diff --git a/meta-security/classes/dm-verity-img.bbclass b/meta-security/classes/dm-verity-img.bbclass
index 93f667d..dd447e6 100644
--- a/meta-security/classes/dm-verity-img.bbclass
+++ b/meta-security/classes/dm-verity-img.bbclass
@@ -63,7 +63,7 @@
     veritysetup --data-block-size=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} --hash-offset=$SIZE format $OUTPUT $OUTPUT | tail -n +2 | process_verity
 }
 
-VERITY_TYPES = "ext2.verity ext3.verity ext4.verity btrfs.verity"
+VERITY_TYPES = "ext2.verity ext3.verity ext4.verity btrfs.verity erofs.verity erofs-lz4.verity erofs-lz4hc.verity"
 IMAGE_TYPES += "${VERITY_TYPES}"
 CONVERSIONTYPES += "verity"
 CONVERSION_CMD:verity = "verity_setup ${type}"
@@ -90,6 +90,6 @@
     # If we're using wic: we'll have to use partition images and not the rootfs
     # source plugin so add the appropriate dependency.
     if 'wic' in image_fstypes:
-        dep = ' %s:do_image_%s' % (pn, verity_type)
+        dep = ' %s:do_image_%s' % (pn, verity_type.replace("-", "_"))
         d.appendVarFlag('do_image_wic', 'depends', dep)
 }
diff --git a/meta-security/conf/layer.conf b/meta-security/conf/layer.conf
index 21f03d1..7d57f9c 100644
--- a/meta-security/conf/layer.conf
+++ b/meta-security/conf/layer.conf
@@ -11,7 +11,14 @@
 
 LAYERSERIES_COMPAT_security = "kirkstone"
 
-LAYERDEPENDS_security = "core openembedded-layer perl-layer networking-layer meta-python"
+LAYERDEPENDS_security = "core openembedded-layer"
+
+BBFILES_DYNAMIC += " \
+  perl-layer:${LAYERDIR}/dynamic-layers/meta-perl/recipes-*/*/*.bb \
+  perl-layer:${LAYERDIR}/dynamic-layers/meta-perl/recipes-*/*/*.bbappend \
+  meta-python:${LAYERDIR}/dynamic-layers/meta-python/recipes-*/*/*.bb \
+  meta-python:${LAYERDIR}/dynamic-layers/meta-python/recipes-*/*/*.bbappend \
+"
 
 # Sanity check for meta-security layer.
 # Setting SKIP_META_SECURITY_SANITY_CHECK to "1" would skip the bbappend files check.
diff --git a/meta-security/dynamic-layers/meta-perl/recipes-core/packagegroup/packagegroup-core-security.bbappend b/meta-security/dynamic-layers/meta-perl/recipes-core/packagegroup/packagegroup-core-security.bbappend
new file mode 100644
index 0000000..475a24d
--- /dev/null
+++ b/meta-security/dynamic-layers/meta-perl/recipes-core/packagegroup/packagegroup-core-security.bbappend
@@ -0,0 +1,18 @@
+
+
+PACKAGES += "\
+   packagegroup-security-hardening \
+   "
+RDEPENDS:packagegroup-core-security += "\
+   packagegroup-security-hardening \
+   "
+
+SUMMARY:packagegroup-security-hardening = "Security Hardening tools"
+RDEPENDS:packagegroup-security-hardening = " \
+    bastille \
+    "
+
+RDEPENDS:packagegroup-security-scanners += "\
+     nikto \
+     checksecurity \
+     "
diff --git a/meta-security/recipes-scanners/checksecurity/checksecurity_2.0.15.bb b/meta-security/dynamic-layers/meta-perl/recipes-scanners/checksecurity/checksecurity_2.0.15.bb
similarity index 100%
rename from meta-security/recipes-scanners/checksecurity/checksecurity_2.0.15.bb
rename to meta-security/dynamic-layers/meta-perl/recipes-scanners/checksecurity/checksecurity_2.0.15.bb
diff --git a/meta-security/recipes-scanners/checksecurity/files/check-setuid-use-more-portable-find-args.patch b/meta-security/dynamic-layers/meta-perl/recipes-scanners/checksecurity/files/check-setuid-use-more-portable-find-args.patch
similarity index 100%
rename from meta-security/recipes-scanners/checksecurity/files/check-setuid-use-more-portable-find-args.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-scanners/checksecurity/files/check-setuid-use-more-portable-find-args.patch
diff --git a/meta-security/recipes-scanners/checksecurity/files/setuid-log-folder.patch b/meta-security/dynamic-layers/meta-perl/recipes-scanners/checksecurity/files/setuid-log-folder.patch
similarity index 100%
rename from meta-security/recipes-scanners/checksecurity/files/setuid-log-folder.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-scanners/checksecurity/files/setuid-log-folder.patch
diff --git a/meta-security/recipes-security/bastille/bastille_3.2.1.bb b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/bastille_3.2.1.bb
similarity index 100%
rename from meta-security/recipes-security/bastille/bastille_3.2.1.bb
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/bastille_3.2.1.bb
diff --git a/meta-security/recipes-security/bastille/files/API.pm b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/API.pm
similarity index 100%
rename from meta-security/recipes-security/bastille/files/API.pm
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/API.pm
