add required distro feature check to polkit
xfce4-session: optional support polkit
upower: remove polkit dependency
gvfs: add meson option admin and udisks2 to PACKAGECONFIG
mongodb: add to PNBLACKLIST
itstool: use libxml2 to instead of python3-lxml
meta-multimedia: add layer depends on meta-python
itstool: use libxml2 to instead of python3-lxml
python-six: remove duplicated recipe
libauthen-radius-perl: ptest requires meta-networking to be present
xfce4-panel: use lxdm to replace dm-tool
drop lxdm_%.bbappend
python3-pykickstart: 3.18 -> 3.20
python3-blivet: 3.1.2 -> 3.1.4
python-pyparted/python3-pyparted: 3.11.1 -> 3.11.2
libbytesize: 1.4 -> 2.0
libblockdev: 2.20 -> 2.22
network-manager-applet: 1.8.20 -> 1.8.22
thin-provisioning-tools: 0.7.6 -> 0.8.5
libreport: 2.9.7 -> 2.10.0
python3-blivetgui: fix blivet-gui broken
php: remove 5.6.40
lmsensors: support package lmsensors
Jackie Huang (1):
keyutils: add new recipe
Jason Wessel (1):
libbytesize: Add depends for gettext-native
Joshua Lock (3):
python-cffi: add missing RDEPENDS on pycparser
python-attrs: add native BBCLASSEXTEND
python-dateutil: add native BBCLASSEXTEND
Kai Kang (39):
mozjs: fix configure failure on CentOS 7.6
libvncserver: update to latest commit 1354f7f
libxfce4util: 4.13.3 -> 4.13.4
libxfce4ui: 4.13.5 -> 4.13.6
exo: 0.12.5 -> 0.12.6
xfconf: 4.13.7 -> 4.13.8
thunar: 1.8.6 -> 1.8.7
xfce4-session: 4.13.2 -> 4.13.3
xfwm4: 4.13.2 -> 4.13.3
xfdesktop: 4.13.4 -> 4.13.5
xfce4-power-manager: 1.6.2 -> 1.6.3
xfce4-panel: 4.13.5 -> 4.13.6
xfce4-dev-tools: 4.12.0 -> 4.13.0
thunar-volman: 0.9.2 -> 0.9.3
garcon: 0.6.2 -> 0.6.3
xfce4-settings: 4.12.4 -> 4.13.7
xfce4-pulseaudio-plugin: add dependency dbus-glib
xfce4-verve-plugin: 1.1.0 -> 2.0.0
net-snmp: update SRC_URI
xfwm4: fix assertion error
poppler: toggle gobject-introspection support
xfce4-settings: rrecommends xfce4-datetime-setter
xfce4-datetime-setter: add recipe
libxfce4util: 4.13.4 -> 4.14.0
xfconf: 4.13.8 -> 4.14.1
libxfce4ui: 4.13.6 -> 4.14.1
exo: 0.12.6 -> 0.12.8
garcon: 0.6.3 -> 0.6.4
thunar: 1.8.7 -> 1.8.9
thunar-volman: 0.9.3 -> 0.9.5
tumbler: 0.2.0 -> 0.2.7
xfce4-appfinder: 4.13.3 -> 4.14.0
xfce4-dev-tools: 4.13.0 -> 4.14.0
xfce4-panel: 4.13.6 -> 4.14.0
xfce4-power-manager: 1.6.3 -> 1.6.5
xfce4-session: 4.13.3 -> 4.14.0
xfce4-settings: 4.13.7 -> 4.14.0
xfdesktop: 4.13.5 -> 4.14.1
xfwm4: 4.13.3 -> 4.14.0
Khem Raj (44):
wvdial: Fix build with musl
librelp: Pass Wno-error to compiler
recipes: Use BPN instead of PN in SRC_URIs
cli11: Refresh patch to fix fuzz
sthttpd: Use git SRC_URI instead of github archive
arno-iptables-firewall: Switch to git fetcher
firewalld: Update to 0.6.3->0.6.4
python-matplotlib: Use git src_uri
mpv: Switch to using git fetcher
x11vnc: Switch to git fetcher
dumb-init: Switch to git fetcher
pam-plugin-ldapdb: Use git fetcher
libuv: Switch to using git fetcher
usbctl: Switch to git fetcher
pmdk: Fix libdir which is multi-lib aware
kexec-tools-klibc: Refresh patch with no code change
log4cplus: Fix build with gold linker
orage: Fix build with libical3
pegtl: Fix build with clang/libc++
postfix: Fix build failures with glibc 2.30
snort: Fix build with glibc 2.30
opensaf: Add configure time check to detect gettid API in libc
ypbind-mt: Fix build with glibc 2.30
openocd: Fix build with glibc 2.30
netkit-rusers: Add dep on rpcsvc-proto for rpc headers
collectd: Fix build with glibc 2.30
alsa-oss: Drop now not needed patch
klcc-cross: Recognise --unwindlib clang option
libsub-exporter-progressive-perl: Remove unneeded DEPENDS_PN
libedit: Delete
sjf2410-linux-native: Do not include sys/io.h
gradm: Upgrade to 3.1-201903191516 release
pmdk: Fix packaging errors when building on non-x86 host
klibc: Pass -fno-builtin-bcmp with musl/clang combo
graphviz: Fix build error that surfaced with latest pango
graphviz: Do not build tcl support for target
python-grpcio: Use gettid API from glibc 2.30+
grpc: Update to 1.22.0
android-tools: Fix build with glibc 2.30
iperf2: Upgrade to 2.0.13
netkit-rusers: Depend on rpcsvc-proto-native for rpcgen tool
kpatch: Pass ARCH from environment
python3-pillow: Provide python3-imaging
netkit-rusers: Fix cross-build after glibc dropped rpc
Laszlo Toth (1):
networkmanager: fix typo in nonarch_base_libdir
Liwei Song (2):
pm-graph: fix time format parse error
fio: fix first direct IO errored when ioengine is splice
Luca Boccassi (2):
python-pygobject: move python-setuptools from RDEPENDS to DEPENDS
python-pygobject: remove build-dependency on setuptools and add dependency on pkgutil
Luca Ceresoli (4):
fuse-exfat: moved to github
exfat-utils: moved to github
fuse-exfat: update 1.2.3 -> 1.3.0
exfat-utils: update 1.2.3 -> 1.3.0
Luca Palano (1):
Netdata upgrade: 1.8.0 -> 1.16.0
Maciej Pijanowski (8):
python3-websockets: upgrade to 8.0.2
python3-multidict: upgrade to 4.5.2
python-engineio: upgrade to 3.9.3
python-socketio: upgrade to 4.3.1
python-aiohttp.inc: add missing RDEPENDS
python-async-timeout: add asyncio to RDEPENDS
python-socketio.inc: add missing RDEPENDS
python3-aiofiles: add recipe
Mariano Lopez (1):
nftables: 0.9.0 > 0.9.1
Martin Jansa (8):
protobuf: fix build with gold
SIGGEN_EXCLUDE_SAFE_RECIPE_DEPS add lsb and util-linux for phoronix-test-suite
oprofile: drop kernel-vmlinux from RRECOMMENDS
libdbi-perl: prevent native libdbi-perl depending on target perl
redis: backport a fix for stack trace generation on aarch64
ntop: fix missing return from non-void function
python3-twofish: Fix missing return statements in module stubs
kernel-selftest: skip -Werror=format-security and fortify
Max Krummenacher (1):
joe: update to 4.6
Mikko Rapeli (2):
protobuf: fix ptest compilation with hardening flags
stress-ng: delete recipe
Mingli Yu (7):
fio: Upgrade to 3.15
crash: Upgrade to 7.2.6
makedumpfile: Upgrade to 1.6.6
hwloc: Upgrade to 1.11.13
iperf3: Upgrade to 3.7
log4cplus: Upgrade to 2.0.4
log4cplus: remove gold linker setting
Oleksandr Kravchuk (22):
nghttp2: update to 1.39.1
drbd-utils: update to 9.10.0
drbd: update to 9.0.18-1
keepalived: update to 2.0.16
nano: update to 4.3
nuttcp: add systemd unit file
mbedtls: update to 2.16.2
dhcpcd: update to 7.2.2
freediameter: update to 1.2.1
sethdlc: set PV in filename
miniupnpd: update to 2.1.20190210
ipvsadm: update to 1.30
uftp: update to 4.9.11
libnftnl: update to 1.1.3
dhcpcd: update to 7.2.3
blueman: update to 2.1.1
uftp: update to 4.10
htpdate: update to 1.2.1
dhcpcd: update to 8.0.1
chrony: update to 3.5
wolfssl: update to 4.1.0
dhcpcd: update to 8.0.2
Ovidiu Panait (2):
python3-pillow: 5.4.1 -> 6.1
python3-pillow: Add python3-misc/logging/numbers to RDEPENDS
Paolo Valente (1):
s-suite: push SRCREV to version 3.5
Parthiban Nallathambi (1):
python3-matplotlib: add version 3.1.1
Pascal Bach (1):
protobuf: 1.3.1 -> 1.3.2
Paul Eggleton (3):
mraa: update to 2.0.0
upm: update to 2.0.0
picocom: update to 3.1
Pierre-Jean Texier (2):
stunnel: bump to version 5.55
cppzmq: bump to version 4.4.1
Piotr Tworek (1):
itstool: Don't use hardcoded, absolute path to python3 binary.
Qi.Chen@windriver.com (3):
turbostat: set PACKAGE_ARCH as MACHINE_ARCH
esmtp: use alternatives to manage /usr/lib/sendmail
postfix: use alternatives to manage /usr/lib/sendmail
Radovan Scasny (2):
dhcpcd: enable udev by default
dhcpcd: fix building with pkgconfig
Randy MacLeod (2):
poppler: update from 0.75.0 to 0.79.0
rsyslog: update from 8.1903.0 to 8.1907.0
Ricardo Ribalda Delgado (1):
fwts: Update to 19.06.00
Robert Joslyn (1):
cryptsetup: Don't enable udev for native build
Roman Stratiienko (1):
glmark2: Upgrade SRCREV to latest
Ross Burton (2):
gtk+: add (from oe-core)
gnome-themes-standard: add recipe for GTK+ 2 Adwaita
Ruslan Bilovol (2):
libnss-nisplus: Add recipe
kpatch: fix QA build errors for nativesdk
Saravanan Sekar (1):
liblightmodbus: Add version 2.0.2
Scott Ellis (1):
wireguard: Upgrade 20190406 to 20190702
Slater, Joseph (3):
drbd-utils: enable reproducible_build awareness
php: remove host specific info from header file
mozjs: do not expose intl api for mips64
Tim Orling (9):
libencode-perl: upgrade 2.94 -> 3.01; enable ptest
libdbi-perl: fix dependencies
libtest-nowarnings-perl: add recipe for 1.04
libdbd-sqlite-perl: upgrade 1.54 -> 1.62; enable ptest
libsub-uplevel-perl: add recipe for 0.36
libtest-warn-perl: add recipe for 0.36
libcgi-perl: upgrade 4.43 -> 4.44
libnet-ldap-perl: upgrade 0.65 -> 0.66; enable ptest
libunicode-linebreak-perl: upgrade 2017.004 -> 2019.001; enable ptest
Trevor Gamblin (2):
metacity; upgrade from 3.30.1 to 3.32.0
gvfs: upgrade from 1.40.0 to 1.40.2
Vincent Prince (1):
mongodb: add mongo shell as a PACKAGECONF option
William A. Kennington III via Openembedded-devel (5):
gtest: Googletest project is back under github.com/google/googletest
googletest: The gtest and gmock projects were combined under googletest in 2015
libtar: Enable libtar-native build
fmt: Init at 5.3.0
cli11: 1.7.1 -> 1.8.0
Windel Bouwman (3):
python-humanfriendly: Add recipe for the humanfriendly package.
Fix python-humanfriendly recipe for python2.
Add recipe for the coloredlogs python package.
Yi Zhao (7):
strongswan: upgrade 5.7.1 -> 5.8.0
snort: fix compile-host-path QA issue
cryptsetup: set the default luks format to LUKS1
libldb: upgrade 1.5.4 -> 1.5.5
samba: upgrade 4.10.5 -> 4.10.6
snort: upgrade 2.9.13 -> 2.9.14
snort: upgrade 2.9.14 -> 2.9.14.1
Yong, Jonathan (1):
icewm: add recipe
Yongxin Liu (3):
keyutils: move recipe and patches from meta-security to meta-oe
ndctl: v63 -> v65
pmdk: update from 1.4.2 to 1.6
Yuan Chao (9):
python-pycodestyle: upgrade 2.4.0 -> 2.5.0
python-lxml: upgrade 4.3.4 -> 4.4.0
python-configparser: upgrade 3.5.0 -> 3.7.4
protobuf: upgrade 3.9.0 -> 3.9.1
python-markupsafe: upgrade 1.0 -> 1.1.1
hostapd: upgrade 2.8 -> 2.9
python-configparser: upgrade 3.7.4 -> 3.8.1
python-lxml: upgrade 4.4.0 -> 4.4.1
python-pip: upgrade 19.2.1 -> 19.2.2
Zang Ruochen (47):
postgresql: upgrade 11.3 -> 11.4
wireshark: upgrade 3.0.1 -> 3.0.2
python-pygobject: upgrade 3.32.1 -> 3.32.2
python-alembic: upgrade 1.0.10 -> 1.0.11
logwatch: upgrade 7.4.3 -> 7.5.1
tcsh: upgrade 6.20.00 -> 6.21.00
python-cython: upgrade 0.29.10 -> 0.29.11
dialog: upgrade 1.3-20180621 -> 1.3-20190211
php: upgrade 7.3.6 -> 7.3.7
sessreg: upgrade 1.1.1 -> 1.1.2
python-typing: upgrade 3.6.6 -> 3.7.4
python-mako: upgrade 1.0.12 -> 1.0.13
python-pbr: upgrade 5.2.1 -> 5.4.0
python-cython: upgrade 0.29.11 -> 0.29.12
adcli: added new recipe.
python-pyflakes: upgrade 1.6.0 -> 2.1.1
python-protobuf: upgrade 3.8.0 -> 3.9.0
protobuf: upgrade 3.8.0 -> 3.9.0
setxkbmap: upgrade 1.3.1 -> 1.3.2
uftrace: upgrade 0.9.2 -> 0.9.3
wireshark: upgrade 3.0.2 -> 3.0.3
python-pbr: upgrade 5.4.0 -> 5.4.1
dstat: upgrade 0.7.3 -> 0.7.4
python-mako: upgrade 1.0.13 -> 1.0.14
xfsprogs: upgrade 5.0.0 -> 5.1.0
python-beautifulsoup4: upgrade 4.7.1 -> 4.8.0
xterm: upgrade 347 -> 348
python-pip: upgrade 19.1.1 -> 19.2.1
python-paste: upgrade 3.0.8 -> 3.1.0
syslog-ng: append syslog-ng.service
dialog: upgrade 1.3-20190211 -> 1.3-20190728
openldap: upgrade 2.4.47 -> 2.4.48
python-cython: upgrade 0.29.12 -> 0.29.13
libsodium: upgrade 1.0.17 -> 1.0.18
hwdata: upgrade 0.322 -> 0.326
python-jsonpatch: upgrade 1.23 -> 1.24
python-pyasn1: upgrade 0.4.5 -> 0.4.6
python-pyasn1-modules: upgrade 0.2.2 -> 0.2.6
python-pyparsing: upgrade 2.4.0 -> 2.4.2
python-pytest-runner: upgrade 4.2 -> 5.1
python-pytz: upgrade 2019.1 -> 2019.2
itstool: upgrade 2.0.5 -> 2.0.6
opensaf: upgrade 5.19.03 -> 5.19.07
libkcapi: upgrade 1.1.4 -> 1.1.5
mcelog: upgrade 162 -> 164
php: upgrade 7.3.7 -> 7.3.8
kpatch: upgrade 0.61 -> 0.71
Zheng Ruoqin (3):
python-mako: upgrade 1.0.14 -> 1.1.0
python-pbr: upgrade 5.4.1 -> 5.4.2
dnf-plugin-tui: new recipe
wouterlucas (1):
python-jsonref: add recipe
meta-phosphor: fbd01b6e08..fe8cee7488:
Brad Bishop (1):
meta-phosphor: sdk: react to upstream gtest rename
meta-xilinx: 64aa3d35ae..f3c8b1c9a8:
Alejandro Enedino Hernandez Samaniego (7):
opencl-clhpp: Allow empty packages to be built
opencl-headers: Allow empty packages to be built
gcc-8: rebase microblaze patches for gcc 8.2.0
gcc8: update microblaze patches
gcc: update microblaze patches
update gcc-8 patches
gcc: Remove xilinx.ld requirement
Jaewon Lee (6):
zc1254-zynqmp.conf: Add support for zc1254 evaluation board
zc1275-zynqmp.conf: Add support for zc1275 evaluation board
zcu102-zynqmp.conf: Changing qemu boot mode
Adding FPGA_MNGR_RECONFIG_ENABLE to control enabling fpga manager
gcc: Removing already upstreamed patch
Rebasing binutils patches from 2.31 to 2.32
Madhurkiran Harikrishnan (2):
kernel-module-mali: Fix errors associated with kernel upgrade to 4.19
xf86-video-armsoc: Remove the recipe for xf86-video-armsoc
Manjukumar Matha (10):
libmali-xlnx_git.bb: Fix the package arch for libmali
zcu111-zynqmp.conf: Add support for ZCU111 evaluation board
qemu-system-aarch64-multiarch: Enable plm argument in runqemu
arm-trusted-firmware.inc: Add support to build ATF for versal devices
linux-xlnx.inc: Add support to build kernel for versal devices
linux-xlnx.inc: Use KBUILD_DEFCONFIG in externalsrc mode if defined
kernel-simpleimage.bbclass: Use dts for simpleImage generation for Microblaze
kernel-simpleimage.bbclass: Deploy simpleImage unstrip file
kernel-simpleimage.bbclass: Deploy simpleImage strip
binutils%.bbappend: Update Microblaze binutils patches to v2.31
Min Ma (4):
ocl-icd_git.bb: Add recipe for OpenCL ICD loaders
opencl-clhpp_git.bb: Recipe for OpenCL Host API C++ bindings
zocl: Recipe for Xilinx runtime driver module
xrt: Xilinx Runtime User Space Libraries and headers
Sai Hari Chandana Kalluri (1):
xilinx-testimage.bbclass: Include IMAGE_AUTOLOGIN and IMAGE_FSTYPES values for runqemu
Sreeja Vadakattu (1):
machine-xilinx-default.inc: Make u-boot.elf as UBOOT_ELF for zynq
Vineeth Chowdary Karumanchi (1):
tune-zynq.inc: Build zImage in addition to uImage
meta-security: c28b72e91d..ecb526ffab:
Armin Kuster (34):
linux-bbappends: simplify
layers: set warrior only
security-test-image: add a testing image
runtime: clamav test cleanup
packagegroup-core-security: cleanup and remove ptest
test-image: add packagegroup-core-security-ptest
test-image: add a few more packages to image
ima-evm-utils: update to tip
runtime: tpm2 fix names in packagecheck
tpm2 images: create tpm2 image and fix packagegroup
tpm image: split out tpm2
tpm2-pkcs11/tpm2-pkcs11: update to tip
tpm2-tcti-uefi: update to tip
tpm2-tools: update to 3.2.0
tpm2-tss: update to 2.2.3
tpm2-totp: update to offical release v0.1.1
tpm2-tss-engine: update to 1.0.0
libmspack: update SRC_URI and package
clamav: minor recipe cleanup
lynis: update to 2.7.5
meta-security-compliance: update README
openscap_git: update to 1.3.0
openscap: add 1.3.1 recipes for upstream source
scap-security-guide: update to 0.1.44
meta-security-compliance: add meta-python
libldb: remove recipe
waf-cross-answers: remove files
samhain: update to 4.3.3
keyutils: remove from meta-security
linux-%: remove kernel fragments now in cache
meta-integrity: remove kernel fragments now in cache
linux-stable/5.2: add stable bbappend
linux-yocto: use 4.19 kernel cache now
linux-yocto-dev: update to use kernel cache
Dmitry Eremin-Solenikov (11):
packagegroup-security-tpm2: stop including tpm2-tcti-uefi
tpm2-tss: fix compilation when using updated AX_CODE_COVERAGE macro
tpm2-tcti-uefi: add autoconf-archive-native dependency
tpm2-tcti-uefi: fix configure arguments
tpm2-tcti-uefi: stop inserting host directories into build path
tpm2-tcti-uefi: build and install examples
meta-integrity: rename IMA_EVM_BASE to INTEGRITY_BASE
ima-evm-utils: bump to release 1.2.1
kernel-modsign.bbclass: add support for kernel modules signing
linux: add support for kernel modules signing
layer.conf: switch to keyutils from meta-oe
He Zhe (1):
kernel: Add conditional inclusion of fragments for linux-yocto-dev
Mark Asselstine (1):
openscap/scap-security-guide: use _git instead of versioned filenames
Yi Zhao (5):
openscap: update recipe
scap-security-guide: update recipe
openscap: cleanup DEPENDS
scap-security-guide: fix typo
xmlsec1: upgrade 1.2.27 -> 1.2.28
lumag (3):
layer.conf: add dependency on meta-security
ima-evm-utils: bump version
ima-evm-utils: refresh xattr patch
meta-raspberrypi: 8636b63752..b112816e95:
Andrei Gherzan (46):
rpi-base.inc: Include rpi4 dtb
raspberrypi3.conf: Clarify machine mode
linux-raspberrypi: Include configuration for RaspberryPi3 defconfig
linux-raspberrypi: Update 4.19 kernel to 4.19.56
rpi-base: Rename the rpi0w dtb
firmware: Update to 20190620
raspberrypi4.conf: Add initial machine 32 bit configuration
linux-firmware-rpidistro: Fix WiFi on RaspberryPi 4
rpi-base.inc: Include the "fake" KMS dtbo
raspberrypi4: Use vc4-fkms-v3d
linux-raspberrypi: Bump 4.19 revision to fix RPi 4 arm64 builds
raspberrypi4-64.conf: Introduce RPi arm64 machine
firmware: Rename firmware inc file to raspberrypi-firmware.inc
armstubs: Add support for compiling ARM stubs
rpi-config: Handle ARMSTUB
sdcard_image-rpi.bbclass: Include in the SD card image the armstub file
raspberrypi4-64.conf: Initial machine configuration
raspberrypi-tools: Update to remove Makefile patch
linux-raspberrypi: Fix defconfig for RPi4-64
linux-raspberrypi.inc: Explicitly set defconfig for raspberrypi4-64
sdcard_image-rpi.bbclass: Fix typo
linux-raspberrypi: Bump 4.19 revision to have proper coherent_pool set
raspberrypi4-64.conf: Define a machine feature for armstubs
sdcard_image-rpi.bbclass: Use armstub machine feature
linux-raspberrypi: Bump 4.19.57 revision
raspberrypi4.conf: Define uboot defconfig
raspberrypi4-64.conf: Uboot configuration and drop armstub
u-boot: Use a temporary fork for RPi4 support
raspberrypi-firmware: Update to 20190709
raspberrypi4.conf: The firmware uses kernel7l.img when LPAE is supported
linux-raspberrypi: Bump 4.19 to 4.19.58
linux-raspberrypi: Build dtbs with dtbs make target for all 64bit targets
linux-raspberrypi: Bump 4.19 revision
raspberrypi4-64.conf: Remove memory limitation
u-boot: Replace custom fork by patches
u-boot: Update patches for RPi4
rpi-config: Check for armstub based on machine feature
sdcard_image-rpi: Check for armstub based on machine feature
armstubs: Error out when ARMSTUBS is not defined
raspberrypi*: Define ARMSTUB for all machines
raspberrypi4-64.conf: Limit RAM to 3G
README.md: Use matrix chat room
raspberrypi-firmware.inc: Update to 20190718
linux-raspberrypi: Update 4.19 recipe to 4.19.66
mesa: Add v3d and kmsro driver as well
raspberrypi4-64: Remove the 3G RAM limitation
Carton (2):
bluez5: Fixed typo (RC_URI -> SRC_URI)
rpi-config: Check some config values against "1"
Francesco Giancane (1):
linux-raspberrypi: update to 4.14.114
Khem Raj (8):
linux-raspberrypi: Upgrade to 4.19.57
userland: Upgrade to latest
webkitgtk: Remove -DUSE_GSTREAMER_GL=OFF for vc4graphics
layer.conf: Add meta-networking to dynamic layers
drbd: Disable for rpi machines
packagegroup-rpi-test: Depend on wireless-regdb instead of crda
xorg-xserver: Adapt bbappend to latest OE-core
python-rtimu,python-sense-hat: Convert to py3 modules
Kirill Goncharov (1):
omxplayer: Bump revision
Martin Jansa (1):
sdcard_image-rpi.bbclass: use -v for all mcopy calls and add bbfatal in case mcopy fails
Riyaz (1):
rpi-base.inc: Enabling open-source vc4graphics driver for all RPI platforms
Change-Id: I9e37b5952a2e2e30745275fc89e4dd7c47b851e2
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
diff --git a/meta-security/conf/layer.conf b/meta-security/conf/layer.conf
index 4beac38..b9a4f25 100644
--- a/meta-security/conf/layer.conf
+++ b/meta-security/conf/layer.conf
@@ -9,8 +9,6 @@
BBFILE_PATTERN_security = "^${LAYERDIR}/"
BBFILE_PRIORITY_security = "8"
-LAYERSERIES_COMPAT_security = "thud warrior"
+LAYERSERIES_COMPAT_security = "warrior"
LAYERDEPENDS_security = "core openembedded-layer perl-layer networking-layer meta-python"
-
-DEFAULT_TEST_SUITES_pn-security-build-image = " ping ssh ptest"
diff --git a/meta-security/files/waf-cross-answers/README b/meta-security/files/waf-cross-answers/README
deleted file mode 100644
index dda45c5..0000000
--- a/meta-security/files/waf-cross-answers/README
+++ /dev/null
@@ -1,3 +0,0 @@
-The files in this directory are cross answers files
-used by waf-samba.bbclass, please see waf-samba.bbclass
-for details about how they are used.
