commit 82c905dc58a36aeae40b1b273a12f63fb1973cf4
author Andrew Geissler <geissonator@yahoo.com> Mon Apr 13 13:39:40 2020 -0500
committer Andrew Geissler <geissonator@yahoo.com> Tue May 05 13:30:44 2020 +0000
tree 38caf00263451b5036435cdc36e035b25d32e623
parent 83ecb75644b3d677c274188f9ac0b2374d6f6925

meta-openembedded and poky: subtree updates

Squash of the following due to dependencies among them
and OpenBMC changes:

meta-openembedded: subtree update:d0748372d2..9201611135
meta-openembedded: subtree update:9201611135..17fd382f34
poky: subtree update:9052e5b32a..2e11d97b6c
poky: subtree update:2e11d97b6c..a8544811d7

The change log was too large for the jenkins plugin
to handle therefore it has been removed. Here is
the first and last commit of each subtree:

meta-openembedded:d0748372d2
      cppzmq: bump to version 4.6.0
meta-openembedded:17fd382f34
      mpv: Remove X11 dependency
poky:9052e5b32a
      package_ipk: Remove pointless comment to trigger rebuild
poky:a8544811d7
      pbzip2: Fix license warning

Change-Id: If0fc6c37629642ee207a4ca2f7aa501a2c673cd6
Signed-off-by: Andrew Geissler <geissonator@yahoo.com>

poky/meta/recipes-support/rng-tools/rng-tools/rngd.service

diff --git a/poky/meta/recipes-support/rng-tools/rng-tools/rngd.service b/poky/meta/recipes-support/rng-tools/rng-tools/rngd.service
index aaaaa29..0559b97 100644
--- a/poky/meta/recipes-support/rng-tools/rng-tools/rngd.service
+++ b/poky/meta/recipes-support/rng-tools/rng-tools/rngd.service
@@ -8,6 +8,25 @@
 [Service]
 EnvironmentFile=-@SYSCONFDIR@/default/rng-tools
 ExecStart=@SBINDIR@/rngd -f $EXTRA_ARGS
+CapabilityBoundingSet=CAP_SYS_ADMIN
+IPAddressDeny=any
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectControlGroups=yes
+ProtectHome=yes
+ProtectHostname=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectSystem=strict
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallArchitectures=native
+SystemCallErrorNumber=EPERM
+SystemCallFilter=@system-service
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=sysinit.target

poky/meta/recipes-support/rng-tools/rng-tools_6.9.bb

diff --git a/poky/meta/recipes-support/rng-tools/rng-tools_6.8.bb b/poky/meta/recipes-support/rng-tools/rng-tools_6.9.bb
similarity index 84%
rename from poky/meta/recipes-support/rng-tools/rng-tools_6.8.bb
rename to poky/meta/recipes-support/rng-tools/rng-tools_6.9.bb
index 83a48a4..8c98a9a 100644
--- a/poky/meta/recipes-support/rng-tools/rng-tools_6.8.bb
+++ b/poky/meta/recipes-support/rng-tools/rng-tools_6.9.bb
@@ -14,7 +14,7 @@
     file://default \
     file://rngd.service \
 "
-SRCREV = "eb5e34c7fb05594760f99d863fbe0401fe297b93"
+SRCREV = "4a865797a69dd38c64a86aa32884ecc9ba7b4d08"
 
 S = "${WORKDIR}/git"
 
@@ -49,4 +49,11 @@
         -e 's,@SBINDIR@,${sbindir},g' \
         ${D}${sysconfdir}/init.d/rng-tools \
         ${D}${systemd_system_unitdir}/rngd.service
+
+    if [ "${@bb.utils.contains('PACKAGECONFIG', 'nistbeacon', 'yes', 'no', d)}" = "yes" ]; then
+        sed -i \
+            -e '/^IPAddressDeny=any/d' \
+            -e '/^RestrictAddressFamilies=/ s/$/ AF_INET AF_INET6/' \
+            ${D}${systemd_system_unitdir}/rngd.service
+    fi
 }