diff --git a/meta-security/recipes-security/bastille/files/AccountPermission.pm b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/AccountPermission.pm
similarity index 100%
rename from meta-security/recipes-security/bastille/files/AccountPermission.pm
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/AccountPermission.pm
diff --git a/meta-security/recipes-security/bastille/files/FileContent.pm b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/FileContent.pm
similarity index 100%
rename from meta-security/recipes-security/bastille/files/FileContent.pm
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/FileContent.pm
diff --git a/meta-security/recipes-security/bastille/files/HPSpecific.pm b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/HPSpecific.pm
similarity index 100%
rename from meta-security/recipes-security/bastille/files/HPSpecific.pm
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/HPSpecific.pm
diff --git a/meta-security/recipes-security/bastille/files/Miscellaneous.pm b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/Miscellaneous.pm
similarity index 100%
rename from meta-security/recipes-security/bastille/files/Miscellaneous.pm
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/Miscellaneous.pm
diff --git a/meta-security/recipes-security/bastille/files/ServiceAdmin.pm b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/ServiceAdmin.pm
similarity index 100%
rename from meta-security/recipes-security/bastille/files/ServiceAdmin.pm
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/ServiceAdmin.pm
diff --git a/meta-security/recipes-security/bastille/files/accept_os_flag_in_backend.patch b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/accept_os_flag_in_backend.patch
similarity index 100%
rename from meta-security/recipes-security/bastille/files/accept_os_flag_in_backend.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/accept_os_flag_in_backend.patch
diff --git a/meta-security/recipes-security/bastille/files/allow_os_with_assess.patch b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/allow_os_with_assess.patch
similarity index 100%
rename from meta-security/recipes-security/bastille/files/allow_os_with_assess.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/allow_os_with_assess.patch
diff --git a/meta-security/recipes-security/bastille/files/call_output_config.patch b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/call_output_config.patch
similarity index 100%
rename from meta-security/recipes-security/bastille/files/call_output_config.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/call_output_config.patch
diff --git a/meta-security/recipes-security/bastille/files/config b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/config
similarity index 100%
rename from meta-security/recipes-security/bastille/files/config
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/config
diff --git a/meta-security/recipes-security/bastille/files/do_not_apply_config.patch b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/do_not_apply_config.patch
similarity index 100%
rename from meta-security/recipes-security/bastille/files/do_not_apply_config.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/do_not_apply_config.patch
diff --git a/meta-security/recipes-security/bastille/files/edit_usage_message.patch b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/edit_usage_message.patch
similarity index 100%
rename from meta-security/recipes-security/bastille/files/edit_usage_message.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/edit_usage_message.patch
diff --git a/meta-security/recipes-security/bastille/files/find_existing_config.patch b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/find_existing_config.patch
similarity index 100%
rename from meta-security/recipes-security/bastille/files/find_existing_config.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/find_existing_config.patch
diff --git a/meta-security/recipes-security/bastille/files/fix_missing_use_directives.patch b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/fix_missing_use_directives.patch
similarity index 100%
rename from meta-security/recipes-security/bastille/files/fix_missing_use_directives.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/fix_missing_use_directives.patch
diff --git a/meta-security/recipes-security/bastille/files/fix_number_of_modules.patch b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/fix_number_of_modules.patch
similarity index 100%
rename from meta-security/recipes-security/bastille/files/fix_number_of_modules.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/fix_number_of_modules.patch