diff --git a/meta-security/files/waf-cross-answers/cross-answers-aarch64.txt b/meta-security/files/waf-cross-answers/cross-answers-aarch64.txt
deleted file mode 100644
index 1023f6a..0000000
--- a/meta-security/files/waf-cross-answers/cross-answers-aarch64.txt
+++ /dev/null
@@ -1,39 +0,0 @@
-Checking uname sysname type: "Linux"
-Checking uname version type: "# Wed May 20 10:34:39 UTC 2015"
-Checking simple C program: "hello world"
-rpath library support: OK
--Wl,--version-script support: OK
-Checking getconf LFS_CFLAGS: NO
-Checking correct behavior of strtoll: NO
-Checking for working strptime: OK
-Checking for C99 vsnprintf: "1"
-Checking for HAVE_SHARED_MMAP: OK
-Checking for HAVE_MREMAP: OK
-Checking for HAVE_SECURE_MKSTEMP: OK
-Checking for HAVE_IFACE_GETIFADDRS: NO
-Checking for HAVE_IFACE_IFCONF: NO
-Checking for HAVE_IFACE_IFREQ: NO
-Checking for large file support without additional flags: OK
-Checking for HAVE_INCOHERENT_MMAP: NO
-Checking value of NSIG: "65"
-Checking value of _NSIG: "65"
-Checking value of SIGRTMAX: "64"
-Checking value of SIGRTMIN: "34"
-Checking whether the WRFILE -keytab is supported: OK
-Checking for kernel change notify support: OK
-Checking for Linux kernel oplocks: OK
-Checking for kernel share modes: OK
-Checking whether POSIX capabilities are available: OK
-Checking if can we convert from CP850 to UCS-2LE: OK
-Checking if can we convert from UTF-8 to UCS-2LE: OK
-vfs_fileid checking for statfs() and struct statfs.f_fsid: OK
-Checking whether we can use Linux thread-specific credentials: OK
-Checking whether fcntl locking is available: OK
-Checking for the maximum value of the 'time_t' type: OK
-Checking whether the realpath function allows a NULL argument: OK
-Checking for ftruncate extend: OK
-getcwd takes a NULL argument: OK
-Checking for small off_t: NO
-Checking whether blkcnt_t is 32 bit: NO
-Checking whether blkcnt_t is 64 bit: OK
-Checking whether fcntl lock supports open file description locks: OK
diff --git a/meta-security/files/waf-cross-answers/cross-answers-aarch64_be.txt b/meta-security/files/waf-cross-answers/cross-answers-aarch64_be.txt
deleted file mode 100644
index 1023f6a..0000000
--- a/meta-security/files/waf-cross-answers/cross-answers-aarch64_be.txt
+++ /dev/null
@@ -1,39 +0,0 @@
-Checking uname sysname type: "Linux"
-Checking uname version type: "# Wed May 20 10:34:39 UTC 2015"
-Checking simple C program: "hello world"
-rpath library support: OK
--Wl,--version-script support: OK
-Checking getconf LFS_CFLAGS: NO
-Checking correct behavior of strtoll: NO
-Checking for working strptime: OK
-Checking for C99 vsnprintf: "1"
-Checking for HAVE_SHARED_MMAP: OK
-Checking for HAVE_MREMAP: OK
-Checking for HAVE_SECURE_MKSTEMP: OK
-Checking for HAVE_IFACE_GETIFADDRS: NO
-Checking for HAVE_IFACE_IFCONF: NO
-Checking for HAVE_IFACE_IFREQ: NO
-Checking for large file support without additional flags: OK
-Checking for HAVE_INCOHERENT_MMAP: NO
-Checking value of NSIG: "65"
-Checking value of _NSIG: "65"
-Checking value of SIGRTMAX: "64"
-Checking value of SIGRTMIN: "34"
-Checking whether the WRFILE -keytab is supported: OK
-Checking for kernel change notify support: OK
-Checking for Linux kernel oplocks: OK
-Checking for kernel share modes: OK
-Checking whether POSIX capabilities are available: OK
-Checking if can we convert from CP850 to UCS-2LE: OK
-Checking if can we convert from UTF-8 to UCS-2LE: OK
-vfs_fileid checking for statfs() and struct statfs.f_fsid: OK
-Checking whether we can use Linux thread-specific credentials: OK
-Checking whether fcntl locking is available: OK
-Checking for the maximum value of the 'time_t' type: OK
-Checking whether the realpath function allows a NULL argument: OK
-Checking for ftruncate extend: OK
-getcwd takes a NULL argument: OK
-Checking for small off_t: NO
-Checking whether blkcnt_t is 32 bit: NO
-Checking whether blkcnt_t is 64 bit: OK
-Checking whether fcntl lock supports open file description locks: OK
diff --git a/meta-security/files/waf-cross-answers/cross-answers-arm.txt b/meta-security/files/waf-cross-answers/cross-answers-arm.txt
deleted file mode 100644
index a5cd998..0000000
--- a/meta-security/files/waf-cross-answers/cross-answers-arm.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Checking uname sysname type: "Linux"
-Checking uname version type: "# Wed May 20 10:34:39 UTC 2015"
-Checking simple C program: "hello world"
-rpath library support: OK
--Wl,--version-script support: OK
-Checking getconf LFS_CFLAGS: NO
-Checking correct behavior of strtoll: NO
-Checking for working strptime: OK
-Checking for C99 vsnprintf: "1"
-Checking for HAVE_SHARED_MMAP: OK
-Checking for HAVE_MREMAP: OK
-Checking for HAVE_SECURE_MKSTEMP: OK
-Checking for HAVE_IFACE_GETIFADDRS: NO
-Checking for HAVE_IFACE_IFCONF: NO
-Checking for HAVE_IFACE_IFREQ: NO
-Checking for large file support without additional flags: NO
-Checking for -D_FILE_OFFSET_BITS=64: OK
-Checking for HAVE_INCOHERENT_MMAP: NO
-Checking value of NSIG: "65"
-Checking value of _NSIG: "65"
-Checking value of SIGRTMAX: "64"
-Checking value of SIGRTMIN: "34"
-Checking whether the WRFILE -keytab is supported: OK
-Checking for kernel change notify support: OK
-Checking for Linux kernel oplocks: OK
-Checking for kernel share modes: OK
-Checking whether POSIX capabilities are available: OK
-Checking if can we convert from CP850 to UCS-2LE: OK
-Checking if can we convert from UTF-8 to UCS-2LE: OK
-vfs_fileid checking for statfs() and struct statfs.f_fsid: OK
-Checking whether we can use Linux thread-specific credentials with 32-bit system calls: OK
-Checking whether fcntl locking is available: OK
-Checking for the maximum value of the 'time_t' type: NO
-Checking whether the realpath function allows a NULL argument: OK
-Checking for ftruncate extend: OK
-getcwd takes a NULL argument: OK
-Checking for small off_t: NO
-Checking whether blkcnt_t is 32 bit: NO
-Checking whether blkcnt_t is 64 bit: OK
-Checking whether fcntl lock supports open file description locks: OK
diff --git a/meta-security/files/waf-cross-answers/cross-answers-armeb.txt b/meta-security/files/waf-cross-answers/cross-answers-armeb.txt
deleted file mode 100644
index a5cd998..0000000
--- a/meta-security/files/waf-cross-answers/cross-answers-armeb.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Checking uname sysname type: "Linux"
-Checking uname version type: "# Wed May 20 10:34:39 UTC 2015"
-Checking simple C program: "hello world"
-rpath library support: OK
--Wl,--version-script support: OK
-Checking getconf LFS_CFLAGS: NO
-Checking correct behavior of strtoll: NO
-Checking for working strptime: OK
-Checking for C99 vsnprintf: "1"
-Checking for HAVE_SHARED_MMAP: OK
-Checking for HAVE_MREMAP: OK
-Checking for HAVE_SECURE_MKSTEMP: OK
-Checking for HAVE_IFACE_GETIFADDRS: NO
-Checking for HAVE_IFACE_IFCONF: NO
-Checking for HAVE_IFACE_IFREQ: NO
-Checking for large file support without additional flags: NO
-Checking for -D_FILE_OFFSET_BITS=64: OK
-Checking for HAVE_INCOHERENT_MMAP: NO
-Checking value of NSIG: "65"
-Checking value of _NSIG: "65"
-Checking value of SIGRTMAX: "64"
-Checking value of SIGRTMIN: "34"
-Checking whether the WRFILE -keytab is supported: OK
-Checking for kernel change notify support: OK
-Checking for Linux kernel oplocks: OK
-Checking for kernel share modes: OK
-Checking whether POSIX capabilities are available: OK
-Checking if can we convert from CP850 to UCS-2LE: OK
-Checking if can we convert from UTF-8 to UCS-2LE: OK
-vfs_fileid checking for statfs() and struct statfs.f_fsid: OK
-Checking whether we can use Linux thread-specific credentials with 32-bit system calls: OK
-Checking whether fcntl locking is available: OK
-Checking for the maximum value of the 'time_t' type: NO
-Checking whether the realpath function allows a NULL argument: OK
-Checking for ftruncate extend: OK
-getcwd takes a NULL argument: OK
-Checking for small off_t: NO
-Checking whether blkcnt_t is 32 bit: NO
-Checking whether blkcnt_t is 64 bit: OK
-Checking whether fcntl lock supports open file description locks: OK
diff --git a/meta-security/files/waf-cross-answers/cross-answers-i586.txt b/meta-security/files/waf-cross-answers/cross-answers-i586.txt
deleted file mode 100644
index a5cd998..0000000
--- a/meta-security/files/waf-cross-answers/cross-answers-i586.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Checking uname sysname type: "Linux"
-Checking uname version type: "# Wed May 20 10:34:39 UTC 2015"
-Checking simple C program: "hello world"
-rpath library support: OK
--Wl,--version-script support: OK
-Checking getconf LFS_CFLAGS: NO
-Checking correct behavior of strtoll: NO
-Checking for working strptime: OK
-Checking for C99 vsnprintf: "1"
-Checking for HAVE_SHARED_MMAP: OK
-Checking for HAVE_MREMAP: OK
-Checking for HAVE_SECURE_MKSTEMP: OK
-Checking for HAVE_IFACE_GETIFADDRS: NO
-Checking for HAVE_IFACE_IFCONF: NO
-Checking for HAVE_IFACE_IFREQ: NO
-Checking for large file support without additional flags: NO
-Checking for -D_FILE_OFFSET_BITS=64: OK
-Checking for HAVE_INCOHERENT_MMAP: NO
-Checking value of NSIG: "65"
-Checking value of _NSIG: "65"
-Checking value of SIGRTMAX: "64"
-Checking value of SIGRTMIN: "34"
-Checking whether the WRFILE -keytab is supported: OK
-Checking for kernel change notify support: OK
-Checking for Linux kernel oplocks: OK
-Checking for kernel share modes: OK
-Checking whether POSIX capabilities are available: OK
-Checking if can we convert from CP850 to UCS-2LE: OK
-Checking if can we convert from UTF-8 to UCS-2LE: OK
-vfs_fileid checking for statfs() and struct statfs.f_fsid: OK
-Checking whether we can use Linux thread-specific credentials with 32-bit system calls: OK
-Checking whether fcntl locking is available: OK
-Checking for the maximum value of the 'time_t' type: NO
-Checking whether the realpath function allows a NULL argument: OK
-Checking for ftruncate extend: OK
-getcwd takes a NULL argument: OK
-Checking for small off_t: NO
-Checking whether blkcnt_t is 32 bit: NO
-Checking whether blkcnt_t is 64 bit: OK
-Checking whether fcntl lock supports open file description locks: OK
diff --git a/meta-security/files/waf-cross-answers/cross-answers-i686.txt b/meta-security/files/waf-cross-answers/cross-answers-i686.txt
deleted file mode 100644
index a5cd998..0000000
--- a/meta-security/files/waf-cross-answers/cross-answers-i686.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Checking uname sysname type: "Linux"
-Checking uname version type: "# Wed May 20 10:34:39 UTC 2015"
-Checking simple C program: "hello world"
-rpath library support: OK
--Wl,--version-script support: OK
-Checking getconf LFS_CFLAGS: NO
-Checking correct behavior of strtoll: NO
-Checking for working strptime: OK
-Checking for C99 vsnprintf: "1"
-Checking for HAVE_SHARED_MMAP: OK
-Checking for HAVE_MREMAP: OK
-Checking for HAVE_SECURE_MKSTEMP: OK
-Checking for HAVE_IFACE_GETIFADDRS: NO
-Checking for HAVE_IFACE_IFCONF: NO
-Checking for HAVE_IFACE_IFREQ: NO
-Checking for large file support without additional flags: NO
-Checking for -D_FILE_OFFSET_BITS=64: OK
-Checking for HAVE_INCOHERENT_MMAP: NO
-Checking value of NSIG: "65"
-Checking value of _NSIG: "65"
-Checking value of SIGRTMAX: "64"
-Checking value of SIGRTMIN: "34"
-Checking whether the WRFILE -keytab is supported: OK
-Checking for kernel change notify support: OK
-Checking for Linux kernel oplocks: OK
-Checking for kernel share modes: OK
-Checking whether POSIX capabilities are available: OK
-Checking if can we convert from CP850 to UCS-2LE: OK
-Checking if can we convert from UTF-8 to UCS-2LE: OK
-vfs_fileid checking for statfs() and struct statfs.f_fsid: OK
-Checking whether we can use Linux thread-specific credentials with 32-bit system calls: OK
-Checking whether fcntl locking is available: OK
-Checking for the maximum value of the 'time_t' type: NO
-Checking whether the realpath function allows a NULL argument: OK
-Checking for ftruncate extend: OK
-getcwd takes a NULL argument: OK
-Checking for small off_t: NO
-Checking whether blkcnt_t is 32 bit: NO
-Checking whether blkcnt_t is 64 bit: OK
-Checking whether fcntl lock supports open file description locks: OK
diff --git a/meta-security/files/waf-cross-answers/cross-answers-mips.txt b/meta-security/files/waf-cross-answers/cross-answers-mips.txt
deleted file mode 100644
index 3e239e7..0000000
--- a/meta-security/files/waf-cross-answers/cross-answers-mips.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Checking uname sysname type: "Linux"
-Checking uname version type: "# Wed May 20 10:34:39 UTC 2015"
-Checking simple C program: "hello world"
-rpath library support: OK
--Wl,--version-script support: OK
-Checking getconf LFS_CFLAGS: NO
-Checking correct behavior of strtoll: NO
-Checking for working strptime: OK
-Checking for C99 vsnprintf: "1"
-Checking for HAVE_SHARED_MMAP: OK
-Checking for HAVE_MREMAP: OK
-Checking for HAVE_SECURE_MKSTEMP: OK
-Checking for HAVE_IFACE_GETIFADDRS: NO
-Checking for HAVE_IFACE_IFCONF: NO
-Checking for HAVE_IFACE_IFREQ: NO
-Checking for large file support without additional flags: NO
-Checking for -D_FILE_OFFSET_BITS=64: OK
-Checking for HAVE_INCOHERENT_MMAP: NO
-Checking value of NSIG: "128"
-Checking value of _NSIG: "128"
-Checking value of SIGRTMAX: "127"
-Checking value of SIGRTMIN: "34"
-Checking whether the WRFILE -keytab is supported: OK
-Checking for kernel change notify support: OK
-Checking for Linux kernel oplocks: OK
-Checking for kernel share modes: OK
-Checking whether POSIX capabilities are available: OK
-Checking if can we convert from CP850 to UCS-2LE: OK
-Checking if can we convert from UTF-8 to UCS-2LE: OK
-vfs_fileid checking for statfs() and struct statfs.f_fsid: OK
-Checking whether we can use Linux thread-specific credentials: OK
-Checking whether fcntl locking is available: OK
-Checking for the maximum value of the 'time_t' type: NO
-Checking whether the realpath function allows a NULL argument: OK
-Checking for ftruncate extend: OK
-getcwd takes a NULL argument: OK
-Checking for small off_t: NO
-Checking whether blkcnt_t is 32 bit: NO
-Checking whether blkcnt_t is 64 bit: OK
-Checking whether fcntl lock supports open file description locks: OK
diff --git a/meta-security/files/waf-cross-answers/cross-answers-mips64.txt b/meta-security/files/waf-cross-answers/cross-answers-mips64.txt
deleted file mode 100644
index 82e694f..0000000
--- a/meta-security/files/waf-cross-answers/cross-answers-mips64.txt
+++ /dev/null
@@ -1,39 +0,0 @@
-Checking uname sysname type: "Linux"
-Checking uname version type: "# Wed May 20 10:34:39 UTC 2015"
-Checking simple C program: "hello world"
-rpath library support: OK
--Wl,--version-script support: OK
-Checking getconf LFS_CFLAGS: NO
-Checking correct behavior of strtoll: NO
-Checking for working strptime: OK
-Checking for C99 vsnprintf: "1"
-Checking for HAVE_SHARED_MMAP: OK
-Checking for HAVE_MREMAP: OK
-Checking for HAVE_SECURE_MKSTEMP: OK
-Checking for HAVE_IFACE_GETIFADDRS: NO
-Checking for HAVE_IFACE_IFCONF: NO
-Checking for HAVE_IFACE_IFREQ: NO
-Checking for large file support without additional flags: OK
-Checking for HAVE_INCOHERENT_MMAP: OK
-Checking value of NSIG: "128"
-Checking value of _NSIG: "128"
-Checking value of SIGRTMAX: "127"
-Checking value of SIGRTMIN: "34"
-Checking whether the WRFILE -keytab is supported: OK
-Checking for kernel change notify support: OK
-Checking for Linux kernel oplocks: OK
-Checking for kernel share modes: OK
-Checking whether POSIX capabilities are available: OK
-Checking if can we convert from CP850 to UCS-2LE: OK
-Checking if can we convert from UTF-8 to UCS-2LE: OK
-vfs_fileid checking for statfs() and struct statfs.f_fsid: OK
-Checking whether we can use Linux thread-specific credentials: OK
-Checking whether fcntl locking is available: OK
-Checking for the maximum value of the 'time_t' type: OK
-Checking whether the realpath function allows a NULL argument: OK
-Checking for ftruncate extend: OK
-getcwd takes a NULL argument: OK
-Checking for small off_t: NO
-Checking whether blkcnt_t is 32 bit: NO
-Checking whether blkcnt_t is 64 bit: OK
-Checking whether fcntl lock supports open file description locks: OK
diff --git a/meta-security/files/waf-cross-answers/cross-answers-mips64el.txt b/meta-security/files/waf-cross-answers/cross-answers-mips64el.txt
deleted file mode 100644
index 82e694f..0000000
--- a/meta-security/files/waf-cross-answers/cross-answers-mips64el.txt
+++ /dev/null
@@ -1,39 +0,0 @@
-Checking uname sysname type: "Linux"
-Checking uname version type: "# Wed May 20 10:34:39 UTC 2015"
-Checking simple C program: "hello world"
-rpath library support: OK
--Wl,--version-script support: OK
-Checking getconf LFS_CFLAGS: NO
-Checking correct behavior of strtoll: NO
-Checking for working strptime: OK
-Checking for C99 vsnprintf: "1"
-Checking for HAVE_SHARED_MMAP: OK
-Checking for HAVE_MREMAP: OK
-Checking for HAVE_SECURE_MKSTEMP: OK
-Checking for HAVE_IFACE_GETIFADDRS: NO
-Checking for HAVE_IFACE_IFCONF: NO
-Checking for HAVE_IFACE_IFREQ: NO
-Checking for large file support without additional flags: OK
-Checking for HAVE_INCOHERENT_MMAP: OK
-Checking value of NSIG: "128"
-Checking value of _NSIG: "128"
-Checking value of SIGRTMAX: "127"
-Checking value of SIGRTMIN: "34"
-Checking whether the WRFILE -keytab is supported: OK
-Checking for kernel change notify support: OK
-Checking for Linux kernel oplocks: OK
-Checking for kernel share modes: OK
-Checking whether POSIX capabilities are available: OK
-Checking if can we convert from CP850 to UCS-2LE: OK
-Checking if can we convert from UTF-8 to UCS-2LE: OK
-vfs_fileid checking for statfs() and struct statfs.f_fsid: OK
-Checking whether we can use Linux thread-specific credentials: OK
-Checking whether fcntl locking is available: OK
-Checking for the maximum value of the 'time_t' type: OK
-Checking whether the realpath function allows a NULL argument: OK
-Checking for ftruncate extend: OK
-getcwd takes a NULL argument: OK
-Checking for small off_t: NO
-Checking whether blkcnt_t is 32 bit: NO
-Checking whether blkcnt_t is 64 bit: OK
-Checking whether fcntl lock supports open file description locks: OK
diff --git a/meta-security/files/waf-cross-answers/cross-answers-mipsel.txt b/meta-security/files/waf-cross-answers/cross-answers-mipsel.txt
deleted file mode 100644
index 3e239e7..0000000
--- a/meta-security/files/waf-cross-answers/cross-answers-mipsel.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Checking uname sysname type: "Linux"
-Checking uname version type: "# Wed May 20 10:34:39 UTC 2015"
-Checking simple C program: "hello world"
-rpath library support: OK
--Wl,--version-script support: OK
-Checking getconf LFS_CFLAGS: NO
-Checking correct behavior of strtoll: NO
-Checking for working strptime: OK
-Checking for C99 vsnprintf: "1"
-Checking for HAVE_SHARED_MMAP: OK
-Checking for HAVE_MREMAP: OK
-Checking for HAVE_SECURE_MKSTEMP: OK
-Checking for HAVE_IFACE_GETIFADDRS: NO
-Checking for HAVE_IFACE_IFCONF: NO
-Checking for HAVE_IFACE_IFREQ: NO
-Checking for large file support without additional flags: NO
-Checking for -D_FILE_OFFSET_BITS=64: OK
-Checking for HAVE_INCOHERENT_MMAP: NO
-Checking value of NSIG: "128"
-Checking value of _NSIG: "128"
-Checking value of SIGRTMAX: "127"
-Checking value of SIGRTMIN: "34"
-Checking whether the WRFILE -keytab is supported: OK
-Checking for kernel change notify support: OK
-Checking for Linux kernel oplocks: OK
-Checking for kernel share modes: OK
-Checking whether POSIX capabilities are available: OK
-Checking if can we convert from CP850 to UCS-2LE: OK
-Checking if can we convert from UTF-8 to UCS-2LE: OK
-vfs_fileid checking for statfs() and struct statfs.f_fsid: OK
-Checking whether we can use Linux thread-specific credentials: OK
-Checking whether fcntl locking is available: OK
-Checking for the maximum value of the 'time_t' type: NO
-Checking whether the realpath function allows a NULL argument: OK
-Checking for ftruncate extend: OK
-getcwd takes a NULL argument: OK
-Checking for small off_t: NO
-Checking whether blkcnt_t is 32 bit: NO
-Checking whether blkcnt_t is 64 bit: OK
-Checking whether fcntl lock supports open file description locks: OK
diff --git a/meta-security/files/waf-cross-answers/cross-answers-powerpc.txt b/meta-security/files/waf-cross-answers/cross-answers-powerpc.txt
deleted file mode 100644
index 27b9378..0000000
--- a/meta-security/files/waf-cross-answers/cross-answers-powerpc.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Checking uname sysname type: "Linux"
-Checking uname version type: "# Wed May 20 10:34:39 UTC 2015"
-Checking simple C program: "hello world"
-rpath library support: OK
--Wl,--version-script support: OK
-Checking getconf LFS_CFLAGS: NO
-Checking correct behavior of strtoll: NO
-Checking for working strptime: OK
-Checking for C99 vsnprintf: "1"
-Checking for HAVE_SHARED_MMAP: OK
-Checking for HAVE_MREMAP: OK
-Checking for HAVE_SECURE_MKSTEMP: OK
-Checking for HAVE_IFACE_GETIFADDRS: NO
-Checking for HAVE_IFACE_IFCONF: NO
-Checking for HAVE_IFACE_IFREQ: NO
-Checking for large file support without additional flags: NO
-Checking for -D_FILE_OFFSET_BITS=64: OK
-Checking for HAVE_INCOHERENT_MMAP: NO
-Checking value of NSIG: "65"
-Checking value of _NSIG: "65"
-Checking value of SIGRTMAX: "64"
-Checking value of SIGRTMIN: "34"
-Checking whether the WRFILE -keytab is supported: OK
-Checking for kernel change notify support: OK
-Checking for Linux kernel oplocks: OK
-Checking for kernel share modes: OK
-Checking whether POSIX capabilities are available: OK
-Checking if can we convert from CP850 to UCS-2LE: OK
-Checking if can we convert from UTF-8 to UCS-2LE: OK
-vfs_fileid checking for statfs() and struct statfs.f_fsid: OK
-Checking whether we can use Linux thread-specific credentials: OK
-Checking whether fcntl locking is available: OK
-Checking for the maximum value of the 'time_t' type: NO
-Checking whether the realpath function allows a NULL argument: OK
-Checking for ftruncate extend: OK
-getcwd takes a NULL argument: OK
-Checking for small off_t: NO
-Checking whether blkcnt_t is 32 bit: NO
-Checking whether blkcnt_t is 64 bit: OK
-Checking whether fcntl lock supports open file description locks: OK
diff --git a/meta-security/files/waf-cross-answers/cross-answers-powerpc64.txt b/meta-security/files/waf-cross-answers/cross-answers-powerpc64.txt
deleted file mode 100644
index 7fd3092..0000000
--- a/meta-security/files/waf-cross-answers/cross-answers-powerpc64.txt
+++ /dev/null
@@ -1,40 +0,0 @@
-Checking uname sysname type: "Linux"
-Checking uname version type: "# Wed May 20 10:34:39 UTC 2015"
-Checking simple C program: "hello world"
-rpath library support: OK
--Wl,--version-script support: OK
-Checking getconf LFS_CFLAGS: NO
-Checking correct behavior of strtoll: NO
-Checking for working strptime: OK
-Checking for C99 vsnprintf: "1"
-Checking for HAVE_SHARED_MMAP: OK
-Checking for HAVE_MREMAP: OK
-Checking for HAVE_SECURE_MKSTEMP: OK
-Checking for HAVE_IFACE_GETIFADDRS: NO
-Checking for HAVE_IFACE_IFCONF: NO
-Checking for HAVE_IFACE_IFREQ: NO
-Checking for large file support without additional flags: OK
-Checking for HAVE_INCOHERENT_MMAP: NO
-Checking value of NSIG: "65"
-Checking value of _NSIG: "65"
-Checking value of SIGRTMAX: "64"
-Checking value of SIGRTMIN: "34"
-Checking whether the WRFILE -keytab is supported: OK
-Checking for kernel change notify support: OK
-Checking for Linux kernel oplocks: OK
-Checking for kernel share modes: OK
-Checking whether POSIX capabilities are available: OK
-Checking if can we convert from CP850 to UCS-2LE: (255, "")
-Checking if can we convert from IBM850 to UCS-2LE: (255, "")
-Checking if can we convert from UTF-8 to UCS-2LE: OK
-vfs_fileid checking for statfs() and struct statfs.f_fsid: OK
-Checking whether we can use Linux thread-specific credentials: OK
-Checking whether fcntl locking is available: OK
-Checking for the maximum value of the 'time_t' type: OK
-Checking whether the realpath function allows a NULL argument: OK
-Checking for ftruncate extend: OK
-getcwd takes a NULL argument: OK
-Checking for small off_t: NO
-Checking whether blkcnt_t is 32 bit: NO
-Checking whether blkcnt_t is 64 bit: OK
-Checking whether fcntl lock supports open file description locks: OK
diff --git a/meta-security/files/waf-cross-answers/cross-answers-riscv64.txt b/meta-security/files/waf-cross-answers/cross-answers-riscv64.txt
deleted file mode 100644
index 1023f6a..0000000
--- a/meta-security/files/waf-cross-answers/cross-answers-riscv64.txt
+++ /dev/null
@@ -1,39 +0,0 @@
-Checking uname sysname type: "Linux"
-Checking uname version type: "# Wed May 20 10:34:39 UTC 2015"
-Checking simple C program: "hello world"
-rpath library support: OK
--Wl,--version-script support: OK
-Checking getconf LFS_CFLAGS: NO
-Checking correct behavior of strtoll: NO
-Checking for working strptime: OK
-Checking for C99 vsnprintf: "1"
-Checking for HAVE_SHARED_MMAP: OK
-Checking for HAVE_MREMAP: OK
-Checking for HAVE_SECURE_MKSTEMP: OK
-Checking for HAVE_IFACE_GETIFADDRS: NO
-Checking for HAVE_IFACE_IFCONF: NO
-Checking for HAVE_IFACE_IFREQ: NO
-Checking for large file support without additional flags: OK
-Checking for HAVE_INCOHERENT_MMAP: NO
-Checking value of NSIG: "65"
-Checking value of _NSIG: "65"
-Checking value of SIGRTMAX: "64"
-Checking value of SIGRTMIN: "34"
-Checking whether the WRFILE -keytab is supported: OK
-Checking for kernel change notify support: OK
-Checking for Linux kernel oplocks: OK
-Checking for kernel share modes: OK
-Checking whether POSIX capabilities are available: OK
-Checking if can we convert from CP850 to UCS-2LE: OK
-Checking if can we convert from UTF-8 to UCS-2LE: OK
-vfs_fileid checking for statfs() and struct statfs.f_fsid: OK
-Checking whether we can use Linux thread-specific credentials: OK
-Checking whether fcntl locking is available: OK
-Checking for the maximum value of the 'time_t' type: OK
-Checking whether the realpath function allows a NULL argument: OK
-Checking for ftruncate extend: OK
-getcwd takes a NULL argument: OK
-Checking for small off_t: NO
-Checking whether blkcnt_t is 32 bit: NO
-Checking whether blkcnt_t is 64 bit: OK
-Checking whether fcntl lock supports open file description locks: OK
diff --git a/meta-security/files/waf-cross-answers/cross-answers-x86_64.txt b/meta-security/files/waf-cross-answers/cross-answers-x86_64.txt
deleted file mode 100644
index 1023f6a..0000000
--- a/meta-security/files/waf-cross-answers/cross-answers-x86_64.txt
+++ /dev/null
@@ -1,39 +0,0 @@
-Checking uname sysname type: "Linux"
-Checking uname version type: "# Wed May 20 10:34:39 UTC 2015"
-Checking simple C program: "hello world"
-rpath library support: OK
--Wl,--version-script support: OK
-Checking getconf LFS_CFLAGS: NO
-Checking correct behavior of strtoll: NO
-Checking for working strptime: OK
-Checking for C99 vsnprintf: "1"
-Checking for HAVE_SHARED_MMAP: OK
-Checking for HAVE_MREMAP: OK
-Checking for HAVE_SECURE_MKSTEMP: OK
-Checking for HAVE_IFACE_GETIFADDRS: NO
-Checking for HAVE_IFACE_IFCONF: NO
-Checking for HAVE_IFACE_IFREQ: NO
-Checking for large file support without additional flags: OK
-Checking for HAVE_INCOHERENT_MMAP: NO
-Checking value of NSIG: "65"
-Checking value of _NSIG: "65"
-Checking value of SIGRTMAX: "64"
-Checking value of SIGRTMIN: "34"
-Checking whether the WRFILE -keytab is supported: OK
-Checking for kernel change notify support: OK
-Checking for Linux kernel oplocks: OK
-Checking for kernel share modes: OK
-Checking whether POSIX capabilities are available: OK
-Checking if can we convert from CP850 to UCS-2LE: OK
-Checking if can we convert from UTF-8 to UCS-2LE: OK
-vfs_fileid checking for statfs() and struct statfs.f_fsid: OK
-Checking whether we can use Linux thread-specific credentials: OK
-Checking whether fcntl locking is available: OK
-Checking for the maximum value of the 'time_t' type: OK
-Checking whether the realpath function allows a NULL argument: OK
-Checking for ftruncate extend: OK
-getcwd takes a NULL argument: OK
-Checking for small off_t: NO
-Checking whether blkcnt_t is 32 bit: NO
-Checking whether blkcnt_t is 64 bit: OK
-Checking whether fcntl lock supports open file description locks: OK
diff --git a/meta-security/lib/oeqa/runtime/cases/clamav.py b/meta-security/lib/oeqa/runtime/cases/clamav.py
index d0bc645..2808df4 100644
--- a/meta-security/lib/oeqa/runtime/cases/clamav.py
+++ b/meta-security/lib/oeqa/runtime/cases/clamav.py
@@ -57,7 +57,7 @@
'Status and output:%s and %s' % (status, output))
self.assertEqual(status, 1, msg = msg)
- @OETestDepends(['clamav.ClamavTest.test_freshclam_download'])
+ @OETestDepends(['clamav.ClamavTest.test_ping_clamav_net'])
def test_freshclam_check_mirrors(self):
status, output = self.target.run('freshclam --list-mirrors')
match = re.search('Failures: 0', output)
diff --git a/meta-security/meta-integrity/README.md b/meta-security/meta-integrity/README.md
index 5bef76e..4607948 100644
--- a/meta-security/meta-integrity/README.md
+++ b/meta-security/meta-integrity/README.md
@@ -74,7 +74,7 @@
the image, enable image signing in the local.conf like this:
INHERIT += "ima-evm-rootfs"
- IMA_EVM_KEY_DIR = "${IMA_EVM_BASE}/data/debug-keys"
+ IMA_EVM_KEY_DIR = "${INTEGRITY_BASE}/data/debug-keys"
This uses the default keys provided in the "data" directory of the layer.
Because everyone has access to these private keys, such an image
@@ -96,7 +96,7 @@
# In that shell, create the keys. Several options exist:
# 1. Self-signed keys.
- $IMA_EVM_BASE/scripts/ima-gen-self-signed.sh
+ $INTEGRITY_BASE/scripts/ima-gen-self-signed.sh
# 2. Keys signed by a new CA.
# When asked for a PEM passphrase, that will be for the root CA.
@@ -104,11 +104,11 @@
# only creating new certificates does. Most likely the default
# attributes for these certificates need to be adapted; modify
# the scripts as needed.
- # $IMA_EVM_BASE/scripts/ima-gen-local-ca.sh
- # $IMA_EVM_BASE/scripts/ima-gen-CA-signed.sh
+ # $INTEGRITY_BASE/scripts/ima-gen-local-ca.sh
+ # $INTEGRITY_BASE/scripts/ima-gen-CA-signed.sh
# 3. Keys signed by an existing CA.
- # $IMA_EVM_BASE/scripts/ima-gen-CA-signed.sh <CA.pem> <CA.priv>
+ # $INTEGRITY_BASE/scripts/ima-gen-CA-signed.sh <CA.pem> <CA.priv>
exit
When using ``ima-self-signed.sh`` as described above, self-signed keys
@@ -169,7 +169,7 @@
changes. To activate policy loading via systemd, place a policy file
in `/etc/ima/ima-policy`, for example with:
- IMA_EVM_POLICY_SYSTEMD = "${IMA_EVM_BASE}/data/ima_policy_simple"
+ IMA_EVM_POLICY_SYSTEMD = "${INTEGRITY_BASE}/data/ima_policy_simple"
To check that measuring works, look at `/sys/kernel/security/ima/ascii_runtime_measurements`
diff --git a/meta-security/meta-integrity/classes/ima-evm-rootfs.bbclass b/meta-security/meta-integrity/classes/ima-evm-rootfs.bbclass
index 8aec388..d6ade3b 100644
--- a/meta-security/meta-integrity/classes/ima-evm-rootfs.bbclass
+++ b/meta-security/meta-integrity/classes/ima-evm-rootfs.bbclass
@@ -1,7 +1,7 @@
# No default! Either this or IMA_EVM_PRIVKEY/IMA_EVM_X509 have to be
# set explicitly in a local.conf before activating ima-evm-rootfs.
# To use the insecure (because public) example keys, use
-# IMA_EVM_KEY_DIR = "${IMA_EVM_BASE}/data/debug-keys"
+# IMA_EVM_KEY_DIR = "${INTEGRITY_BASE}/data/debug-keys"
IMA_EVM_KEY_DIR ?= "IMA_EVM_KEY_DIR_NOT_SET"
# Private key for IMA signing. The default is okay when
diff --git a/meta-security/meta-integrity/classes/kernel-modsign.bbclass b/meta-security/meta-integrity/classes/kernel-modsign.bbclass
new file mode 100644
index 0000000..09025ba
--- /dev/null
+++ b/meta-security/meta-integrity/classes/kernel-modsign.bbclass
@@ -0,0 +1,29 @@
+# No default! Either this or MODSIGN_PRIVKEY/MODSIGN_X509 have to be
+# set explicitly in a local.conf before activating kernel-modsign.
+# To use the insecure (because public) example keys, use
+# MODSIGN_KEY_DIR = "${INTEGRITY_BASE}/data/debug-keys"
+MODSIGN_KEY_DIR ?= "MODSIGN_KEY_DIR_NOT_SET"
+
+# Private key for modules signing. The default is okay when
+# using the example key directory.
+MODSIGN_PRIVKEY ?= "${MODSIGN_KEY_DIR}/privkey_modsign.pem"
+
+# Public part of certificates used for modules signing.
+# The default is okay when using the example key directory.
+MODSIGN_X509 ?= "${MODSIGN_KEY_DIR}/x509_modsign.crt"
+
+# If this class is enabled, disable stripping signatures from modules
+INHIBIT_PACKAGE_STRIP = "1"
+
+kernel_do_configure_prepend() {
+ if [ -f "${MODSIGN_PRIVKEY}" -a -f "${MODSIGN_X509}" ]; then
+ cat "${MODSIGN_PRIVKEY}" "${MODSIGN_X509}" \
+ > "${B}/modsign_key.pem"
+ else
+ bberror "Either modsign key or certificate are invalid"
+ fi
+}
+
+do_shared_workdir_append() {
+ cp modsign_key.pem $kerneldir/
+}
diff --git a/meta-security/meta-integrity/conf/layer.conf b/meta-security/meta-integrity/conf/layer.conf
index 2f696cf..41989da 100644
--- a/meta-security/meta-integrity/conf/layer.conf
+++ b/meta-security/meta-integrity/conf/layer.conf
@@ -13,12 +13,14 @@
# Set a variable to get to the top of the metadata location. Needed
# for finding scripts (when following the README.md instructions) and
# default debug keys (in ima-evm-rootfs.bbclass).
-IMA_EVM_BASE := '${LAYERDIR}'
+INTEGRITY_BASE := '${LAYERDIR}'