diff --git a/meta-security/recipes-security/bastille/files/fix_version_parse.patch b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/fix_version_parse.patch
similarity index 100%
rename from meta-security/recipes-security/bastille/files/fix_version_parse.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/fix_version_parse.patch
diff --git a/meta-security/recipes-security/bastille/files/fixed_defined_warnings.patch b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/fixed_defined_warnings.patch
similarity index 100%
rename from meta-security/recipes-security/bastille/files/fixed_defined_warnings.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/fixed_defined_warnings.patch
diff --git a/meta-security/recipes-security/bastille/files/organize_distro_discovery.patch b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/organize_distro_discovery.patch
similarity index 100%
rename from meta-security/recipes-security/bastille/files/organize_distro_discovery.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/organize_distro_discovery.patch
diff --git a/meta-security/recipes-security/bastille/files/remove_questions_text_file_references.patch b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/remove_questions_text_file_references.patch
similarity index 100%
rename from meta-security/recipes-security/bastille/files/remove_questions_text_file_references.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/remove_questions_text_file_references.patch
diff --git a/meta-security/recipes-security/bastille/files/set_required_questions.py b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/set_required_questions.py
similarity index 100%
rename from meta-security/recipes-security/bastille/files/set_required_questions.py
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/set_required_questions.py
diff --git a/meta-security/recipes-security/bastille/files/simplify_B_place.patch b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/simplify_B_place.patch
similarity index 100%
rename from meta-security/recipes-security/bastille/files/simplify_B_place.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/simplify_B_place.patch
diff --git a/meta-security/recipes-security/bastille/files/upgrade_options_processing.patch b/meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/upgrade_options_processing.patch
similarity index 100%
rename from meta-security/recipes-security/bastille/files/upgrade_options_processing.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-security/bastille/files/upgrade_options_processing.patch
diff --git a/meta-security/recipes-security/nikto/files/location.patch b/meta-security/dynamic-layers/meta-perl/recipes-security/nikto/files/location.patch
similarity index 100%
rename from meta-security/recipes-security/nikto/files/location.patch
rename to meta-security/dynamic-layers/meta-perl/recipes-security/nikto/files/location.patch
diff --git a/meta-security/recipes-security/nikto/nikto_2.1.6.bb b/meta-security/dynamic-layers/meta-perl/recipes-security/nikto/nikto_2.1.6.bb
similarity index 100%
rename from meta-security/recipes-security/nikto/nikto_2.1.6.bb
rename to meta-security/dynamic-layers/meta-perl/recipes-security/nikto/nikto_2.1.6.bb
diff --git a/meta-security/dynamic-layers/meta-python/recipes-core/packagegroup/packagegroup-core-security.bbappend b/meta-security/dynamic-layers/meta-python/recipes-core/packagegroup/packagegroup-core-security.bbappend
new file mode 100644
index 0000000..828931d
--- /dev/null
+++ b/meta-security/dynamic-layers/meta-python/recipes-core/packagegroup/packagegroup-core-security.bbappend
@@ -0,0 +1,10 @@
+
+
+RDEPENDS:packagegroup-security-utils += "\
+    python3-privacyidea \
+    python3-fail2ban \
+    "
+
+RDEPENDS:packagegroup-meta-security-ptest-packages += "\
+    python3-fail2ban-ptest \
+    "
diff --git a/meta-security/recipes-security/fail2ban/files/0001-To-fix-build-error-of-xrang.patch b/meta-security/dynamic-layers/meta-python/recipes-security/fail2ban/files/0001-To-fix-build-error-of-xrang.patch
similarity index 100%
rename from meta-security/recipes-security/fail2ban/files/0001-To-fix-build-error-of-xrang.patch
rename to meta-security/dynamic-layers/meta-python/recipes-security/fail2ban/files/0001-To-fix-build-error-of-xrang.patch
diff --git a/meta-security/recipes-security/fail2ban/files/initd b/meta-security/dynamic-layers/meta-python/recipes-security/fail2ban/files/initd
similarity index 100%
rename from meta-security/recipes-security/fail2ban/files/initd
rename to meta-security/dynamic-layers/meta-python/recipes-security/fail2ban/files/initd