# We must not export this path to all shell scripts (as in "export
-# IMA_EVM_BASE"), because that causes problems with sstate (becames
+# INTEGRITY_BASE"), because that causes problems with sstate (becames
# dependent on location of the layer). Exporting it to just the
# interactive shell is enough.
-OE_TERMINAL_EXPORTS += "IMA_EVM_BASE"
+OE_TERMINAL_EXPORTS += "INTEGRITY_BASE"
LAYERSERIES_COMPAT_integrity = "warrior"
+# ima-evm-utils depends on keyutils from meta-oe
+LAYERDEPENDS_integrity = "core openembedded-layer"
diff --git a/meta-security/meta-integrity/data/debug-keys/privkey_modsign.pem b/meta-security/meta-integrity/data/debug-keys/privkey_modsign.pem
new file mode 100644
index 0000000..4cac00a
--- /dev/null
+++ b/meta-security/meta-integrity/data/debug-keys/privkey_modsign.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDEWsJjB2pA5Ih6
+EelXvVjwWY1ix1azMciNRNPPQN1AMXF0K/VUkfOYbaPajg1cQYEf9gk3q7OZ5Axk
+UY/e5piZORaPcsmj0lV0L+NSlRYydR5M/QxtEz26585FgqRGdAe6umStPmVKdqa2
+d68O4PgQgJJtVuz6ndm+0uNEUDCVLwhkGQSwNB3qBbZAUX9escZ/a8eUiBfMYKaO
+k8JRyM+2br9dgpTFg4UfBYexgNSQo8g5TIBGc8KgQiKCuFj1fQEhV5z4RusHthjc
+NYXa3RHmdclxyrGeYr5ZRc47HqE1gd5NDR0WeHn4C4YKcfK1rZZz/2+6hfsIRfGx
+6cQKk23hAgMBAAECggEAJ0ULiWirPG04SkmYxF5vEiqm1zGMymvTc0VnoxSS60q4
+KQa9mvtRn5OV6JjuXRwQqga30zV4xvdP7yRMxMSTkllThL7tSuE/C+yj5xlABjlc
+JQOa35mwh9fibg5xslF0Vkj+55MKCPlv4CBRl4Uwt4QvRMTUwk6dhMeCgmATR1J1
+2/7AipjtfFYreDx7sLbRVvSzUhmZS0iCbNOhtTWPLNW+9YKHTOffKa04HzNtnAXq
+OjJ0IRZD/C6LfkBUsnHg2eEiA97QXh/Srsl9nc8DaUK1IXRywEdmYIoNMWMav2Hm
+RO8kkU30BqKW+/EO2ZbH2GmkxvwWd0ocBnLC3FRWEQKBgQDu4T8CB3YsOcVjqem4
+iBlaSht/b46YQc7A1SOqZCimehmmXNSxQOkapIG3wlIr5edtXQA+xv09+WrproUB
+SjAnqaH6pYeCvbNlY5k344gtYs+Kco2rq5GYa+LumAeX2Sam8F7u4LxvEogCecX7
+e4rnG3lt3AVuuRE7zpCQtaWcJQKBgQDSbUvea9pcYli9pssTl+ijQKkgG9DdaYbA
+I5w5bY1TPYZ/Ocysljefv/ssaHFh4DPxE1MQ5JHwZgZRo1EICxxYzGsLjyR/fmjz
+1c/NJlTtalCNtLvWaf7b02ag/abnP8neiSpLL5xqHvGo5ikWwgYQD+9HVKGvL3S1
+kI7x/ziADQKBgQCqFbkuMa/jh3LTJp0iZc1fa1qu3vhx0pFq3Zeab9w9xLxUps5O
+MwCGltFBzNuDJBwm00wkZrzTjq6gGkHbjD5DT1XkyE13OqjsLQFgOOKyJiPN2Qik
+TfHJzC91YMwvQ09xF78QaPXiRBiRYrEkAXACY56PKVS45I6vvcFTN/Ll/QKBgA9m
+KDMyuVwhZlUaq6nXaBLqXHYZEwPhARd2g6xANCNvUTRmSnAm3hM2vW7WhdWfzq1J
+uL53u6ZYEQZQaVGpXn2xF/RUmVsrKQsPDpH4yCZHrXVxUH20bA4yPkRxy5EIvgEn
+EI1IAq5RbWXq0f70W/U49U3HB74GPwg6d/uFreDRAoGAN+v9gMQA6A1vM7LvbYR8
+5CwwyqS/CfI9zKPLn53QstguXC/ObafIYQzVRqGb9lCQgtlmmKw4jMY0B/lDzpcH
+zS8rqoyvDj/m7i17NYkqXErJKLRQ0ptXKdLXHlG0u185e7Y5p4O3Z5dk8bACkpHi
+hp764y+BtU4qIcVaPsPK4uU=
+-----END PRIVATE KEY-----
diff --git a/meta-security/meta-integrity/data/debug-keys/x509_modsign.crt b/meta-security/meta-integrity/data/debug-keys/x509_modsign.crt
new file mode 100644
index 0000000..5fa2a90
--- /dev/null
+++ b/meta-security/meta-integrity/data/debug-keys/x509_modsign.crt
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDnjCCAoagAwIBAgIUUqmBj5Q8edHMMTXsoGVGEEKdwV4wDQYJKoZIhvcNAQEL
+BQAwZzEqMCgGA1UEAxMhbWV0YS1zZWN1cml0eSBtb2R1bGVzIHNpZ25pbmcga2V5
+MRQwEgYDVQQKEwtleGFtcGxlLmNvbTEjMCEGCSqGSIb3DQEJARYUam9obi5kb2VA
+ZXhhbXBsZS5jb20wIBcNMTkwNzI3MjIzOTA3WhgPMjExOTA3MjcyMjM5MTVaMGcx
+KjAoBgNVBAMTIW1ldGEtc2VjdXJpdHkgbW9kdWxlcyBzaWduaW5nIGtleTEUMBIG
+A1UEChMLZXhhbXBsZS5jb20xIzAhBgkqhkiG9w0BCQEWFGpvaG4uZG9lQGV4YW1w
+bGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxFrCYwdqQOSI
+ehHpV71Y8FmNYsdWszHIjUTTz0DdQDFxdCv1VJHzmG2j2o4NXEGBH/YJN6uzmeQM
+ZFGP3uaYmTkWj3LJo9JVdC/jUpUWMnUeTP0MbRM9uufORYKkRnQHurpkrT5lSnam
+tnevDuD4EICSbVbs+p3ZvtLjRFAwlS8IZBkEsDQd6gW2QFF/XrHGf2vHlIgXzGCm
+jpPCUcjPtm6/XYKUxYOFHwWHsYDUkKPIOUyARnPCoEIigrhY9X0BIVec+EbrB7YY
+3DWF2t0R5nXJccqxnmK+WUXOOx6hNYHeTQ0dFnh5+AuGCnHyta2Wc/9vuoX7CEXx
+senECpNt4QIDAQABo0AwPjAMBgNVHRMBAf8EAjAAMA8GA1UdDwEB/wQFAwMHgAAw
+HQYDVR0OBBYEFDa35X9LnPlrd76inh/cYgeXh6X4MA0GCSqGSIb3DQEBCwUAA4IB
+AQBTPTh7zY9BrfZW9Izk9JSZYNigwUDwjrhNBSLr5NKi2A/LmZ0jjdCDkwaCn5io
+xrAq5oxPCAkwlzKwY2ootcL3+En4Pq2e5U+n9kRrpDpKKiR5/0S0d9vpgg4eZR0R
+kxqE9APCQ5SFU3PgnJ5H5y2SPXzle3bgUsWxNGD81zXFn5clJj4XHvJDWTQ/jG7C
+FTQ1o1HXtzda4EmKIzrSU/ayVbpPg5fPEBJjk/hHPT45kfzVZBuxwBLXVbe/YyWi
+NTFWCbJwjZwVRKrsQ3HFpYMWvugtcsSHo7vGi06FvUHcS2sUZH5sFn7hulcIGICt
+EztTO8Q+yhZujZbmEyJmxqZv
+-----END CERTIFICATE-----
diff --git a/meta-security/meta-integrity/recipes-core/images/integrity-image-minimal.bb b/meta-security/meta-integrity/recipes-core/images/integrity-image-minimal.bb
index 6ed724d..e1bc6ff 100644
--- a/meta-security/meta-integrity/recipes-core/images/integrity-image-minimal.bb
+++ b/meta-security/meta-integrity/recipes-core/images/integrity-image-minimal.bb
@@ -17,6 +17,6 @@
export IMAGE_BASENAME = "integrity-image-minimal"
INHERIT += "ima-evm-rootfs"
-IMA_EVM_KEY_DIR = "${IMA_EVM_BASE}/data/debug-keys"
+IMA_EVM_KEY_DIR = "${INTEGRITY_BASE}/data/debug-keys"
QB_KERNEL_CMDLINE_APPEND_append = " ima_appraise=fix ima_policy=tcb ima_policy=appraise_tcb"
diff --git a/meta-security/meta-integrity/recipes-kernel/linux/linux-%.bbappend b/meta-security/meta-integrity/recipes-kernel/linux/linux-%.bbappend
index 931854e..f9a48cd 100644
--- a/meta-security/meta-integrity/recipes-kernel/linux/linux-%.bbappend
+++ b/meta-security/meta-integrity/recipes-kernel/linux/linux-%.bbappend
@@ -1,3 +1,5 @@
-FILESEXTRAPATHS_prepend := "${THISDIR}/linux:"
+KERNEL_FEATURES_append = " ${@bb.utils.contains("DISTRO_FEATURES", "ima", " features/ima/ima.scc", "" ,d)}"
-SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'ima', ' file://ima.cfg', '', d)}"
+KERNEL_FEATURES_append = " ${@bb.utils.contains('DISTRO_FEATURES', 'modsign', ' features/ima/modsign.scc', '', d)}"
+
+inherit ${@bb.utils.contains('DISTRO_FEATURES', 'modsign', 'kernel-modsign', '', d)}
diff --git a/meta-security/meta-integrity/recipes-kernel/linux/linux/ima.cfg b/meta-security/meta-integrity/recipes-kernel/linux/linux/ima.cfg
deleted file mode 100644
index b3e47ba..0000000
--- a/meta-security/meta-integrity/recipes-kernel/linux/linux/ima.cfg
+++ /dev/null
@@ -1,18 +0,0 @@
-CONFIG_IMA=y
-CONFIG_IMA_MEASURE_PCR_IDX=10
-CONFIG_IMA_NG_TEMPLATE=y
-CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng"
-CONFIG_IMA_DEFAULT_HASH_SHA1=y
-CONFIG_IMA_DEFAULT_HASH="sha1"
-CONFIG_IMA_APPRAISE=y
-CONFIG_IMA_APPRAISE_BOOTPARAM=y
-CONFIG_IMA_TRUSTED_KEYRING=y
-CONFIG_SIGNATURE=y
-CONFIG_IMA_WRITE_POLICY=y
-CONFIG_IMA_READ_POLICY=y
-CONFIG_IMA_LOAD_X509=y
-CONFIG_IMA_X509_PATH="/etc/keys/x509_ima.der"
-
-#CONFIG_INTEGRITY_SIGNATURE=y
-#CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
-#CONFIG_INTEGRITY_TRUSTED_KEYRING=y
diff --git a/meta-security/meta-integrity/recipes-kernel/linux/linux/ima_evm_root_ca.cfg b/meta-security/meta-integrity/recipes-kernel/linux/linux/ima_evm_root_ca.cfg
deleted file mode 100644
index 9a45425..0000000
--- a/meta-security/meta-integrity/recipes-kernel/linux/linux/ima_evm_root_ca.cfg
+++ /dev/null
@@ -1,3 +0,0 @@
-# CONFIG_IMA_APPRAISE_SIGNED_INIT is not set
-CONFIG_EVM_LOAD_X509=y
-CONFIG_EVM_X509_PATH="/etc/keys/x509_evm.der"
diff --git a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0001-ima-evm-utils-link-to-libcrypto-instead-of-OpenSSL.patch b/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0001-ima-evm-utils-link-to-libcrypto-instead-of-OpenSSL.patch
deleted file mode 100644
index 5ccb73d..0000000
--- a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0001-ima-evm-utils-link-to-libcrypto-instead-of-OpenSSL.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 4feaf9b61f93e4043eca26b4ec9f9f68d0cf5e68 Mon Sep 17 00:00:00 2001
-From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
-Date: Wed, 6 Mar 2019 01:08:43 +0300
-Subject: [PATCH 1/4] ima-evm-utils: link to libcrypto instead of OpenSSL
-
-There is no need to link to full libssl. evmctl uses functions from
-libcrypto, so let's link only against that library.
-
-Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
----
- configure.ac | 4 +---
- src/Makefile.am | 9 ++++-----
- 2 files changed, 5 insertions(+), 8 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 60f3684..32e8d85 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -24,9 +24,7 @@ LT_INIT
- # Checks for header files.
- AC_HEADER_STDC
-
--PKG_CHECK_MODULES(OPENSSL, [ openssl >= 0.9.8 ])
--AC_SUBST(OPENSSL_CFLAGS)
--AC_SUBST(OPENSSL_LIBS)
-+PKG_CHECK_MODULES(LIBCRYPTO, [libcrypto >= 0.9.8 ])
- AC_SUBST(KERNEL_HEADERS)
- AC_CHECK_HEADER(unistd.h)
- AC_CHECK_HEADERS(openssl/conf.h)
-diff --git a/src/Makefile.am b/src/Makefile.am
-index d74fc6f..b81281a 100644
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -1,11 +1,11 @@
- lib_LTLIBRARIES = libimaevm.la
-
- libimaevm_la_SOURCES = libimaevm.c
--libimaevm_la_CPPFLAGS = $(OPENSSL_CFLAGS)
-+libimaevm_la_CPPFLAGS = $(LIBCRYPTO_CFLAGS)
- # current[:revision[:age]]
- # result: [current-age].age.revision
- libimaevm_la_LDFLAGS = -version-info 0:0:0
--libimaevm_la_LIBADD = $(OPENSSL_LIBS)
-+libimaevm_la_LIBADD = $(LIBCRYPTO_LIBS)
-
- include_HEADERS = imaevm.h
-
-@@ -17,12 +17,11 @@ hash_info.h: Makefile
- bin_PROGRAMS = evmctl
-
- evmctl_SOURCES = evmctl.c
--evmctl_CPPFLAGS = $(OPENSSL_CFLAGS)
-+evmctl_CPPFLAGS = $(LIBCRYPTO_CFLAGS)
- evmctl_LDFLAGS = $(LDFLAGS_READLINE)
--evmctl_LDADD = $(OPENSSL_LIBS) -lkeyutils libimaevm.la
-+evmctl_LDADD = $(LIBCRYPTO_LIBS) -lkeyutils libimaevm.la
-
- INCLUDES = -I$(top_srcdir) -include config.h
-
- CLEANFILES = hash_info.h
- DISTCLEANFILES = @DISTCLEANFILES@
--
---
-2.17.1
-
diff --git a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0002-ima-evm-utils-replace-INCLUDES-with-AM_CPPFLAGS.patch b/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0002-ima-evm-utils-replace-INCLUDES-with-AM_CPPFLAGS.patch
deleted file mode 100644
index 8237274..0000000
--- a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0002-ima-evm-utils-replace-INCLUDES-with-AM_CPPFLAGS.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 5bb10f3da420f4c46e44423276a9da0d4bc1b691 Mon Sep 17 00:00:00 2001
-From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
-Date: Wed, 6 Mar 2019 01:17:12 +0300
-Subject: [PATCH 2/4] ima-evm-utils: replace INCLUDES with AM_CPPFLAGS
-
-Replace INCLUDES variable with AM_CPPFLAGS to stop Automake from warning
-about deprecated variable usage.
-
-Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
----
- src/Makefile.am | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/Makefile.am b/src/Makefile.am
-index b81281a..164e7e4 100644
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -1,7 +1,7 @@
- lib_LTLIBRARIES = libimaevm.la
-
- libimaevm_la_SOURCES = libimaevm.c
--libimaevm_la_CPPFLAGS = $(LIBCRYPTO_CFLAGS)
-+libimaevm_la_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS)
- # current[:revision[:age]]
- # result: [current-age].age.revision
- libimaevm_la_LDFLAGS = -version-info 0:0:0
-@@ -17,11 +17,11 @@ hash_info.h: Makefile
- bin_PROGRAMS = evmctl
-
- evmctl_SOURCES = evmctl.c
--evmctl_CPPFLAGS = $(LIBCRYPTO_CFLAGS)
-+evmctl_CPPFLAGS = $(AM_CPPFLAGS) $(LIBCRYPTO_CFLAGS)
- evmctl_LDFLAGS = $(LDFLAGS_READLINE)
- evmctl_LDADD = $(LIBCRYPTO_LIBS) -lkeyutils libimaevm.la
-
--INCLUDES = -I$(top_srcdir) -include config.h
-+AM_CPPFLAGS = -I$(top_srcdir) -include config.h
-
- CLEANFILES = hash_info.h
- DISTCLEANFILES = @DISTCLEANFILES@
---
-2.17.1
-
diff --git a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0003-ima-evm-utils-include-hash-info.gen-into-distributio.patch b/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0003-ima-evm-utils-include-hash-info.gen-into-distributio.patch
deleted file mode 100644
index 3d250d2..0000000
--- a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0003-ima-evm-utils-include-hash-info.gen-into-distributio.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From c587ec307a6259a990bfab727cea7db28dba4c23 Mon Sep 17 00:00:00 2001
-From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
-Date: Wed, 6 Mar 2019 01:22:30 +0300
-Subject: [PATCH 3/4] ima-evm-utils: include hash-info.gen into distribution
-
-Include hash-info.gen into tarball and call it from the sourcedir to fix
-out-of-tree build (and thus 'make distcheck').
-
-Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
----
- src/Makefile.am | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/Makefile.am b/src/Makefile.am
-index 164e7e4..9c037e2 100644
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -11,8 +11,9 @@ include_HEADERS = imaevm.h
-
- nodist_libimaevm_la_SOURCES = hash_info.h
- BUILT_SOURCES = hash_info.h
-+EXTRA_DIST = hash_info.gen
- hash_info.h: Makefile
-- ./hash_info.gen $(KERNEL_HEADERS) >$@
-+ $(srcdir)/hash_info.gen $(KERNEL_HEADERS) >$@
-
- bin_PROGRAMS = evmctl
-
---
-2.17.1
-
diff --git a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0004-ima-evm-utils-update-.gitignore-files.patch b/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0004-ima-evm-utils-update-.gitignore-files.patch
deleted file mode 100644
index 4ada1a2..0000000
--- a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/0004-ima-evm-utils-update-.gitignore-files.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From b9f327c5c513ccea9cb56d4bbd50c1f66d629099 Mon Sep 17 00:00:00 2001
-From: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
-Date: Wed, 6 Mar 2019 01:24:04 +0300
-Subject: [PATCH 4/4] ima-evm-utils: update .gitignore files
-
-Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
----
- .gitignore | 1 +
- src/.gitignore | 1 +
- 2 files changed, 2 insertions(+)
- create mode 100644 src/.gitignore
-
-diff --git a/.gitignore b/.gitignore
-index ca7a06e..cb82166 100644
---- a/.gitignore
-+++ b/.gitignore
-@@ -45,6 +45,7 @@ cscope.*
- ncscope.*
-
- # Generated documentation
-+*.1
- *.8
- *.5
- manpage.links
-diff --git a/src/.gitignore b/src/.gitignore
-new file mode 100644
-index 0000000..38e8e3c
---- /dev/null
-+++ b/src/.gitignore
-@@ -0,0 +1 @@
-+hash_info.h
---
-2.17.1
-
diff --git a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/evmctl.c-do-not-depend-on-xattr.h-with-IMA-defines.patch b/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/evmctl.c-do-not-depend-on-xattr.h-with-IMA-defines.patch
index c0bdd9b..ffa65df 100644
--- a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/evmctl.c-do-not-depend-on-xattr.h-with-IMA-defines.patch
+++ b/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/evmctl.c-do-not-depend-on-xattr.h-with-IMA-defines.patch
@@ -23,9 +23,9 @@
index c54efbb..23cf54c 100644
--- a/src/evmctl.c
+++ b/src/evmctl.c
-@@ -56,6 +56,18 @@
- #include <ctype.h>
+@@ -57,6 +57,18 @@
#include <termios.h>
+ #include <assert.h>
+/*
+ * linux/xattr.h might be old to have this. Allow compilation on older
diff --git a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils_git.bb b/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils_git.bb
index 929d853..92c24c9 100644
--- a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils_git.bb
+++ b/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils_git.bb
@@ -6,9 +6,9 @@
DEPENDS_class-native += "openssl-native keyutils-native"
-PV = "1.0+git${SRCPV}"
-SRCREV = "0267fa16990fd0ddcc89984a8e55b27d43e80167"
-SRC_URI = "git://git.code.sf.net/p/linux-ima/ima-evm-utils"
+PV = "1.2.1+git${SRCPV}"
+SRCREV = "3eab1f93b634249c1720f65fcb495b1996f0256e"
+SRC_URI = "git://git.code.sf.net/p/linux-ima/ima-evm-utils;branch=ima-evm-utils-1.2.y"
# Documentation depends on asciidoc, which we do not have, so
# do not build documentation.
@@ -21,12 +21,6 @@
# Required for xargs with more than one path as argument (better for performance).
SRC_URI += "file://command-line-apply-operation-to-all-paths.patch"
-SRC_URI += "\
- file://0001-ima-evm-utils-link-to-libcrypto-instead-of-OpenSSL.patch \
- file://0002-ima-evm-utils-replace-INCLUDES-with-AM_CPPFLAGS.patch \
- file://0003-ima-evm-utils-include-hash-info.gen-into-distributio.patch \
- file://0004-ima-evm-utils-update-.gitignore-files.patch \
-"
S = "${WORKDIR}/git"
inherit pkgconfig autotools
diff --git a/meta-security/meta-security-compliance/README b/meta-security/meta-security-compliance/README
index b29c143..320f856 100644
--- a/meta-security/meta-security-compliance/README
+++ b/meta-security/meta-security-compliance/README
@@ -28,9 +28,9 @@
Send pull requests, patches, comments or questions to yocto@yoctoproject.org
When sending single patches, please using something like:
-'git send-email -1 --to yocto@yoctoproject.org --subject-prefix=meta-security][PATCH'
+'git send-email -1 --to yocto@yoctoproject.org --subject-prefix=meta-security-compliance][PATCH'
-Layer Maintainer: Armin Kuster <akuster@mvista.com>
+Layer Maintainer: Armin Kuster <akuster808@gmail.com>
License
diff --git a/meta-security/meta-security-compliance/conf/layer.conf b/meta-security/meta-security-compliance/conf/layer.conf
index d48feb9..9ccadab 100644
--- a/meta-security/meta-security-compliance/conf/layer.conf
+++ b/meta-security/meta-security-compliance/conf/layer.conf
@@ -8,8 +8,6 @@
BBFILE_PATTERN_scanners-layer = "^${LAYERDIR}/"
BBFILE_PRIORITY_scanners-layer = "10"
-LAYERSERIES_COMPAT_scanners-layer = "thud warrior"
+LAYERSERIES_COMPAT_scanners-layer = "warrior"
-LAYERDEPENDS_scanners-layer = " \
- core \
-"
+LAYERDEPENDS_scanners-layer = "core openembedded-layer meta-python"
diff --git a/meta-security/meta-security-compliance/recipes-auditors/lynis/lynis_2.7.2.bb b/meta-security/meta-security-compliance/recipes-auditors/lynis/lynis_2.7.5.bb
similarity index 89%
rename from meta-security/meta-security-compliance/recipes-auditors/lynis/lynis_2.7.2.bb
rename to meta-security/meta-security-compliance/recipes-auditors/lynis/lynis_2.7.5.bb
index 3ba82f9..21e4517 100644
--- a/meta-security/meta-security-compliance/recipes-auditors/lynis/lynis_2.7.2.bb
+++ b/meta-security/meta-security-compliance/recipes-auditors/lynis/lynis_2.7.5.bb
@@ -8,8 +8,8 @@
SRC_URI = "https://cisofy.com/files/${BPN}-${PV}.tar.gz"
-SRC_URI[md5sum] = "3422cee3b12fc33338fcde003d65e234"
-SRC_URI[sha256sum] = "fde6ccf8d6ec0ae1e9c9f4a6d640cddcde4bf7a92f8437d47d16a5477e21bfda"
+SRC_URI[md5sum] = "fb527b6976e70a6bcd57036c9cddc242"
+SRC_URI[sha256sum] = "3d27ade73a5c1248925ad9c060024940ce5d2029f40aaa901f43314888fe324d"
S = "${WORKDIR}/${BPN}"
diff --git a/meta-security/meta-security-compliance/recipes-openscap/openscap/files/crypto_pkgconfig.patch b/meta-security/meta-security-compliance/recipes-openscap/openscap/files/crypto_pkgconfig.patch
deleted file mode 100644
index 2d70855..0000000
--- a/meta-security/meta-security-compliance/recipes-openscap/openscap/files/crypto_pkgconfig.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-Index: git/configure.ac
-===================================================================
---- git.orig/configure.ac
-+++ git/configure.ac
-@@ -360,25 +360,13 @@ case "${with_crypto}" in
- AC_DEFINE([HAVE_NSS3], [1], [Define to 1 if you have 'NSS' library.])
- ;;
- gcrypt)
-- SAVE_LIBS=$LIBS
-- AC_CHECK_LIB([gcrypt], [gcry_check_version],
-- [crapi_CFLAGS=`libgcrypt-config --cflags`;
-- crapi_LIBS=`libgcrypt-config --libs`;
-- crapi_libname="GCrypt";],
-- [AC_MSG_ERROR([library 'gcrypt' is required for GCrypt.])],
-- [])
-- AC_DEFINE([HAVE_GCRYPT], [1], [Define to 1 if you have 'gcrypt' library.])
-- AC_CACHE_CHECK([for GCRYCTL_SET_ENFORCED_FIPS_FLAG],
-- [ac_cv_gcryctl_set_enforced_fips_flag],
-- [AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include<gcrypt.h>],
-- [return GCRYCTL_SET_ENFORCED_FIPS_FLAG;])],
-- [ac_cv_gcryctl_set_enforced_fips_flag=yes],
-- [ac_cv_gcryctl_set_enforced_fips_flag=no])])
-+ PKG_CHECK_MODULES([libgcrypt], [libgcrypt >= 1.7.9],[],
-+ AC_MSG_FAILURE([libgcrypt devel support is missing]))
-
-- if test "${ac_cv_gcryctl_set_enforced_fips_flag}" == "yes"; then
-- AC_DEFINE([HAVE_GCRYCTL_SET_ENFORCED_FIPS_FLAG], [1], [Define to 1 if you have 'gcrypt' library with GCRYCTL_SET_ENFORCED_FIPS_FLAG.])
-- fi
-- LIBS=$SAVE_LIBS
-+ crapi_libname="libgcrypt"
-+ crapi_CFLAGS=$libgcrypt_CFLAGS
-+ crapi_LIBS=$libgcrypt_LIBS
-+ AC_DEFINE([HAVE_GCRYPT], [1], [Define to 1 if you have 'libgcrypt' library.])
- ;;
- *)
- AC_MSG_ERROR([unknown crypto backend])
diff --git a/meta-security/meta-security-compliance/recipes-openscap/openscap/files/probe_dir_fixup.patch b/meta-security/meta-security-compliance/recipes-openscap/openscap/files/probe_dir_fixup.patch
deleted file mode 100644
index ecbe602..0000000
--- a/meta-security/meta-security-compliance/recipes-openscap/openscap/files/probe_dir_fixup.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-Index: git/configure.ac
-===================================================================
---- git.orig/configure.ac
-+++ git/configure.ac
-@@ -1109,11 +1109,7 @@ AC_ARG_WITH([crypto],
- [],
- [crypto=gcrypt])
-
--if test "x${libexecdir}" = xNONE; then
-- probe_dir="/usr/local/libexec/openscap"
--else
-- EXPAND_DIR(probe_dir,"${libexecdir}/openscap")
--fi
-+probe_dir="/usr/local/libexec/openscap"
-
- AC_SUBST(probe_dir)
-
diff --git a/meta-security/meta-security-compliance/recipes-openscap/openscap/files/run-ptest b/meta-security/meta-security-compliance/recipes-openscap/openscap/files/run-ptest
deleted file mode 100644
index 454a6a3..0000000
--- a/meta-security/meta-security-compliance/recipes-openscap/openscap/files/run-ptest
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/sh
-cd tests
-make -k check
diff --git a/meta-security/meta-security-compliance/recipes-openscap/openscap/openscap.inc b/meta-security/meta-security-compliance/recipes-openscap/openscap/openscap.inc
index e9589b6..53309e8 100644
--- a/meta-security/meta-security-compliance/recipes-openscap/openscap/openscap.inc
+++ b/meta-security/meta-security-compliance/recipes-openscap/openscap/openscap.inc
@@ -1,2 +1,55 @@
+# Copyright (C) 2017 Armin Kuster <akuster808@gmail.com>
+# Released under the MIT license (see COPYING.MIT for the terms)
+
+SUMARRY = "NIST Certified SCAP 1.2 toolkit"
+HOME_URL = "https://www.open-scap.org/tools/openscap-base/"
+LIC_FILES_CHKSUM = "file://COPYING;md5=fbc093901857fcd118f065f900982c24"
+LICENSE = "LGPL-2.1"
+
+DEPENDS = "dbus acl bzip2 pkgconfig gconf procps curl libxml2 libxslt libcap swig"
+DEPENDS_class-native = "pkgconfig-native swig-native curl-native libxml2-native libxslt-native libcap-native"
+
+S = "${WORKDIR}/git"
+
+inherit cmake pkgconfig python3native perlnative
+
+PACKAGECONFIG ?= "python3 rpm perl gcrypt ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'selinux', '', d)}"
+PACKAGECONFIG[python3] = "-DENABLE_PYTHON3=ON, ,python3, python3"
+PACKAGECONFIG[perl] = "-DENABLE_PERL=ON, ,perl, perl"
+PACKAGECONFIG[rpm] = "-DENABLE_OSCAP_UTIL_AS_RPM=ON, ,rpm, rpm"
+PACKAGECONFIG[gcrypt] = "-DWITH_CRYPTO=gcrypt, ,libgcrypt"
+PACKAGECONFIG[nss3] = "-DWITH_CRYPTO=nss3, ,nss"
+PACKAGECONFIG[selinux] = ", ,libselinux"
+
+EXTRA_OECMAKE += "-DENABLE_PROBES_LINUX=ON -DENABLE_PROBES_UNIX=ON \
+ -DENABLE_PROBES_SOLARIS=OFF -DENABLE_PROBES_INDEPENDENT=ON \
+ -DENABLE_OSCAP_UTIL=ON -DENABLE_OSCAP_UTIL_SSH=ON \
+ -DENABLE_OSCAP_UTIL_DOCKER=OFF -DENABLE_OSCAP_UTIL_CHROOT=OFF \
+ -DENABLE_OSCAP_UTIL_PODMAN=OFF -DENABLE_OSCAP_UTIL_VM=OFF \
+ -DENABLE_PROBES_WINDOWS=OFF -DENABLE_VALGRIND=OFF \
+ -DENABLE_SCE=ON -DENABLE_MITRE=OFF -DENABLE_TESTS=OFF \
+ -DCMAKE_SKIP_INSTALL_RPATH=ON -DCMAKE_SKIP_RPATH=ON \
+ "
+
STAGING_OSCAP_DIR = "${TMPDIR}/work-shared/${MACHINE}/oscap-source"
STAGING_OSCAP_BUILDDIR = "${TMPDIR}/work-shared/openscap/oscap-build-artifacts"
+
+do_configure_append_class-native () {
+ sed -i 's:OSCAP_DEFAULT_CPE_PATH.*$:OSCAP_DEFAULT_CPE_PATH "${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/cpe":' ${B}/config.h
+ sed -i 's:OSCAP_DEFAULT_SCHEMA_PATH.*$:OSCAP_DEFAULT_SCHEMA_PATH "${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/schemas":' ${B}/config.h
+ sed -i 's:OSCAP_DEFAULT_XSLT_PATH.*$:OSCAP_DEFAULT_XSLT_PATH "${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/xsl":' ${B}/config.h
+}
+
+do_clean[cleandirs] += "${STAGING_OSCAP_BUILDDIR}"
+
+do_install_append_class-native () {
+ oscapdir=${STAGING_OSCAP_BUILDDIR}/${datadir_native}
+ install -d $oscapdir
+ cp -a ${D}/${STAGING_DATADIR_NATIVE}/openscap $oscapdir
+}
+
+FILES_${PN} += "${PYTHON_SITEPACKAGES_DIR}"
+
+RDEPENDS_${PN} += "libxml2 python3 libgcc"
+
+BBCLASSEXTEND = "native"
diff --git a/meta-security/meta-security-compliance/recipes-openscap/openscap/openscap_1.2.17.bb b/meta-security/meta-security-compliance/recipes-openscap/openscap/openscap_1.2.17.bb
deleted file mode 100644
index e2a4fa2..0000000
--- a/meta-security/meta-security-compliance/recipes-openscap/openscap/openscap_1.2.17.bb
+++ /dev/null
@@ -1,87 +0,0 @@
-# Copyright (C) 2017 Armin Kuster <akuster808@gmail.com>
-# Released under the MIT license (see COPYING.MIT for the terms)
-
-SUMARRY = "NIST Certified SCAP 1.2 toolkit"
-HOME_URL = "https://www.open-scap.org/tools/openscap-base/"
-LIC_FILES_CHKSUM = "file://COPYING;md5=fbc093901857fcd118f065f900982c24"
-LICENSE = "LGPL-2.1"
-
-DEPENDS = "autoconf-archive pkgconfig gconf procps curl libxml2 rpm \
- libxslt libcap swig swig-native"
-
-DEPENDS_class-native = "autoconf-archive-native pkgconfig-native swig-native curl-native libxml2-native libxslt-native dpkg-native libgcrypt-native nss-native"
-
-SRCREV = "59c234b3e9907480c89dfbd1b466a6bf72a2d2ed"
-SRC_URI = "git://github.com/akuster/openscap.git;branch=oe \
- file://crypto_pkgconfig.patch \
- file://run-ptest \
-"
-
-inherit autotools-brokensep pkgconfig python3native perlnative ptest
-
-S = "${WORKDIR}/git"
-
-PACKAGECONFIG ?= "nss3 pcre rpm"
-PACKAGECONFIG[pcre] = ",--enable-regex-posix, libpcre"
-PACKAGECONFIG[gcrypt] = "--with-crypto=gcrypt,, libgcrypt "
-PACKAGECONFIG[nss3] = "--with-crypto=nss3,, nss"
-PACKAGECONFIG[python] = "--enable-python, --disable-python, python, python"
-PACKAGECONFIG[python3] = "--enable-python3, --disable-python3, python3, python3"
-PACKAGECONFIG[perl] = "--enable-perl, --disable-perl, perl, perl"
-PACKAGECONFIG[rpm] = " --enable-util-scap-as-rpm, --disable-util-scap-as-rpm, rpm, rpm"
-
-export LDFLAGS += " -ldl"
-
-EXTRA_OECONF += "--enable-probes-independent --enable-probes-linux \
- --enable-probes-solaris --enable-probes-unix --disable-util-oscap-docker\
- --enable-util-oscap-ssh --enable-util-oscap --enable-ssp --enable-sce \
-"
-
-EXTRA_OECONF_class-native += "--disable-probes-independent --enable-probes-linux \
- --disable-probes-solaris --disable-probes-unix \
- --enable-util-oscap \
-"
-
-do_configure_prepend () {
- sed -i 's:-I/usr/include:-I${STAGING_INCDIR}:' ${S}/swig/perl/Makefile.am
- sed -i 's:-I/usr/include:-I${STAGING_INCDIR}:' ${S}/swig/python3/Makefile.am
- sed -i 's:-I/usr/include:-I${STAGING_INCDIR}:' ${S}/swig/python2/Makefile.am
- sed -i 's:python2:python:' ${S}/utils/scap-as-rpm
-}
-
-
-include openscap.inc
-
-do_configure_append_class-native () {
- sed -i 's:OSCAP_DEFAULT_CPE_PATH.*$:OSCAP_DEFAULT_CPE_PATH "${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/cpe":' ${S}/config.h
- sed -i 's:OSCAP_DEFAULT_SCHEMA_PATH.*$:OSCAP_DEFAULT_SCHEMA_PATH "${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/schemas":' ${S}/config.h
- sed -i 's:OSCAP_DEFAULT_XSLT_PATH.*$:OSCAP_DEFAULT_XSLT_PATH "${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/xsl":' ${S}/config.h
-}
-
-do_clean[cleandirs] += " ${STAGING_OSCAP_BUILDDIR}"
-
-do_install_append_class-native () {
- oscapdir=${STAGING_OSCAP_BUILDDIR}/${datadir_native}
- install -d $oscapdir
- cp -a ${D}/${STAGING_DATADIR_NATIVE}/openscap $oscapdir
-}
-
-TESTDIR = "tests"
-
-do_compile_ptest() {
- sed -i 's:python2:python:' ${S}/${TESTDIR}/nist/test_worker.py
- echo 'buildtest-TESTS: $(check)' >> ${TESTDIR}/Makefile
- oe_runmake -C ${TESTDIR} buildtest-TESTS
-}
-
-do_install_ptest() {
- # install the tests
- cp -rf ${B}/${TESTDIR} ${D}${PTEST_PATH}
-}
-
-FILES_${PN} += "${PYTHON_SITEPACKAGES_DIR}"
-
-RDEPENDS_${PN} += "libxml2 python libgcc"
-RDEPENDS_${PN}-ptest = "bash perl python"
-
-BBCLASSEXTEND = "native"
diff --git a/meta-security/meta-security-compliance/recipes-openscap/openscap/openscap_1.3.1.bb b/meta-security/meta-security-compliance/recipes-openscap/openscap/openscap_1.3.1.bb
new file mode 100644
index 0000000..ad29efd
--- /dev/null
+++ b/meta-security/meta-security-compliance/recipes-openscap/openscap/openscap_1.3.1.bb
@@ -0,0 +1,9 @@
+SUMARRY = "NIST Certified SCAP 1.2 toolkit"
+
+require openscap.inc
+
+SRCREV = "3a4c635691380fa990a226acc8558db35d7ebabc"
+SRC_URI = "git://github.com/OpenSCAP/openscap.git;branch=maint-1.3 \
+"
+
+DEFAULT_PREFERENCE = "-1"
diff --git a/meta-security/meta-security-compliance/recipes-openscap/openscap/openscap_git.bb b/meta-security/meta-security-compliance/recipes-openscap/openscap/openscap_git.bb
new file mode 100644
index 0000000..963d3de
--- /dev/null
+++ b/meta-security/meta-security-compliance/recipes-openscap/openscap/openscap_git.bb
@@ -0,0 +1,12 @@
+# Copyright (C) 2017 Armin Kuster <akuster808@gmail.com>
+# Released under the MIT license (see COPYING.MIT for the terms)
+
+SUMARRY = "NIST Certified SCAP 1.2 toolkit with OE changes"
+
+include openscap.inc
+
+SRCREV = "4bbdb46ff651f809d5b38ca08d769790c4bfff90"
+SRC_URI = "git://github.com/akuster/openscap.git;branch=oe-1.3 \
+"
+
+PV = "1.3.1+git${SRCPV}"
diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide.inc b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide.inc
new file mode 100644
index 0000000..341721a
--- /dev/null
+++ b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide.inc
@@ -0,0 +1,31 @@
+# Copyright (C) 2017 Armin Kuster <akuster808@gmail.com>
+# Released under the MIT license (see COPYING.MIT for the terms)
+
+SUMARRY = "SCAP content for various platforms"
+HOME_URL = "https://www.open-scap.org/security-policies/scap-security-guide/"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=97662e4486d9a1d09f358851d9f41a1a"
+LICENSE = "LGPL-2.1"
+
+DEPENDS = "openscap-native python3 python3-pyyaml-native python3-jinja2-native libxml2-native"
+RDEPENDS_${PN} = "openscap"
+
+S = "${WORKDIR}/git"
+
+inherit cmake pkgconfig python3native
+
+#PARALLEL_MAKE = ""
+
+STAGING_OSCAP_BUILDDIR = "${TMPDIR}/work-shared/openscap/oscap-build-artifacts"
+
+OECMAKE_GENERATOR = "Unix Makefiles"
+
+EXTRA_OECMAKE += "-DENABLE_PYTHON_COVERAGE=OFF"
+
+B = "${S}/build"
+
+do_configure_prepend () {
+ sed -i -e 's:NAMES\ sed:NAMES\ ${HOSTTOOLS_DIR}/sed:g' ${S}/CMakeLists.txt
+ sed -i -e 's:NAMES\ grep:NAMES\ ${HOSTTOOLS_DIR}/grep:g' ${S}/CMakeLists.txt
+}
+
+FILES_${PN} += "${datadir}/xml"
diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_0.1.33.bb b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_0.1.33.bb
deleted file mode 100644
index 27d3d86..0000000
--- a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_0.1.33.bb
+++ /dev/null
@@ -1,59 +0,0 @@
-# Copyright (C) 2017 Armin Kuster <akuster808@gmail.com>
-# Released under the MIT license (see COPYING.MIT for the terms)
-
-SUMARRY = "SCAP content for various platforms"
-HOME_URL = "https://www.open-scap.org/security-policies/scap-security-guide/"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=236e81befc8154d18c93c848185d7e52"
-LICENSE = "LGPL-2.1"
-
-DEPENDS = "openscap-native"
-
-SRCREV = "423d9f40021a03abd018bef7818a3a9fe91a083c"
-SRC_URI = "git://github.com/akuster/scap-security-guide.git;branch=oe;"
-
-inherit cmake
-
-PARALLEL_MAKE = ""
-
-S = "${WORKDIR}/git"
-
-STAGING_OSCAP_BUILDDIR = "${TMPDIR}/work-shared/openscap/oscap-build-artifacts"
-
-OECMAKE_GENERATOR = "Unix Makefiles"
-
-EXTRA_OECMAKE += "-DSSG_PRODUCT_CHROMIUM:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_DEBIAN8:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_FEDORA:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_FIREFOX:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_JBOSS_EAP5:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_JBOSS_FUSE6:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_JRE:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_OPENSUSE:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_OSP7:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_RHEL5:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_RHEL6:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_RHEL7:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_RHEV3:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_SUSE11:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_SUSE12:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_UBUNTU1404:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_UBUNTU1604:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_WRLINUX:BOOL=OFF"
-EXTRA_OECMAKE += "-DSSG_PRODUCT_WEBMIN:BOOL=OFF"
-
-do_configure_prepend () {
- sed -i -e 's:NAMES\ sed:NAMES\ ${HOSTTOOLS_DIR}/sed:g' ${S}/CMakeLists.txt
- sed -i 's:/usr/share/openscap/:${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/:g' ${S}/cmake/SSGCommon.cmake
-}
-
-do_compile () {
- cd ${B}
- make openembedded
-}
-
-do_install () {
- cd ${B}
- make DESTDIR=${D} install
-}
-FILES_${PN} += "${datadir}/xml"
-RDEPNEDS_${PN} = "openscap"
diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_0.1.44.bb b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_0.1.44.bb
new file mode 100644
index 0000000..d80ecd7
--- /dev/null
+++ b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_0.1.44.bb
@@ -0,0 +1,8 @@
+SUMARRY = "SCAP content for various platforms, upstream version"
+
+SRCREV = "8cb2d0f351faff5440742258782281164953b0a6"
+SRC_URI = "git://github.com/ComplianceAsCode/content.git"
+
+DEFAULT_PREFERENCE = "-1"
+
+require scap-security-guide.inc
diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb
new file mode 100644
index 0000000..d9238c0
--- /dev/null
+++ b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb
@@ -0,0 +1,9 @@
+SUMARRY = "SCAP content for various platforms, OE changes"
+
+SRCREV = "5fdfdcb2e95afbd86ace555beca5d20cbf1043ed"
+SRC_URI = "git://github.com/akuster/scap-security-guide.git;branch=oe-0.1.44;"
+PV = "0.1.44+git${SRCPV}"
+
+require scap-security-guide.inc
+
+EXTRA_OECMAKE += "-DSSG_PRODUCT_OPENEMBEDDED=ON"
diff --git a/meta-security/meta-tpm/conf/layer.conf b/meta-security/meta-tpm/conf/layer.conf
index bf9a76e..cdccc55 100644
--- a/meta-security/meta-tpm/conf/layer.conf
+++ b/meta-security/meta-tpm/conf/layer.conf
@@ -8,7 +8,7 @@
BBFILE_PATTERN_tpm-layer = "^${LAYERDIR}/"
BBFILE_PRIORITY_tpm-layer = "10"
-LAYERSERIES_COMPAT_tpm-layer = "thud warrior"
+LAYERSERIES_COMPAT_tpm-layer = "warrior"
LAYERDEPENDS_tpm-layer = " \
core \
diff --git a/meta-security/meta-tpm/lib/oeqa/runtime/cases/tpm2.py b/meta-security/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
index 240a9b3..c6f9d92 100644
--- a/meta-security/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
+++ b/meta-security/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
@@ -16,9 +16,9 @@
if expected_endlines:
self.fail('Missing expected line endings:\n %s' % '\n '.join(expected_endlines))
- @OEHasPackage(['tpm2.0-tss'])
+ @OEHasPackage(['tpm2-tss'])
@OEHasPackage(['tpm2-abrmd'])
- @OEHasPackage(['tpm2.0-tools'])
+ @OEHasPackage(['tpm2-tools'])
@OEHasPackage(['ibmswtpm2'])
@OETestDepends(['ssh.SSHTest.test_ssh'])
def test_tpm2_sim(self):
diff --git a/meta-security/meta-tpm/recipes-core/images/security-tpm-image.bb b/meta-security/meta-tpm/recipes-core/images/security-tpm-image.bb
index a337076..dbdd309 100644
--- a/meta-security/meta-tpm/recipes-core/images/security-tpm-image.bb
+++ b/meta-security/meta-tpm/recipes-core/images/security-tpm-image.bb
@@ -1,14 +1,13 @@
-DESCRIPTION = "A small image for building meta-security packages"
+DESCRIPTION = "A small image for building a tpm image for testing"
IMAGE_FEATURES += "ssh-server-openssh"
IMAGE_INSTALL = "\
packagegroup-base \
packagegroup-core-boot \
- ${@bb.utils.contains('MACHINE_FEATURES', 'tpm', 'packagegroup-security-tpm', '', d)} \
- ${@bb.utils.contains('MACHINE_FEATURES', 'tpm2', 'packagegroup-security-tpm2', '', d)} \
+ packagegroup-security-tpm \
os-release \
- ${CORE_IMAGE_EXTRA_INSTALL}"
+"
IMAGE_LINGUAS ?= " "
diff --git a/meta-security/meta-tpm/recipes-core/images/security-tpm2-image.bb b/meta-security/meta-tpm/recipes-core/images/security-tpm2-image.bb
new file mode 100644
index 0000000..7e047d1
--- /dev/null
+++ b/meta-security/meta-tpm/recipes-core/images/security-tpm2-image.bb
@@ -0,0 +1,18 @@
+DESCRIPTION = "A small image for building a tpm2 image for testing"
+
+IMAGE_FEATURES += "ssh-server-openssh"
+
+IMAGE_INSTALL = "\
+ packagegroup-base \
+ packagegroup-core-boot \
+ packagegroup-security-tpm2 \
+ os-release \
+"
+
+IMAGE_LINGUAS ?= " "
+
+LICENSE = "MIT"
+
+inherit core-image
+
+export IMAGE_BASENAME = "security-tpm2-image"
diff --git a/meta-security/meta-tpm/recipes-core/packagegroup/packagegroup-security-tpm2.bb b/meta-security/meta-tpm/recipes-core/packagegroup/packagegroup-security-tpm2.bb
index 5ded3a2..8f5c537 100644
--- a/meta-security/meta-tpm/recipes-core/packagegroup/packagegroup-security-tpm2.bb
+++ b/meta-security/meta-tpm/recipes-core/packagegroup/packagegroup-security-tpm2.bb
@@ -5,19 +5,19 @@
inherit packagegroup
-PACKAGES = "packagegroup-security-tpm2"
+PACKAGES = "${PN}"
SUMMARY_packagegroup-security-tpm2 = "Security TPM 2.0 support"
RDEPENDS_packagegroup-security-tpm2 = " \
tpm2-tools \
trousers \
+ tpm2-tss \
libtss2 \
+ libtss2-mu \
libtss2-tcti-device \
libtss2-tcti-mssim \
tpm2-abrmd \
tpm2-pkcs11 \
+ ibmswtpm2 \
cryptsetup-tpm-incubator \
"
-
-RDEPENDS_packagegroup-security-tpm2_append_x86 = " tpm2-tcti-uefi"
-RDEPENDS_packagegroup-security-tpm2_append_x86-64 = " tpm2-tcti-uefi"
diff --git a/meta-security/meta-tpm/recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_0.9.9.bb b/meta-security/meta-tpm/recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_0.9.9.bb
index 9031e63..222bb6d 100644
--- a/meta-security/meta-tpm/recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_0.9.9.bb
+++ b/meta-security/meta-tpm/recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_0.9.9.bb
@@ -2,7 +2,7 @@
DESCRIPTION = "PKCS #11 is a Public-Key Cryptography Standard that defines a standard method to access cryptographic services from tokens/ devices such as hardware security modules (HSM), smart cards, etc. In this project we intend to use a TPM2 device as the cryptographic token."