diff --git a/meta-security/recipes-security/fail2ban/files/run-ptest b/meta-security/dynamic-layers/meta-python/recipes-security/fail2ban/files/run-ptest
similarity index 100%
rename from meta-security/recipes-security/fail2ban/files/run-ptest
rename to meta-security/dynamic-layers/meta-python/recipes-security/fail2ban/files/run-ptest
diff --git a/meta-security/recipes-security/fail2ban/python3-fail2ban_0.11.2.bb b/meta-security/dynamic-layers/meta-python/recipes-security/fail2ban/python3-fail2ban_0.11.2.bb
similarity index 100%
rename from meta-security/recipes-security/fail2ban/python3-fail2ban_0.11.2.bb
rename to meta-security/dynamic-layers/meta-python/recipes-security/fail2ban/python3-fail2ban_0.11.2.bb
diff --git a/meta-security/recipes-security/mfa/python3-privacyidea_3.6.2.bb b/meta-security/dynamic-layers/meta-python/recipes-security/mfa/python3-privacyidea_3.6.2.bb
similarity index 100%
rename from meta-security/recipes-security/mfa/python3-privacyidea_3.6.2.bb
rename to meta-security/dynamic-layers/meta-python/recipes-security/mfa/python3-privacyidea_3.6.2.bb
diff --git a/meta-security/recipes-python/python/python3-oauth2client_4.1.3.bb b/meta-security/dynamic-layers/meta-python/recipes-security/python/python3-oauth2client_4.1.3.bb
similarity index 100%
rename from meta-security/recipes-python/python/python3-oauth2client_4.1.3.bb
rename to meta-security/dynamic-layers/meta-python/recipes-security/python/python3-oauth2client_4.1.3.bb
diff --git a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/command-line-apply-operation-to-all-paths.patch b/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/command-line-apply-operation-to-all-paths.patch
deleted file mode 100644
index 35c3162..0000000
--- a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/command-line-apply-operation-to-all-paths.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 5834216fb3aa4e5e59ee13e871c70db1b4e13f02 Mon Sep 17 00:00:00 2001
-From: Patrick Ohly <patrick.ohly@intel.com>
-Date: Fri, 30 Sep 2016 10:22:16 +0200
-Subject: [PATCH] command line: apply operation to all paths
-
-Previously, invocations like "evmctl ima_hash foo bar" silently
-ignored all parameters after the first path name ("foo" in this
-example).
-
-Now evmctl iterates over all specified paths. It aborts with an
-error as soon as the selected operation fails for a path.
-
-Supporting more than one parameter is useful in combination with
-"find" and "xargs" because it is noticably faster than invoking
-evmutil separately for each file, in particular when run under pseudo
-(a fakeroot environment used by the OpenEmbedded build system).
-
-This complements the recursive mode and can be used when more control
-over file selection is needed.
-
-Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
----
- src/evmctl.c | 21 ++++++++++++---------
- 1 file changed, 12 insertions(+), 9 deletions(-)
-
-diff --git a/src/evmctl.c b/src/evmctl.c
-index 23cf54c..2072034 100644
---- a/src/evmctl.c
-+++ b/src/evmctl.c
-@@ -626,7 +626,7 @@ static int get_file_type(const char *path, const char *search_type)
- static int do_cmd(struct command *cmd, find_cb_t func)
- {
- 	char *path = g_argv[optind++];
--	int err, dts = REG_MASK; /* only regular files by default */
-+	int err = 0, dts = REG_MASK; /* only regular files by default */
- 
- 	if (!path) {
- 		log_err("Parameters missing\n");
-@@ -634,15 +634,18 @@ static int do_cmd(struct command *cmd, find_cb_t func)
- 		return -1;
- 	}
- 
--	if (recursive) {
--		if (search_type) {
--			dts = get_file_type(path, search_type);
--			if (dts < 0)
--				return dts;
-+	while (path && !err) {
-+		if (recursive) {
-+			if (search_type) {
-+				dts = get_file_type(path, search_type);
-+				if (dts < 0)
-+					return dts;
-+			}
-+			err = find(path, dts, func);
-+		} else {
-+			err = func(path);
- 		}
--		err = find(path, dts, func);
--	} else {
--		err = func(path);
-+		path = g_argv[optind++];
- 	}
- 
- 	return err;
--- 
-2.1.4
-
diff --git a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/disable-doc-creation.patch b/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/disable-doc-creation.patch
deleted file mode 100644
index 75076f5..0000000
--- a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/disable-doc-creation.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 321a602098d11ee712ebd01f51033b5fd369eae9 Mon Sep 17 00:00:00 2001
-From: Patrick Ohly <patrick.ohly@intel.com>
-Date: Wed, 13 May 2015 03:41:02 -0700
-Subject: [PATCH] Makefile.am: disable man page creation
-
-Depends on asciidoc, which is not available.