SECTION = "security/tpm"
LICENSE = "BSD-2-Clause"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=b748af41ef1300c98e105b3b7ec4ecc1"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=93645981214b60a02688745c14f93c95"
DEPENDS = "autoconf-archive pkgconfig dstat sqlite3 openssl libtss2-dev tpm2-tools"
@@ -10,7 +10,7 @@
file://bootstrap_fixup.patch \
"
-SRCREV = "3107d89b406ecd9c007884613733c9a344ef6d39"
+SRCREV = "9eed9df823a960da481327468a73d477241befdb"
S = "${WORKDIR}/git"
diff --git a/meta-security/meta-tpm/recipes-tpm2/tpm2-tcti-uefi/tpm2-tcti-uefi/0001-configure.ac-stop-inserting-host-directories-into-co.patch b/meta-security/meta-tpm/recipes-tpm2/tpm2-tcti-uefi/tpm2-tcti-uefi/0001-configure.ac-stop-inserting-host-directories-into-co.patch
new file mode 100644
index 0000000..3b54ddd
--- /dev/null
+++ b/meta-security/meta-tpm/recipes-tpm2/tpm2-tcti-uefi/tpm2-tcti-uefi/0001-configure.ac-stop-inserting-host-directories-into-co.patch
@@ -0,0 +1,27 @@
+From b74837184cfdefb45e48f3fdc974fc67691fc861 Mon Sep 17 00:00:00 2001
+From: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
+Date: Wed, 3 Jul 2019 19:16:35 +0300
+Subject: [PATCH] configure.ac: stop inserting host directories into compile
+ path
+
+Do not insert /usr/lib and /usr/lib64 into library search path.
+
+Upstream-Status: OE specific
+Signed-off-by: Dmitry Eremin-Solenikov <dmitry_eremin-solenikov@mentor.com>
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: git/configure.ac
+===================================================================
+--- git.orig/configure.ac
++++ git/configure.ac
+@@ -81,7 +81,7 @@ AC_ARG_WITH([efi-lds],
+ AS_HELP_STRING([--with-efi-lds=LDS_PATH],[Path to gnu-efi lds file.]),
+ [],
+ [with_efi_lds="/usr/lib/elf_${ARCH}_efi.lds"])
+-EXTRA_LDFLAGS="-L /usr/lib -L /usr/lib64 -Wl,--script=${with_efi_lds}"
++EXTRA_LDFLAGS="-Wl,--script=${with_efi_lds}"
+
+ # path to object file from gnu-efi
+ AC_ARG_WITH([efi-crt0],
diff --git a/meta-security/meta-tpm/recipes-tpm2/tpm2-tcti-uefi/tpm2-tcti-uefi_0.9.9.bb b/meta-security/meta-tpm/recipes-tpm2/tpm2-tcti-uefi/tpm2-tcti-uefi_0.9.9.bb
index 815691d..e822e29 100644
--- a/meta-security/meta-tpm/recipes-tpm2/tpm2-tcti-uefi/tpm2-tcti-uefi_0.9.9.bb
+++ b/meta-security/meta-tpm/recipes-tpm2/tpm2-tcti-uefi/tpm2-tcti-uefi_0.9.9.bb
@@ -2,17 +2,38 @@
SECTION = "security/tpm"
LICENSE = "BSD-2-Clause"
LIC_FILES_CHKSUM = "file://LICENSE;md5=500b2e742befc3da00684d8a1d5fd9da"
-DEPENDS = "libtss2-dev gnu-efi-native gnu-efi pkgconfig"
+DEPENDS = "libtss2-dev gnu-efi-native gnu-efi pkgconfig autoconf-archive-native"
SRC_URI = "git://github.com/tpm2-software/tpm2-tcti-uefi.git \
file://configure_oe_fixup.patch \
+ file://0001-configure.ac-stop-inserting-host-directories-into-co.patch \
"
-SRCREV = "131889d12d2c7d8974711d2ebd1032cd32577b7f"
+SRCREV = "7baf1eebfeb56a896bdd5d677fb24377d619eb9d"
S = "${WORKDIR}/git"
inherit autotools pkgconfig
+EFIDIR ?= "/EFI/BOOT"
+
+do_compile_append() {
+ oe_runmake example
+}
+
+do_install_append() {
+ install -d "${D}${EFIDIR}"
+ install -m 0755 "${B}"/example/*.efi "${D}${EFIDIR}"
+}
+
+EFI_ARCH_x86 = "ia32"
+EFI_ARCH_x86-64 = "x86_64"
+
COMPATIBLE_HOST = "(i.86|x86_64).*-linux"
-EXTRA_OECONF_append = " --with-efi-includedir=${STAGING_INCDIR}/efi --with-efi-lds=${STAGING_LIBDIR_NATIVE}/"
+EXTRA_OECONF_append = "\
+ --with-efi-includedir=${STAGING_INCDIR}/efi \
+ --with-efi-crt0=${STAGING_LIBDIR_NATIVE}/crt0-efi-${EFI_ARCH}.o \
+ --with-efi-lds=${STAGING_LIBDIR_NATIVE}/elf_${EFI_ARCH}_efi.lds \
+"
RDEPENDS_${PN} = "gnu-efi"
+
+FILES_${PN} += "${EFIDIR}"
diff --git a/meta-security/meta-tpm/recipes-tpm2/tpm2-tools/tpm2-tools_3.1.3.bb b/meta-security/meta-tpm/recipes-tpm2/tpm2-tools/tpm2-tools_3.2.0.bb
similarity index 86%
rename from meta-security/meta-tpm/recipes-tpm2/tpm2-tools/tpm2-tools_3.1.3.bb
rename to meta-security/meta-tpm/recipes-tpm2/tpm2-tools/tpm2-tools_3.2.0.bb
index 1f1f5c6..b6f1be0 100644
--- a/meta-security/meta-tpm/recipes-tpm2/tpm2-tools/tpm2-tools_3.1.3.bb
+++ b/meta-security/meta-tpm/recipes-tpm2/tpm2-tools/tpm2-tools_3.2.0.bb
@@ -6,7 +6,7 @@
DEPENDS = "pkgconfig tpm2-tss openssl curl autoconf-archive"
-SRCREV = "74ba065e5914bc5d713ca3709d62a5751b097369"
+SRCREV = "a17daa948fc67685651bf3b7a589ed341080ddd3"
SRC_URI = "git://github.com/tpm2-software/tpm2-tools.git;branch=3.X"
diff --git a/meta-security/meta-tpm/recipes-tpm2/tpm2-totp/tpm2-totp_0.1.1.bb b/meta-security/meta-tpm/recipes-tpm2/tpm2-totp/tpm2-totp_0.1.1.bb
new file mode 100644
index 0000000..d47b756
--- /dev/null
+++ b/meta-security/meta-tpm/recipes-tpm2/tpm2-totp/tpm2-totp_0.1.1.bb
@@ -0,0 +1,18 @@
+SUMMARY = "Attest the trustworthiness of a device against a human using time-based one-time passwords"
+
+LICENSE = "BSD-3-Clause"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=ed23833e93c95173c8d8913745e4b4e1"
+
+SECTION = "security/tpm"
+
+DEPENDS = "autoconf-archive libtss2-dev qrencode"
+
+PE = "1"
+
+SRCREV = "2807a509a9da383e14dc0f759e71fd676db04ab1"
+SRC_URI = "git://github.com/tpm2-software/tpm2-totp.git;branch=v0.1.x \
+ file://litpm2_totp_build_fix.patch "
+
+inherit autotools-brokensep pkgconfig
+
+S = "${WORKDIR}/git"
diff --git a/meta-security/meta-tpm/recipes-tpm2/tpm2-totp/tpm2-totp_0.9.9.bb b/meta-security/meta-tpm/recipes-tpm2/tpm2-totp/tpm2-totp_0.9.9.bb
deleted file mode 100644
index bc94ab7..0000000
--- a/meta-security/meta-tpm/recipes-tpm2/tpm2-totp/tpm2-totp_0.9.9.bb
+++ /dev/null
@@ -1,17 +0,0 @@
-SUMMARY = "The tpm2-tss-engine project implements a cryptographic engine for OpenSSL."
-DESCRIPTION = "The tpm2-tss-engine project implements a cryptographic engine for OpenSSL for Trusted Platform Module (TPM 2.0) using the tpm2-tss software stack that follows the Trusted Computing Groups (TCG) TPM Software Stack (TSS 2.0). It uses the Enhanced System API (ESAPI) interface of the TSS 2.0 for downwards communication. It supports RSA decryption and signatures as well as ECDSA signatures."
-
-LICENSE = "BSD-2-Clause"
-LIC_FILES_CHKSUM = "file://LICENSE;md5=ed23833e93c95173c8d8913745e4b4e1"
-
-SECTION = "security/tpm"
-
-DEPENDS = "autoconf-archive libtss2-dev qrencode"
-
-SRCREV = "44fcb6819f79302d5a088b3def648616e3551d4a"
-SRC_URI = "git://github.com/tpm2-software/tpm2-totp.git \
- file://litpm2_totp_build_fix.patch "
-
-inherit autotools-brokensep pkgconfig
-
-S = "${WORKDIR}/git"
diff --git a/meta-security/meta-tpm/recipes-tpm2/tpm2-tss-engine/tpm2-tss-engine_0.9.9.bb b/meta-security/meta-tpm/recipes-tpm2/tpm2-tss-engine/tpm2-tss-engine_1.0.0.bb
similarity index 95%
rename from meta-security/meta-tpm/recipes-tpm2/tpm2-tss-engine/tpm2-tss-engine_0.9.9.bb
rename to meta-security/meta-tpm/recipes-tpm2/tpm2-tss-engine/tpm2-tss-engine_1.0.0.bb
index 36530be..0a8d54f 100644
--- a/meta-security/meta-tpm/recipes-tpm2/tpm2-tss-engine/tpm2-tss-engine_0.9.9.bb
+++ b/meta-security/meta-tpm/recipes-tpm2/tpm2-tss-engine/tpm2-tss-engine_1.0.0.bb
@@ -8,7 +8,7 @@
DEPENDS = "autoconf-archive-native bash-completion libtss2 libgcrypt openssl"
-SRCREV = "bef89ec79cbb4c99963b0e336d9184827c545782"
+SRCREV = "a81d44a8610e28e5987af64f8aae16e4a2d09eaa"
SRC_URI = "git://github.com/tpm2-software/tpm2-tss-engine.git"
inherit autotools-brokensep pkgconfig systemd
diff --git a/meta-security/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss/0001-build-update-for-ax_code_coverage.m4-version-2019.01.patch b/meta-security/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss/0001-build-update-for-ax_code_coverage.m4-version-2019.01.patch
new file mode 100644
index 0000000..86b2cb6
--- /dev/null
+++ b/meta-security/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss/0001-build-update-for-ax_code_coverage.m4-version-2019.01.patch
@@ -0,0 +1,84 @@
+From ec08ab41495ac40641475707c46e844503ada5b3 Mon Sep 17 00:00:00 2001
+From: Jonas Witschel <diabonas@gmx.de>
+Date: Mon, 7 Jan 2019 22:15:06 +0100
+Subject: [PATCH] build: update for ax_code_coverage.m4 version 2019.01.06
+
+@CODE_COVERAGE_RULES@ doesn't exist any more and needs to be replaced.
+Also includes a compatibility switch for older versions of the file.
+
+Signed-off-by: Jonas Witschel <diabonas@gmx.de>
+---
+ .gitignore | 1 +
+ .travis.yml | 10 +++++-----
+ Makefile.am | 6 ++++++
+ configure.ac | 3 +++
+ 4 files changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/.gitignore b/.gitignore
+index 7c6a7b62e6c1..aa1a7efdff71 100644
+--- a/.gitignore
++++ b/.gitignore
+@@ -26,6 +26,7 @@
+ AUTHORS
+ tags
+ aclocal.m4
++aminclude_static.am
+ autom4te.cache/
+ [Bb]uild/
+ [Dd]ebug/
+diff --git a/.travis.yml b/.travis.yml
+index 55f88e22999b..a668e2953dc2 100644
+--- a/.travis.yml
++++ b/.travis.yml
+@@ -44,11 +44,11 @@ addons:
+
+ install:
+ # Autoconf archive
+- - wget https://download.01.org/tpm2/autoconf-archive-2017.09.28.tar.xz
+- - sha256sum autoconf-archive-2017.09.28.tar.xz | grep -q 5c9fb5845b38b28982a3ef12836f76b35f46799ef4a2e46b48e2bd3c6182fa01 || travis_terminate 1
+- - tar xJf autoconf-archive-2017.09.28.tar.xz
+- - cp autoconf-archive-2017.09.28/m4/ax_code_coverage.m4 m4/
+- - cp autoconf-archive-2017.09.28/m4/ax_prog_doxygen.m4 m4/
++ - wget http://ftpmirror.gnu.org/autoconf-archive/autoconf-archive-2019.01.06.tar.xz
++ - sha256sum autoconf-archive-2019.01.06.tar.xz | grep -q 17195c833098da79de5778ee90948f4c5d90ed1a0cf8391b4ab348e2ec511e3f || travis_terminate 1
++ - tar xJf autoconf-archive-2019.01.06.tar.xz
++ - cp autoconf-archive-2019.01.06/m4/ax_code_coverage.m4 m4/
++ - cp autoconf-archive-2019.01.06/m4/ax_prog_doxygen.m4 m4/
+ # IBM-TPM
+ - wget https://download.01.org/tpm2/ibmtpm974.tar.gz
+ # OpenSSL 1.0.2
+diff --git a/Makefile.am b/Makefile.am
+index 1b792d89a392..8e62e9c77c7d 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -19,7 +19,13 @@ noinst_PROGRAMS =
+
+ ### Add ax_* rules ###
+ # ax_code_coverage
++if AUTOCONF_CODE_COVERAGE_2019_01_06
++include $(top_srcdir)/aminclude_static.am
++clean-local: code-coverage-clean
++dist-clean-local: code-coverage-dist-clean
++else
+ @CODE_COVERAGE_RULES@
++endif
+
+ # ax_doxygen
+ @DX_RULES@
+diff --git a/configure.ac b/configure.ac
+index 6c7b0fd96399..22b79c50c015 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -312,6 +312,9 @@ AS_IF([test "x$enable_doxygen_doc" != xno],
+ [ERROR_IF_NO_PROG([doxygen])])
+
+ AX_CODE_COVERAGE
++m4_ifdef([_AX_CODE_COVERAGE_RULES],
++ [AM_CONDITIONAL(AUTOCONF_CODE_COVERAGE_2019_01_06, [true])],
++ [AM_CONDITIONAL(AUTOCONF_CODE_COVERAGE_2019_01_06, [false])])
+
+ AC_OUTPUT
+
+--
+2.20.1
+
diff --git a/meta-security/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_2.2.1.bb b/meta-security/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_2.2.3.bb
similarity index 93%
rename from meta-security/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_2.2.1.bb
rename to meta-security/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_2.2.3.bb
index 78bdeeb..ffbd3f4 100644
--- a/meta-security/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_2.2.1.bb
+++ b/meta-security/meta-tpm/recipes-tpm2/tpm2-tss/tpm2-tss_2.2.3.bb
@@ -6,9 +6,10 @@
DEPENDS = "autoconf-archive-native libgcrypt openssl"
-SRCREV = "eb69e13559f20a0b49002a685c6f4a39be9503e2"
+SRCREV = "36b1539c82bf675265d6f6a6cd808a189b6971f4"
-SRC_URI = "git://github.com/tpm2-software/tpm2-tss.git;branch=2.2.x"
+SRC_URI = "git://github.com/tpm2-software/tpm2-tss.git;branch=2.2.x \
+ file://0001-build-update-for-ax_code_coverage.m4-version-2019.01.patch"
inherit autotools-brokensep pkgconfig systemd
diff --git a/meta-security/recipes-ids/samhain/files/samhain-cross-compile.patch b/meta-security/recipes-ids/samhain/files/samhain-cross-compile.patch
deleted file mode 100644
index 7f80a5c..0000000
--- a/meta-security/recipes-ids/samhain/files/samhain-cross-compile.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From f63908427b2adb1792c59edbe38618e14ef5bc7b Mon Sep 17 00:00:00 2001
-From: Jackie Huang <jackie.huang@windriver.com>
-Date: Fri, 15 Jan 2016 00:48:58 -0500
-Subject: [PATCH] Enable obfuscating binaries natively.
-
-Enable obfuscating binaries natively.
-
-The samhain build process involves an obfuscation step that attempts to
-defeat decompilation or other binary analysis techniques which might reveal
-secret information that should be known only to the system administrator.
-The obfuscation step builds several applications which run on the build host
-and then generate target code, which is then built into target binaries.
-
-This patch creates a basic infrastructure that supports building the
-obfuscation binaries natively then cross-compiling the target code by adding
-a special configure option. In the absence of this option the old behaviour
-is preserved.
-
-Upstream-Status: Inappropriate [cross compile specific]
-
-Signed-off-by: Aws Ismail <aws.ismail@windriver.com>
-Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
----
- Makefile.in | 4 +---
- 1 file changed, 1 insertion(+), 3 deletions(-)
-
-diff --git a/Makefile.in b/Makefile.in
-index 684e92b..fb090e2 100644
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -54,7 +54,7 @@ selectconfig = @selectconfig@
- top_builddir = .
-
- INSTALL = @INSTALL@
--INSTALL_PROGRAM = @INSTALL@ -s -m 700
-+INSTALL_PROGRAM = @INSTALL@ -m 700
- INSTALL_SHELL = @INSTALL@ -m 700
- INSTALL_DATA = @INSTALL@ -m 600
- INSTALL_MAN = @INSTALL@ -m 644
-@@ -525,8 +525,6 @@ install-program: $(PROGRAMS) sstrip
- echo " $(INSTALL_PROGRAM) $$p $$target"; \
- $(INSTALL_PROGRAM) $$p $$target; \
- chmod 0700 $$target; \
-- echo " ./sstrip $$target"; \
-- ./sstrip $$target; \
- else \
- echo " $(INSTALL_SHELL) $$p $$target"; \
- $(INSTALL_SHELL) $$p $$target; \
---
-1.9.1
-
diff --git a/meta-security/recipes-ids/samhain/samhain-client_4.3.2.bb b/meta-security/recipes-ids/samhain/samhain-client.bb
similarity index 100%
rename from meta-security/recipes-ids/samhain/samhain-client_4.3.2.bb
rename to meta-security/recipes-ids/samhain/samhain-client.bb
diff --git a/meta-security/recipes-ids/samhain/samhain-server_4.3.2.bb b/meta-security/recipes-ids/samhain/samhain-server.bb
similarity index 100%
rename from meta-security/recipes-ids/samhain/samhain-server_4.3.2.bb
rename to meta-security/recipes-ids/samhain/samhain-server.bb
diff --git a/meta-security/recipes-ids/samhain/samhain-standalone_4.3.2.bb b/meta-security/recipes-ids/samhain/samhain-standalone.bb
similarity index 100%
rename from meta-security/recipes-ids/samhain/samhain-standalone_4.3.2.bb
rename to meta-security/recipes-ids/samhain/samhain-standalone.bb
diff --git a/meta-security/recipes-ids/samhain/samhain.inc b/meta-security/recipes-ids/samhain/samhain.inc
index 1b9af39..16222ba 100644
--- a/meta-security/recipes-ids/samhain/samhain.inc
+++ b/meta-security/recipes-ids/samhain/samhain.inc
@@ -3,9 +3,9 @@
LICENSE = "GPLv2"
LIC_FILES_CHKSUM = "file://LICENSE;md5=8ca43cbc842c2336e835926c2166c28b"
+PV = "4.3.3"
SRC_URI = "http://la-samhna.de/archive/samhain_signed-${PV}.tar.gz \
- file://samhain-cross-compile.patch \
file://samhain-mips64-aarch64-dnmalloc-hash-fix.patch \
file://samhain-samhainrc.patch \
file://samhain-samhainrc-fix-files-dirs-path.patch \
@@ -19,8 +19,8 @@
file://samhain.service \
"
-SRC_URI[md5sum] = "eae4674164d7c78f5bb39c72b7029c8b"
-SRC_URI[sha256sum] = "0582864ef56ab796031e8e611ed66c48adeb3a30ec34e1a8d0088572442035fc"
+SRC_URI[md5sum] = "7be46ae7d03f53ba21afafd41cff8926"
+SRC_URI[sha256sum] = "33ad4bc3dad4699694553bd9635a6b5827939f965d1f0f05fce0b4e9cdadf21b"
UPSTREAM_CHECK_URI = "https://www.la-samhna.de/samhain/archive.html"
UPSTREAM_CHECK_REGEX = "samhain_signed-(?P<pver>(\d+(\.\d+)+))\.tar"
diff --git a/meta-security/recipes-kernel/linux/linux-stable_5.2.bbappend b/meta-security/recipes-kernel/linux/linux-stable_5.2.bbappend
new file mode 100644
index 0000000..76b5df5
--- /dev/null
+++ b/meta-security/recipes-kernel/linux/linux-stable_5.2.bbappend
@@ -0,0 +1,4 @@
+KERNEL_FEATURES_append = " ${@bb.utils.contains("DISTRO_FEATURES", "apparmor", " features/apparmor/apparmor.scc", "" ,d)}"
+KERNEL_FEATURES_append = " ${@bb.utils.contains("DISTRO_FEATURES", "smack", " features/smack/smack.scc", "" ,d)}"
+KERNEL_FEATURES_append = " ${@bb.utils.contains("DISTRO_FEATURES", "yama", " features/yama/yama.scc", "" ,d)}"
+
diff --git a/meta-security/recipes-kernel/linux/linux-yocto-5.0/apparmor.cfg b/meta-security/recipes-kernel/linux/linux-yocto-5.0/apparmor.cfg
deleted file mode 100644
index ae6cdcd..0000000
--- a/meta-security/recipes-kernel/linux/linux-yocto-5.0/apparmor.cfg
+++ /dev/null
@@ -1,9 +0,0 @@
-CONFIG_AUDIT=y
-CONFIG_SECURITY_PATH=y
-CONFIG_SECURITY_APPARMOR=y
-CONFIG_SECURITY_APPARMOR_HASH=y
-CONFIG_SECURITY_APPARMOR_HASH_DEFAULT=y
-CONFIG_INTEGRITY_AUDIT=y
-CONFIG_DEFAULT_SECURITY_APPARMOR=y
-CONFIG_DEFAULT_SECURITY="apparmor"
-CONFIG_AUDIT_GENERIC=y
diff --git a/meta-security/recipes-kernel/linux/linux-yocto-5.0/apparmor_on_boot.cfg b/meta-security/recipes-kernel/linux/linux-yocto-5.0/apparmor_on_boot.cfg
deleted file mode 100644
index fc35740..0000000
--- a/meta-security/recipes-kernel/linux/linux-yocto-5.0/apparmor_on_boot.cfg
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
diff --git a/meta-security/recipes-kernel/linux/linux-yocto-5.0/smack-default-lsm.cfg b/meta-security/recipes-kernel/linux/linux-yocto-5.0/smack-default-lsm.cfg
deleted file mode 100644
index b5c4845..0000000
--- a/meta-security/recipes-kernel/linux/linux-yocto-5.0/smack-default-lsm.cfg
+++ /dev/null
@@ -1,2 +0,0 @@
-CONFIG_DEFAULT_SECURITY="smack"
-CONFIG_DEFAULT_SECURITY_SMACK=y
diff --git a/meta-security/recipes-kernel/linux/linux-yocto-5.0/smack.cfg b/meta-security/recipes-kernel/linux/linux-yocto-5.0/smack.cfg
deleted file mode 100644
index 0d5fc64..0000000
--- a/meta-security/recipes-kernel/linux/linux-yocto-5.0/smack.cfg
+++ /dev/null
@@ -1,7 +0,0 @@
-CONFIG_NETLABEL=y
-CONFIG_SECURITY_NETWORK=y
-# CONFIG_SECURITY_NETWORK_XFRM is not set
-CONFIG_SECURITY_SMACK=y
-CONFIG_SECURITY_SMACK_BRINGUP=y
-CONFIG_SECURITY_SMACK_APPEND_SIGNALS=y
-CONFIG_TMPFS_XATTR=y
diff --git a/meta-security/recipes-kernel/linux/linux-yocto-dev.bbappend b/meta-security/recipes-kernel/linux/linux-yocto-dev.bbappend
new file mode 100644
index 0000000..239e30e
--- /dev/null
+++ b/meta-security/recipes-kernel/linux/linux-yocto-dev.bbappend
@@ -0,0 +1,2 @@
+KERNEL_FEATURES_append = " ${@bb.utils.contains("DISTRO_FEATURES", "apparmor", " features/apparmor/apparmor.scc", "" ,d)}"
++KERNEL_FEATURES_append = " ${@bb.utils.contains("DISTRO_FEATURES", "smack", " features/smack/smack.scc", "" ,d)}"
diff --git a/meta-security/recipes-kernel/linux/linux-yocto/apparmor.cfg b/meta-security/recipes-kernel/linux/linux-yocto/apparmor.cfg
deleted file mode 100644
index b5f9bb2..0000000
--- a/meta-security/recipes-kernel/linux/linux-yocto/apparmor.cfg
+++ /dev/null
@@ -1,15 +0,0 @@
-CONFIG_AUDIT=y
-# CONFIG_NETFILTER_XT_TARGET_AUDIT is not set
-CONFIG_SECURITY_NETWORK=y
-# CONFIG_SECURITY_NETWORK_XFRM is not set
-CONFIG_SECURITY_PATH=y
-# CONFIG_SECURITY_SELINUX is not set
-CONFIG_SECURITY_APPARMOR=y
-CONFIG_SECURITY_APPARMOR_HASH=y
-CONFIG_SECURITY_APPARMOR_HASH_DEFAULT=y
-# CONFIG_SECURITY_APPARMOR_DEBUG is not set
-CONFIG_INTEGRITY_AUDIT=y
-CONFIG_DEFAULT_SECURITY_APPARMOR=y
-# CONFIG_DEFAULT_SECURITY_DAC is not set
-CONFIG_DEFAULT_SECURITY="apparmor"
-CONFIG_AUDIT_GENERIC=y
diff --git a/meta-security/recipes-kernel/linux/linux-yocto/apparmor_on_boot.cfg b/meta-security/recipes-kernel/linux/linux-yocto/apparmor_on_boot.cfg
deleted file mode 100644
index fc35740..0000000
--- a/meta-security/recipes-kernel/linux/linux-yocto/apparmor_on_boot.cfg
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
diff --git a/meta-security/recipes-kernel/linux/linux-yocto/smack-default-lsm.cfg b/meta-security/recipes-kernel/linux/linux-yocto/smack-default-lsm.cfg
deleted file mode 100644
index b5c4845..0000000
--- a/meta-security/recipes-kernel/linux/linux-yocto/smack-default-lsm.cfg
+++ /dev/null
@@ -1,2 +0,0 @@
-CONFIG_DEFAULT_SECURITY="smack"
-CONFIG_DEFAULT_SECURITY_SMACK=y
diff --git a/meta-security/recipes-kernel/linux/linux-yocto/smack.cfg b/meta-security/recipes-kernel/linux/linux-yocto/smack.cfg
deleted file mode 100644
index 62f465a..0000000
--- a/meta-security/recipes-kernel/linux/linux-yocto/smack.cfg
+++ /dev/null
@@ -1,8 +0,0 @@
-CONFIG_IP_NF_SECURITY=m
-CONFIG_IP6_NF_SECURITY=m
-CONFIG_EXT2_FS_SECURITY=y
-CONFIG_EXT3_FS_SECURITY=y
-CONFIG_EXT4_FS_SECURITY=y
-CONFIG_SECURITY=y
-CONFIG_SECURITY_SMACK=y
-CONFIG_TMPFS_XATTR=y
diff --git a/meta-security/recipes-kernel/linux/linux-yocto_4.%.bbappend b/meta-security/recipes-kernel/linux/linux-yocto_4.%.bbappend
index 321392c..39d4e6f 100644
--- a/meta-security/recipes-kernel/linux/linux-yocto_4.%.bbappend
+++ b/meta-security/recipes-kernel/linux/linux-yocto_4.%.bbappend
@@ -1,11 +1,2 @@
-FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:"
-
-SRC_URI += "\
- ${@bb.utils.contains('DISTRO_FEATURES', 'apparmor', ' file://apparmor.cfg', '', d)} \
- ${@bb.utils.contains('DISTRO_FEATURES', 'apparmor', ' file://apparmor_on_boot.cfg', '', d)} \
-"
-
-SRC_URI += "\
- ${@bb.utils.contains('DISTRO_FEATURES', 'smack', ' file://smack.cfg', '', d)} \
- ${@bb.utils.contains('DISTRO_FEATURES', 'smack', ' file://smack-default-lsm.cfg', '', d)} \
-"
+KERNEL_FEATURES_append = " ${@bb.utils.contains("DISTRO_FEATURES", "apparmor", " features/apparmor/apparmor.scc", "" ,d)}"
+KERNEL_FEATURES_append = " ${@bb.utils.contains("DISTRO_FEATURES", "smack", " features/smack/smack.scc", "" ,d)}"
diff --git a/meta-security/recipes-kernel/linux/linux-yocto_5.0.%.bbappend b/meta-security/recipes-kernel/linux/linux-yocto_5.0.%.bbappend
deleted file mode 100644
index f810e21..0000000
--- a/meta-security/recipes-kernel/linux/linux-yocto_5.0.%.bbappend
+++ /dev/null
@@ -1,11 +0,0 @@
-FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}-5.0:"
-
-SRC_URI += "\
- ${@bb.utils.contains('DISTRO_FEATURES', 'apparmor', ' file://apparmor.cfg', '', d)} \
- ${@bb.utils.contains('DISTRO_FEATURES', 'apparmor', ' file://apparmor_on_boot.cfg', '', d)} \
-"
-
-SRC_URI += "\
- ${@bb.utils.contains('DISTRO_FEATURES', 'smack', ' file://smack.cfg', '', d)} \
- ${@bb.utils.contains('DISTRO_FEATURES', 'smack', ' file://smack-default-lsm.cfg', '', d)} \
-"
diff --git a/meta-security/recipes-security/clamav/clamav_0.99.4.bb b/meta-security/recipes-security/clamav/clamav_0.99.4.bb
index 7d8767e..7f04337 100644
--- a/meta-security/recipes-security/clamav/clamav_0.99.4.bb
+++ b/meta-security/recipes-security/clamav/clamav_0.99.4.bb
@@ -66,14 +66,12 @@
EXTRA_OECONF_class-target += "--with-user=${UID} --with-group=${GID} --disable-rpath ${EXTRA_OECONF_CLAMAV}"
do_configure () {
- cd ${S}
- ./configure ${CONFIGUREOPTS} ${EXTRA_OECONF}
+ ${S}/configure ${CONFIGUREOPTS} ${EXTRA_OECONF}
install -d ${S}/clamav_db
}
do_configure_class-native () {
- cd ${S}
- ./configure ${CONFIGUREOPTS} ${EXTRA_OECONF}
+ ${S}/configure ${CONFIGUREOPTS} ${EXTRA_OECONF}
}
diff --git a/meta-security/recipes-security/images/security-test-image.bb b/meta-security/recipes-security/images/security-test-image.bb
new file mode 100644
index 0000000..c71d726
--- /dev/null
+++ b/meta-security/recipes-security/images/security-test-image.bb
@@ -0,0 +1,33 @@
+DESCRIPTION = "A small image for testing meta-security packages"
+
+IMAGE_FEATURES += "ssh-server-openssh"
+
+TEST_SUITES = "ssh ping ptest apparmor clamav samhain sssd tripwire checksec smack suricata"
+
+INSTALL_CLAMAV_CVD = "1"
+
+IMAGE_INSTALL = "\
+ packagegroup-base \
+ packagegroup-core-boot \
+ packagegroup-core-security-ptest \
+ clamav \
+ tripwire \
+ checksec \
+ suricata \
+ samhain-standalone \
+ ${@bb.utils.contains("DISTRO_FEATURES", "pam", "sssd", "",d)} \
+ ${@bb.utils.contains("DISTRO_FEATURES", "apparmor", "apparmor", "",d)} \
+ ${@bb.utils.contains("DISTRO_FEATURES", "smack", "smack-test", "",d)} \
+ os-release \
+ "
+
+
+IMAGE_LINGUAS ?= " "
+
+LICENSE = "MIT"
+
+inherit core-image
+
+export IMAGE_BASENAME = "security-test-image"
+
+IMAGE_ROOTFS_EXTRA_SPACE = "5242880"
diff --git a/meta-security/recipes-security/keyutils/files/fix_library_install_path.patch b/meta-security/recipes-security/keyutils/files/fix_library_install_path.patch
deleted file mode 100644
index 938fe2e..0000000
--- a/meta-security/recipes-security/keyutils/files/fix_library_install_path.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From b0355cc205543ffd33752874295139d57c4fbc3e Mon Sep 17 00:00:00 2001
-From: Wenzong Fan <wenzong.fan@windriver.com>
-Date: Tue, 26 Sep 2017 07:59:51 +0000
-Subject: [PATCH] Subject: [PATCH] keyutils: use relative path for link
-
-The absolute path of the symlink will be invalid
-when populated in sysroot, so use relative path instead.
-
-Upstream-Status: Pending
-
-Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
-Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
-{rebased for 1.6]
-Signed-off-by: Armin Kuster <akuster808@gmail.com>
-
-Index: keyutils-1.6/Makefile
-===================================================================
---- keyutils-1.6.orig/Makefile
-+++ keyutils-1.6/Makefile
-@@ -184,7 +184,7 @@ ifeq ($(NO_SOLIB),0)
- $(INSTALL) -D $(LIBNAME) $(DESTDIR)$(LIBDIR)/$(LIBNAME)
- $(LNS) $(LIBNAME) $(DESTDIR)$(LIBDIR)/$(SONAME)
- mkdir -p $(DESTDIR)$(USRLIBDIR)
-- $(LNS) $(LIBDIR)/$(SONAME) $(DESTDIR)$(USRLIBDIR)/$(DEVELLIB)
-+ $(LNS) $(SONAME) $(DESTDIR)$(USRLIBDIR)/$(DEVELLIB)
- sed \
- -e 's,@VERSION\@,$(VERSION),g' \
- -e 's,@prefix\@,$(PREFIX),g' \
diff --git a/meta-security/recipes-security/keyutils/files/keyutils-fix-error-report-by-adding-default-message.patch b/meta-security/recipes-security/keyutils/files/keyutils-fix-error-report-by-adding-default-message.patch
deleted file mode 100644
index acd91c0..0000000
--- a/meta-security/recipes-security/keyutils/files/keyutils-fix-error-report-by-adding-default-message.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-fix keyutils test error report
-
-Upstream-Status: Pending
-
-"Permission denied" may be the reason of EKEYEXPIRED and EKEYREVOKED.
-"Required key not available" may be the reason of EKEYREVOKED.
-EXPIRED and REVOKED are 2 status of kernel security keys features.
-But the userspace keyutils lib will output the error message, which may
-have several reasons.
-
-Signed-off-by: Han Chao <chan@windriver.com>
-
-diff --git a/tests/toolbox.inc.sh b/tests/toolbox.inc.sh
-index bbca00a..739e9d0 100644
---- a/tests/toolbox.inc.sh
-+++ b/tests/toolbox.inc.sh
-@@ -227,11 +227,12 @@ function expect_error ()
- ;;
- EKEYEXPIRED)
- my_err="Key has expired"
-- alt_err="Unknown error 127"
-+ alt_err="Permission denied"
- ;;
- EKEYREVOKED)
- my_err="Key has been revoked"
-- alt_err="Unknown error 128"
-+ alt_err="Permission denied"
-+ alt2_err="Required key not available"
- ;;
- EKEYREJECTED)
- my_err="Key has been rejected"
-@@ -249,6 +250,9 @@ function expect_error ()
- elif [ "x$alt_err" != "x" ] && expr "$my_errmsg" : ".*: $alt_err" >&/dev/null
- then
- :
-+ elif [ "x$alt2_err" != "x" ] && expr "$my_errmsg" : ".*: $alt2_err" >&/dev/null
-+ then
-+ :
- elif [ "x$old_err" != "x" ] && expr "$my_errmsg" : ".*: $old_err" >&/dev/null
- then
- :
-
diff --git a/meta-security/recipes-security/keyutils/files/keyutils-test-fix-output-format.patch b/meta-security/recipes-security/keyutils/files/keyutils-test-fix-output-format.patch
deleted file mode 100644
index a4ffd50..0000000
--- a/meta-security/recipes-security/keyutils/files/keyutils-test-fix-output-format.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 49b6321368e4bd3cd233d045cd09004ddd7968b2 Mon Sep 17 00:00:00 2001
-From: Jackie Huang <jackie.huang@windriver.com>
-Date: Mon, 15 May 2017 14:52:00 +0800
-Subject: [PATCH] keyutils: fix output format
-
-keyutils ptest output format is incorrect, according to yocto
-Development Manual
-(http://www.yoctoproject.org/docs/latest/dev-manual/dev-manual.html#testing-packages-with-ptest)
-5.10.6. Testing Packages With ptestThe test generates output in the format used by Automake:
-<result>: <testname>
-where the result can be PASS, FAIL, or SKIP, and the testname can be any
-identifying string.
-So we should change the test result format to match yocto ptest rules.