-
-Upstream-Status: Inappropriate [embedded specific]
-
-Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
----
- Makefile.am | 19 ++++++++++++++++++-
- 1 file changed, 18 insertions(+), 1 deletion(-)
-
-diff --git a/Makefile.am b/Makefile.am
-index 06ebf59..4ddd52c 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -1,5 +1,5 @@
- SUBDIRS = src
--dist_man_MANS = evmctl.1
-+# dist_man_MANS = evmctl.1
- 
- doc_DATA =  examples/ima-genkey-self.sh examples/ima-genkey.sh examples/ima-gen-local-ca.sh
- EXTRA_DIST = autogen.sh $(doc_DATA)
-@@ -39,4 +39,21 @@ rmman:
- 
- doc: evmctl.1.html rmman evmctl.1
- 
-+# requires asciidoc, xslproc, docbook-xsl
-+# FIXME Disabled until docbook-xsl is unavaliable on tizen.org
-+#MANPAGE_DOCBOOK_XSL = /usr/share/xml/docbook/stylesheet/docbook-xsl/manpages/docbook.xsl
-+#
-+#evmctl.1.html: README
-+#	@asciidoc -o $@ $<
-+#
-+#evmctl.1:
-+#	asciidoc -d manpage -b docbook -o evmctl.1.xsl README
-+#	xsltproc --nonet -o $@ $(MANPAGE_DOCBOOK_XSL) evmctl.1.xsl
-+#	rm -f evmctl.1.xsl
-+#
-+#rmman:
-+#	rm -f evmctl.1
-+#
-+#doc: evmctl.1.html rmman evmctl.1
-+
- .PHONY: $(tarname)
--- 
-1.8.4.5
-
diff --git a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/evmctl.c-do-not-depend-on-xattr.h-with-IMA-defines.patch b/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/evmctl.c-do-not-depend-on-xattr.h-with-IMA-defines.patch
deleted file mode 100644
index ffa65df..0000000
--- a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils/evmctl.c-do-not-depend-on-xattr.h-with-IMA-defines.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 2dec9199f8a8a2c84b25a3d3e7e2f41b71e07834 Mon Sep 17 00:00:00 2001
-From: Patrick Ohly <patrick.ohly@intel.com>
-Date: Wed, 17 Jun 2015 14:28:18 +0200
-Subject: [PATCH 20/20] evmctl.c: do not depend on xattr.h with IMA defines
-
-Compilation on older Linux distros (like Ubuntu 12.04) fails
-because linux/xattr.h does not yet have the IMA defines. Compiling
-there makes sense when only the tools are needed, for example when
-signing an image in cross-compile mode.
-
-To support this, add fallbacks for the two defines which are needed.
-Their value is part of the Linux ABI and thus fixed.
-
-Upstream-status: Submitted [linux-ima-devel@lists.sourceforge.net]
-
-Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
-
----
- src/evmctl.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/src/evmctl.c b/src/evmctl.c
-index c54efbb..23cf54c 100644
---- a/src/evmctl.c
-+++ b/src/evmctl.c
-@@ -57,6 +57,18 @@
- #include <termios.h>
- #include <assert.h>
- 
-+/*
-+ * linux/xattr.h might be old to have this. Allow compilation on older
-+ * Linux distros (like Ubuntu 12.04) by falling back to our own
-+ * definition.