-
-Upstream-Status: Inappropriate [OE ptest specific]
-
-Signed-off-by: Li Wang <li.wang@windriver.com>
-Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
----
- tests/runtest.sh | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/tests/runtest.sh b/tests/runtest.sh
-index b6eaa7c..84263fb 100644
---- a/tests/runtest.sh
-+++ b/tests/runtest.sh
-@@ -21,6 +21,11 @@ for i in ${TESTS}; do
- echo "### RUNNING TEST $i"
- if [[ $AUTOMATED != 0 ]] ; then
- bash ./runtest.sh
-+ if [ $? != 0 ]; then
-+ echo "FAIL: $i"
-+ else
-+ echo "PASS: $i"
-+ fi
- else
- bash ./runtest.sh || exit 1
- fi
---
-2.11.0
-
diff --git a/meta-security/recipes-security/keyutils/files/run-ptest b/meta-security/recipes-security/keyutils/files/run-ptest
deleted file mode 100755
index 305707f..0000000
--- a/meta-security/recipes-security/keyutils/files/run-ptest
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/bin/sh
-export AUTOMATED=1
-make -C tests run
diff --git a/meta-security/recipes-security/keyutils/keyutils_1.6.bb b/meta-security/recipes-security/keyutils/keyutils_1.6.bb
deleted file mode 100644
index 4d3a96f..0000000
--- a/meta-security/recipes-security/keyutils/keyutils_1.6.bb
+++ /dev/null
@@ -1,53 +0,0 @@
-SUMMARY = "Linux Key Management Utilities"
-DESCRIPTION = "\
- Utilities to control the kernel key management facility and to provide \
- a mechanism by which the kernel call back to userspace to get a key \
- instantiated. \
- "
-HOMEPAGE = "http://people.redhat.com/dhowells/keyutils"
-SECTION = "base"
-
-LICENSE = "LGPLv2.1+ & GPLv2.0+"
-
-LIC_FILES_CHKSUM = "file://LICENCE.GPL;md5=5f6e72824f5da505c1f4a7197f004b45 \
- file://LICENCE.LGPL;md5=7d1cacaa3ea752b72ea5e525df54a21f"
-
-inherit siteinfo autotools-brokensep ptest
-
-SRC_URI = "http://people.redhat.com/dhowells/keyutils/${BP}.tar.bz2 \
- file://keyutils-test-fix-output-format.patch \
- file://keyutils-fix-error-report-by-adding-default-message.patch \
- file://run-ptest \
- file://fix_library_install_path.patch \
- "
-
-SRC_URI[md5sum] = "191987b0ab46bb5b50efd70a6e6ce808"
-SRC_URI[sha256sum] = "d3aef20cec0005c0fa6b4be40079885567473185b1a57b629b030e67942c7115"
-
-EXTRA_OEMAKE = "'CFLAGS=${CFLAGS} -Wall' \
- NO_ARLIB=1 \
- BINDIR=${base_bindir} \
- SBINDIR=${base_sbindir} \
- LIBDIR=${libdir} \
- USRLIBDIR=${libdir} \
- INCLUDEDIR=${includedir} \
- BUILDFOR=${SITEINFO_BITS}-bit \
- NO_GLIBC_KEYERR=1 \
- "
-
-do_install () {
- install -d ${D}/${libdir}/pkgconfig
- oe_runmake DESTDIR=${D} install
-}
-
-do_install_ptest () {
- cp -r ${S}/tests ${D}${PTEST_PATH}/
- sed -i -e 's/OSDIST=Unknown/OSDIST=${DISTRO}/' ${D}${PTEST_PATH}/tests/prepare.inc.sh
-}
-
-
-RDEPENDS_${PN}-ptest += "lsb"
-RDEPENDS_${PN}-ptest_append_libc-glibc = " glibc-utils"
-RDEPENDS_${PN}-ptest_append_libc-musl = " musl-utils"
-
-BBCLASSEXTEND = "native nativesdk"
diff --git a/meta-security/recipes-security/libmspack/libmspack_0.10.1.bb b/meta-security/recipes-security/libmspack/libmspack_0.10.1.bb
deleted file mode 100644
index b46159f..0000000
--- a/meta-security/recipes-security/libmspack/libmspack_0.10.1.bb
+++ /dev/null
@@ -1,16 +0,0 @@
-SUMMARY = "A library for Microsoft compression formats"
-HOMEPAGE = "http://www.cabextract.org.uk/libmspack/"
-SECTION = "lib"
-LICENSE = "LGPL-2.1"
-DEPENDS = ""
-
-LIC_FILES_CHKSUM = "file://COPYING.LIB;beginline=1;endline=2;md5=5b1fd1f66ef926b3c8a5bb00a72a28dd"
-
-SRC_URI = "${DEBIAN_MIRROR}/main/libm/${BPN}/${BPN}_${PV}.orig.tar.xz"
-
-SRC_URI[md5sum] = "d894d91eba4d2c6f76695fc9566d5387"
-SRC_URI[sha256sum] = "850c57442b850bf1bc0fc4ea8880903ebf2bed063c3c80782ee4626fbcb0e67d"
-
-inherit autotools
-
-S = "${WORKDIR}/${BP}alpha"
diff --git a/meta-security/recipes-security/libmspack/libmspack_1.9.1.bb b/meta-security/recipes-security/libmspack/libmspack_1.9.1.bb
new file mode 100644
index 0000000..8c288be
--- /dev/null
+++ b/meta-security/recipes-security/libmspack/libmspack_1.9.1.bb
@@ -0,0 +1,16 @@
+SUMMARY = "A library for Microsoft compression formats"
+HOMEPAGE = "http://www.cabextract.org.uk/libmspack/"
+SECTION = "lib"
+LICENSE = "LGPL-2.1"
+DEPENDS = ""
+
+LIC_FILES_CHKSUM = "file://COPYING.LIB;beginline=1;endline=2;md5=5b1fd1f66ef926b3c8a5bb00a72a28dd"
+
+SRCREV = "63d3faf90423a4a6c174539a7d32111a840adadc"
+SRC_URI = "git://github.com/kyz/libmspack.git"
+
+inherit autotools
+
+S = "${WORKDIR}/git/${BPN}"
+
+inherit autotools
diff --git a/meta-security/recipes-security/packagegroup/packagegroup-core-security-ptest.bb b/meta-security/recipes-security/packagegroup/packagegroup-core-security-ptest.bb
new file mode 100644
index 0000000..4934889
--- /dev/null
+++ b/meta-security/recipes-security/packagegroup/packagegroup-core-security-ptest.bb
@@ -0,0 +1,25 @@
+DESCRIPTION = "Security ptest packagegroup"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302 \
+ file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
+
+PACKAGES = "\
+ ${PN} \
+ "
+
+ALLOW_EMPTY_${PN} = "1"
+
+SUMMARY_${PN} = "Security packages with ptests"
+RDEPENDS_${PN} = " \
+ ptest-runner \
+ samhain-standalone-ptest \
+ xmlsec1-ptest \
+ keyutils-ptest \
+ libseccomp-ptest \
+ python-scapy-ptest \
+ suricata-ptest \
+ tripwire-ptest \
+ python-fail2ban-ptest \
+ ${@bb.utils.contains("DISTRO_FEATURES", "apparmor", "apparmor-ptest", "",d)} \
+ ${@bb.utils.contains("DISTRO_FEATURES", "smack", "smack-ptest", "",d)} \
+ "
diff --git a/meta-security/recipes-security/packagegroup/packagegroup-core-security.bb b/meta-security/recipes-security/packagegroup/packagegroup-core-security.bb
index b8ab27d..9165eef 100644
--- a/meta-security/recipes-security/packagegroup/packagegroup-core-security.bb
+++ b/meta-security/recipes-security/packagegroup/packagegroup-core-security.bb
@@ -12,7 +12,6 @@
packagegroup-security-ids \
packagegroup-security-mac \
${@bb.utils.contains("MACHINE_FEATURES", "tpm", "packagegroup-security-tpm", "",d)} \
- ${@bb.utils.contains("DISTRO_FEATURES", "ptest", "packagegroup-security-ptest", "", d)} \
"
RDEPENDS_packagegroup-core-security = "\
@@ -21,7 +20,6 @@
packagegroup-security-ids \
packagegroup-security-mac \
${@bb.utils.contains("MACHINE_FEATURES", "tpm", "packagegroup-security-tpm", "",d)} \
- ${@bb.utils.contains("DISTRO_FEATURES", "ptest", "packagegroup-security-ptest", "", d)} \
"
SUMMARY_packagegroup-security-utils = "Security utilities"
@@ -34,6 +32,7 @@
xmlsec1 \
keyutils \
libseccomp \
+ ${@bb.utils.contains("DISTRO_FEATURES", "pam", "sssd", "",d)} \
${@bb.utils.contains("DISTRO_FEATURES", "pax", "pax-utils", "",d)} \
"
@@ -42,6 +41,8 @@
nikto \
checksecurity \
clamav \
+ clamav-freshclam \
+ clamav-cvd \
"
SUMMARY_packagegroup-security-audit = "Security Audit tools "
@@ -68,18 +69,3 @@
${@bb.utils.contains("DISTRO_FEATURES", "apparmor", "apparmor", "",d)} \
${@bb.utils.contains("DISTRO_FEATURES", "smack", "smack", "",d)} \
"
-
-SUMMARY_packagegroup-security-ptest = "Security packages with ptests"
-RDEPENDS_packagegroup-security-ptest = " \
- samhain-standalone-ptest \
- xmlsec1-ptest \
- keyutils-ptest \
- libseccomp-ptest \
- python-scapy-ptest \
- suricata-ptest \
- tripwire-ptest \
- python-fail2ban-ptest \
- ${@bb.utils.contains("DISTRO_FEATURES", "apparmor", "apparmor-ptest", "",d)} \
- ${@bb.utils.contains("DISTRO_FEATURES", "smack", "smack-ptest", "",d)} \
- ptest-runner \
- "
diff --git a/meta-security/recipes-security/xmlsec1/xmlsec1_1.2.27.bb b/meta-security/recipes-security/xmlsec1/xmlsec1_1.2.28.bb
similarity index 93%
rename from meta-security/recipes-security/xmlsec1/xmlsec1_1.2.27.bb
rename to meta-security/recipes-security/xmlsec1/xmlsec1_1.2.28.bb
index eac8d6b..0a4c56a 100644
--- a/meta-security/recipes-security/xmlsec1/xmlsec1_1.2.27.bb
+++ b/meta-security/recipes-security/xmlsec1/xmlsec1_1.2.28.bb
@@ -20,8 +20,8 @@
file://run-ptest \
"
-SRC_URI[md5sum] = "508bee7e4f1b99f2d50aaa7d38ede56e"
-SRC_URI[sha256sum] = "97d756bad8e92588e6997d2227797eaa900d05e34a426829b149f65d87118eb6"
+SRC_URI[md5sum] = "69b8d95c009a404462e19f335e650241"
+SRC_URI[sha256sum] = "13eec4811ea30e3f0e16a734d1dbf7f9d246a71d540b48d143a07b489f6222d4"
inherit autotools-brokensep ptest pkgconfig
diff --git a/meta-security/recipes-support/libldb/libldb/avoid-openldap-unless-wanted.patch b/meta-security/recipes-support/libldb/libldb/avoid-openldap-unless-wanted.patch
deleted file mode 100644
index 8ab094f..0000000
--- a/meta-security/recipes-support/libldb/libldb/avoid-openldap-unless-wanted.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- a/wscript 2015-11-18 12:43:33.000000000 +0100
-+++ b/wscript 2015-11-18 12:46:25.000000000 +0100
-@@ -58,9 +58,7 @@
- if conf.env.standalone_ldb:
- conf.CHECK_XSLTPROC_MANPAGES()
-
-- # we need this for the ldap backend
-- if conf.CHECK_FUNCS_IN('ber_flush ldap_open ldap_initialize', 'lber ldap', headers='lber.h ldap.h'):
-- conf.env.ENABLE_LDAP_BACKEND = True
-+ conf.env.ENABLE_LDAP_BACKEND = False
-
- # we don't want any libraries or modules to rely on runtime
- # resolution of symbols
diff --git a/meta-security/recipes-support/libldb/libldb/do-not-import-target-module-while-cross-compile.patch b/meta-security/recipes-support/libldb/libldb/do-not-import-target-module-while-cross-compile.patch
deleted file mode 100755
index fdd312c..0000000
--- a/meta-security/recipes-support/libldb/libldb/do-not-import-target-module-while-cross-compile.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-Some modules such as dynamic library maybe cann't be imported while cross compile,
-we just check whether does the module exist.
-
-Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com>
-
-Index: ldb-1.1.26/buildtools/wafsamba/samba_bundled.py
-===================================================================
---- ldb-1.1.26.orig/buildtools/wafsamba/samba_bundled.py
-+++ ldb-1.1.26/buildtools/wafsamba/samba_bundled.py
-@@ -2,6 +2,7 @@
-
- import sys
- import Build, Options, Logs
-+import imp, os
- from Configure import conf
- from samba_utils import TO_LIST
-
-@@ -230,17 +231,32 @@ def CHECK_BUNDLED_SYSTEM_PYTHON(conf, li
- # versions
- minversion = minimum_library_version(conf, libname, minversion)
-
-- try:
-- m = __import__(modulename)
-- except ImportError:
-- found = False
-- else:
-+ # Find module in PYTHONPATH
-+ stuff = imp.find_module(modulename, [os.environ["PYTHONPATH"]])
-+ if stuff:
- try:
-- version = m.__version__
-- except AttributeError:
-+ m = imp.load_module(modulename, stuff[0], stuff[1], stuff[2])
-+ except ImportError:
- found = False
-+
-+ if conf.env.CROSS_COMPILE:
-+ # Some modules such as dynamic library maybe cann't be imported
-+ # while cross compile, we just check whether the module exist
-+ Logs.warn('Cross module[%s] has been found, but can not be loaded.' % (stuff[1]))
-+ found = True
- else:
-- found = tuplize_version(version) >= tuplize_version(minversion)
-+ try:
-+ version = m.__version__
-+ except AttributeError:
-+ found = False
-+ else:
-+ found = tuplize_version(version) >= tuplize_version(minversion)
-+ finally:
-+ if stuff[0]:
-+ stuff[0].close()
-+ else:
-+ found = False
-+
- if not found and not conf.LIB_MAY_BE_BUNDLED(libname):
- Logs.error('ERROR: Python module %s of version %s not found, and bundling disabled' % (libname, minversion))
- sys.exit(1)
diff --git a/meta-security/recipes-support/libldb/libldb/options-1.3.1.patch b/meta-security/recipes-support/libldb/libldb/options-1.3.1.patch
deleted file mode 100644
index ffe253b..0000000
--- a/meta-security/recipes-support/libldb/libldb/options-1.3.1.patch
+++ /dev/null
@@ -1,193 +0,0 @@
-From a4da3ab4d76013aaa731d43d52ccca1ebd37c395 Mon Sep 17 00:00:00 2001
-From: Jackie Huang <jackie.huang@windriver.com>
-Date: Wed, 21 Sep 2016 10:06:39 +0800
-Subject: [PATCH 1/1] ldb: Add configure options for packages
-
-Add configure options for the following packages:
- - acl
- - attr
- - libaio
- - libbsd
- - libcap
- - valgrind
-
-Upstream-Status: Inappropriate [oe deterministic build specific]
-
-Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
----
- lib/replace/system/wscript_configure | 6 ++-
- lib/replace/wscript | 94 +++++++++++++++++++++++++++---------
- wscript | 7 +++
- 3 files changed, 83 insertions(+), 24 deletions(-)
-
-diff --git a/lib/replace/system/wscript_configure b/lib/replace/system/wscript_configure
-index 2035474..10f9ae7 100644
---- a/lib/replace/system/wscript_configure
-+++ b/lib/replace/system/wscript_configure
-@@ -1,6 +1,10 @@
- #!/usr/bin/env python
-
--conf.CHECK_HEADERS('sys/capability.h')
-+import Options
-+
-+if Options.options.enable_libcap:
-+ conf.CHECK_HEADERS('sys/capability.h')
-+
- conf.CHECK_FUNCS('getpwnam_r getpwuid_r getpwent_r')
-
- # solaris varients of getXXent_r
-diff --git a/lib/replace/wscript b/lib/replace/wscript
-index 2f94d49..68b2d3a 100644
---- a/lib/replace/wscript
-+++ b/lib/replace/wscript
-@@ -23,6 +23,41 @@ def set_options(opt):
- opt.PRIVATE_EXTENSION_DEFAULT('')
- opt.RECURSE('buildtools/wafsamba')
-
-+ opt.add_option('--with-acl',
-+ help=("Enable use of acl"),
-+ action="store_true", dest='enable_acl')
-+ opt.add_option('--without-acl',
-+ help=("Disable use of acl"),
-+ action="store_false", dest='enable_acl', default=False)
-+
-+ opt.add_option('--with-attr',
-+ help=("Enable use of attr"),
-+ action="store_true", dest='enable_attr')
-+ opt.add_option('--without-attr',
-+ help=("Disable use of attr"),
-+ action="store_false", dest='enable_attr', default=False)
-+
-+ opt.add_option('--with-libaio',
-+ help=("Enable use of libaio"),
-+ action="store_true", dest='enable_libaio')
-+ opt.add_option('--without-libaio',
-+ help=("Disable use of libaio"),
-+ action="store_false", dest='enable_libaio', default=False)
-+
-+ opt.add_option('--with-libbsd',
-+ help=("Enable use of libbsd"),
-+ action="store_true", dest='enable_libbsd')
-+ opt.add_option('--without-libbsd',
-+ help=("Disable use of libbsd"),
-+ action="store_false", dest='enable_libbsd', default=False)
-+
-+ opt.add_option('--with-libcap',
-+ help=("Enable use of libcap"),
-+ action="store_true", dest='enable_libcap')
-+ opt.add_option('--without-libcap',
-+ help=("Disable use of libcap"),
-+ action="store_false", dest='enable_libcap', default=False)
-+
- @Utils.run_once
- def configure(conf):
- conf.RECURSE('buildtools/wafsamba')
-@@ -32,12 +67,25 @@ def configure(conf):
- conf.DEFINE('HAVE_LIBREPLACE', 1)
- conf.DEFINE('LIBREPLACE_NETWORK_CHECKS', 1)
-
-- conf.CHECK_HEADERS('linux/types.h crypt.h locale.h acl/libacl.h compat.h')
-- conf.CHECK_HEADERS('acl/libacl.h attr/xattr.h compat.h ctype.h dustat.h')
-+ conf.CHECK_HEADERS('linux/types.h crypt.h locale.h compat.h')
-+ conf.CHECK_HEADERS('compat.h ctype.h dustat.h')
- conf.CHECK_HEADERS('fcntl.h fnmatch.h glob.h history.h krb5.h langinfo.h')
-- conf.CHECK_HEADERS('libaio.h locale.h ndir.h pwd.h')
-- conf.CHECK_HEADERS('shadow.h sys/acl.h')
-- conf.CHECK_HEADERS('sys/attributes.h attr/attributes.h sys/capability.h sys/dir.h sys/epoll.h')
-+ conf.CHECK_HEADERS('locale.h ndir.h pwd.h')
-+ conf.CHECK_HEADERS('shadow.h')
-+ conf.CHECK_HEADERS('sys/attributes.h sys/dir.h sys/epoll.h')
-+
-+ if Options.options.enable_acl:
-+ conf.CHECK_HEADERS('acl/libacl.h sys/acl.h')
-+
-+ if Options.options.enable_attr:
-+ conf.CHECK_HEADERS('attr/attributes.h attr/xattr.h')
-+
-+ if Options.options.enable_libaio:
-+ conf.CHECK_HEADERS('libaio.h')
-+
-+ if Options.options.enable_libcap:
-+ conf.CHECK_HEADERS('sys/capability.h')
-+
- conf.CHECK_HEADERS('port.h')
- conf.CHECK_HEADERS('sys/fcntl.h sys/filio.h sys/filsys.h sys/fs/s5param.h sys/fs/vx/quota.h')
- conf.CHECK_HEADERS('sys/id.h sys/ioctl.h sys/ipc.h sys/mman.h sys/mode.h sys/ndir.h sys/priv.h')
-@@ -73,7 +121,9 @@ def configure(conf):
-
- conf.CHECK_CODE('', headers='rpc/rpc.h rpcsvc/yp_prot.h', define='HAVE_RPCSVC_YP_PROT_H')
-
-- conf.CHECK_HEADERS('valgrind.h valgrind/valgrind.h valgrind/memcheck.h')
-+ if Options.options.enable_valgrind:
-+ conf.CHECK_HEADERS('valgrind.h valgrind/valgrind.h valgrind/memcheck.h')
-+
- conf.CHECK_HEADERS('nss_common.h nsswitch.h ns_api.h')
- conf.CHECK_HEADERS('sys/extattr.h sys/ea.h sys/proplist.h sys/cdefs.h')
- conf.CHECK_HEADERS('utmp.h utmpx.h lastlog.h')
-@@ -266,22 +316,20 @@ def configure(conf):
-
- conf.CHECK_FUNCS('prctl dirname basename')
-
-- strlcpy_in_bsd = False
--
-- # libbsd on some platforms provides strlcpy and strlcat
-- if not conf.CHECK_FUNCS('strlcpy strlcat'):
-- if conf.CHECK_FUNCS_IN('strlcpy strlcat', 'bsd', headers='bsd/string.h',
-- checklibc=True):
-- strlcpy_in_bsd = True
-- if not conf.CHECK_FUNCS('getpeereid'):
-- conf.CHECK_FUNCS_IN('getpeereid', 'bsd', headers='sys/types.h bsd/unistd.h')
-- if not conf.CHECK_FUNCS_IN('setproctitle', 'setproctitle', headers='setproctitle.h'):
-- conf.CHECK_FUNCS_IN('setproctitle', 'bsd', headers='sys/types.h bsd/unistd.h')
-- if not conf.CHECK_FUNCS('setproctitle_init'):
-- conf.CHECK_FUNCS_IN('setproctitle_init', 'bsd', headers='sys/types.h bsd/unistd.h')
--
-- if not conf.CHECK_FUNCS('closefrom'):
-- conf.CHECK_FUNCS_IN('closefrom', 'bsd', headers='bsd/unistd.h')
-+ if Options.options.enable_libbsd:
-+ # libbsd on some platforms provides strlcpy and strlcat
-+ if not conf.CHECK_FUNCS('strlcpy strlcat'):
-+ conf.CHECK_FUNCS_IN('strlcpy strlcat', 'bsd', headers='bsd/string.h',
-+ checklibc=True)
-+ if not conf.CHECK_FUNCS('getpeereid'):
-+ conf.CHECK_FUNCS_IN('getpeereid', 'bsd', headers='sys/types.h bsd/unistd.h')
-+ if not conf.CHECK_FUNCS_IN('setproctitle', 'setproctitle', headers='setproctitle.h'):
-+ conf.CHECK_FUNCS_IN('setproctitle', 'bsd', headers='sys/types.h bsd/unistd.h')
-+ if not conf.CHECK_FUNCS('setproctitle_init'):
-+ conf.CHECK_FUNCS_IN('setproctitle_init', 'bsd', headers='sys/types.h bsd/unistd.h')
-+
-+ if not conf.CHECK_FUNCS('closefrom'):
-+ conf.CHECK_FUNCS_IN('closefrom', 'bsd', headers='bsd/unistd.h')
-
- conf.CHECK_CODE('''
- struct ucred cred;
-@@ -632,7 +680,7 @@ removeea setea
- # look for a method of finding the list of network interfaces
- for method in ['HAVE_IFACE_GETIFADDRS', 'HAVE_IFACE_AIX', 'HAVE_IFACE_IFCONF', 'HAVE_IFACE_IFREQ']:
- bsd_for_strlcpy = ''
-- if strlcpy_in_bsd:
-+ if Options.options.enable_libbsd:
- bsd_for_strlcpy = ' bsd'
- if conf.CHECK_CODE('''
- #define %s 1
-diff --git a/wscript b/wscript
-index 8ae5be3..a178cc4 100644
---- a/wscript
-+++ b/wscript
-@@ -31,6 +31,13 @@ def set_options(opt):
- opt.RECURSE('lib/replace')
- opt.tool_options('python') # options for disabling pyc or pyo compilation
-
-+ opt.add_option('--with-valgrind',
-+ help=("enable use of valgrind"),
-+ action="store_true", dest='enable_valgrind')
-+ opt.add_option('--without-valgrind',
-+ help=("disable use of valgrind"),
-+ action="store_false", dest='enable_valgrind', default=False)
-+
- def configure(conf):
- conf.RECURSE('lib/tdb')
- conf.RECURSE('lib/tevent')
---
-2.16.2
-
diff --git a/meta-security/recipes-support/libldb/libldb_1.3.1.bb b/meta-security/recipes-support/libldb/libldb_1.3.1.bb
deleted file mode 100644
index c644b20..0000000
--- a/meta-security/recipes-support/libldb/libldb_1.3.1.bb
+++ /dev/null
@@ -1,64 +0,0 @@
-SUMMARY = "Hierarchical, reference counted memory pool system with destructors"
-HOMEPAGE = "http://ldb.samba.org"
-SECTION = "libs"
-LICENSE = "LGPL-3.0+ & LGPL-2.1+ & GPL-3.0+"
-
-DEPENDS += "libtdb libtalloc libtevent popt"
-RDEPENDS_pyldb += "python"
-
-SRC_URI = "http://samba.org/ftp/ldb/ldb-${PV}.tar.gz \
- file://do-not-import-target-module-while-cross-compile.patch \
- file://options-1.3.1.patch \
- "
-
-PACKAGECONFIG ??= "\
- ${@bb.utils.filter('DISTRO_FEATURES', 'acl', d)} \
- ${@bb.utils.contains('DISTRO_FEATURES', 'xattr', 'attr', '', d)} \
-"
-PACKAGECONFIG[acl] = "--with-acl,--without-acl,acl"
-PACKAGECONFIG[attr] = "--with-attr,--without-attr,attr"
-PACKAGECONFIG[ldap] = ",,openldap"
-PACKAGECONFIG[libaio] = "--with-libaio,--without-libaio,libaio"
-PACKAGECONFIG[libbsd] = "--with-libbsd,--without-libbsd,libbsd"
-PACKAGECONFIG[libcap] = "--with-libcap,--without-libcap,libcap"
-PACKAGECONFIG[valgrind] = "--with-valgrind,--without-valgrind,valgrind"
-
-SRC_URI += "${@bb.utils.contains('PACKAGECONFIG', 'ldap', '', 'file://avoid-openldap-unless-wanted.patch', d)}"
-
-LIC_FILES_CHKSUM = "file://pyldb.h;endline=24;md5=dfbd238cecad76957f7f860fbe9adade \
- file://man/ldb.3.xml;beginline=261;endline=262;md5=137f9fd61040c1505d1aa1019663fd08 \
- file://tools/ldbdump.c;endline=19;md5=a7d4fc5d1f75676b49df491575a86a42"
-
-SRC_URI[md5sum] = "e5233f202bca27f6ce8474fb8ae65983"
-SRC_URI[sha256sum] = "b19f2c9f55ae0f46aa5ebaea0bf1a47ec1ac135e1d78af0f6318cf50bf62cbd2"
-
-CROSS_METHOD="exec"
-inherit waf-samba
-
-S = "${WORKDIR}/ldb-${PV}"
-
-EXTRA_OECONF += "--disable-rpath \
- --disable-rpath-install \
- --bundled-libraries=cmocka \
- --builtin-libraries=replace \
- --with-modulesdir=${libdir}/ldb/modules \
- --with-privatelibdir=${libdir}/ldb \
- --with-libiconv=${STAGING_DIR_HOST}${prefix}\
- "
-
-PACKAGES =+ "pyldb pyldb-dbg pyldb-dev"
-
-NOAUTOPACKAGEDEBUG = "1"
-
-FILES_${PN} += "${libdir}/ldb/*"
-FILES_${PN}-dbg += "${bindir}/.debug/* \
- ${libdir}/.debug/* \
- ${libdir}/ldb/.debug/* \
- ${libdir}/ldb/modules/ldb/.debug/*"
-
-FILES_pyldb = "${libdir}/python${PYTHON_BASEVERSION}/site-packages/* \
- ${libdir}/libpyldb-util.so.* \
- "
-FILES_pyldb-dbg = "${libdir}/python${PYTHON_BASEVERSION}/site-packages/.debug \
- ${libdir}/.debug/libpyldb-util.so.*"
-FILES_pyldb-dev = "${libdir}/libpyldb-util.so"