-+ */
-+#ifndef XATTR_IMA_SUFFIX
-+# define XATTR_IMA_SUFFIX "ima"
-+#endif
-+#ifndef XATTR_NAME_IMA
-+# define XATTR_NAME_IMA XATTR_SECURITY_PREFIX XATTR_IMA_SUFFIX
-+#endif
-+
- #include <openssl/sha.h>
- #include <openssl/pem.h>
- #include <openssl/hmac.h>
--- 
-2.1.4
-
diff --git a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils_1.4.bb b/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils_1.4.bb
new file mode 100644
index 0000000..4f1d1a3
--- /dev/null
+++ b/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils_1.4.bb
@@ -0,0 +1,24 @@
+DESCRIPTION = "IMA/EVM control utility"
+LICENSE = "GPL-2.0-with-OpenSSL-exception"
+LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
+
+DEPENDS += "openssl attr keyutils"
+
+DEPENDS:class-native += "openssl-native keyutils-native"
+
+SRC_URI = "https://sourceforge.net/projects/linux-ima/files/${BPN}/${BP}.tar.gz"
+SRC_URI[sha256sum] = "fcf85b31d6292051b3679e5f17ffa7f89b6898957aad0f59aa4e9878884b27d1"
+
+inherit pkgconfig autotools features_check
+
+REQUIRED_DISTRO_FEATURES = "ima"
+REQUIRED_DISTRO_FEATURES:class-native = ""
+
+EXTRA_OECONF:append:class-target = " --with-kernel-headers=${STAGING_KERNEL_BUILDDIR}"
+
+# blkid is called by evmctl when creating evm checksums.
+# This is less useful when signing files on the build host,
+# so disable it when compiling on the host.
+RDEPENDS:${PN}:append:class-target = " util-linux-blkid libcrypto attr libattr keyutils"
+
+BBCLASSEXTEND = "native nativesdk"
diff --git a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils_git.bb b/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils_git.bb
deleted file mode 100644
index fc7a2d6..0000000
--- a/meta-security/meta-integrity/recipes-security/ima-evm-utils/ima-evm-utils_git.bb
+++ /dev/null
@@ -1,38 +0,0 @@
-DESCRIPTION = "IMA/EVM control utility"
-LICENSE = "GPL-2.0-with-OpenSSL-exception"
-LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
-
-DEPENDS += "openssl attr keyutils"
-
-DEPENDS:class-native += "openssl-native keyutils-native"
-
-PV = "1.2.1+git${SRCPV}"
-SRCREV = "3eab1f93b634249c1720f65fcb495b1996f0256e"
-SRC_URI = "git://git.code.sf.net/p/linux-ima/ima-evm-utils;branch=ima-evm-utils-1.2.y"
-
-# Documentation depends on asciidoc, which we do not have, so
-# do not build documentation.
-SRC_URI += "file://disable-doc-creation.patch"
-
-# Workaround for upstream incompatibility with older Linux distros.
-# Relevant for us when compiling ima-evm-utils-native.
-SRC_URI += "file://evmctl.c-do-not-depend-on-xattr.h-with-IMA-defines.patch"
-
-# Required for xargs with more than one path as argument (better for performance).
-SRC_URI += "file://command-line-apply-operation-to-all-paths.patch"
-
-S = "${WORKDIR}/git"
-
-inherit pkgconfig autotools features_check
-
-REQUIRED_DISTRO_FEATURES = "ima"
-REQUIRED_DISTRO_FEATURES:class-native = ""
-
-EXTRA_OECONF:append:class-target = " --with-kernel-headers=${STAGING_KERNEL_BUILDDIR}"
-
-# blkid is called by evmctl when creating evm checksums.
-# This is less useful when signing files on the build host,
-# so disable it when compiling on the host.
-RDEPENDS:${PN}:append:class-target = " util-linux-blkid libcrypto attr libattr keyutils"
-
-BBCLASSEXTEND = "native nativesdk"
diff --git a/meta-security/meta-parsec/README.md b/meta-security/meta-parsec/README.md
index 97026ea..f720cd2 100644
--- a/meta-security/meta-parsec/README.md
+++ b/meta-security/meta-parsec/README.md
@@ -88,6 +88,71 @@
 2. Run cargo-bitbake inside the repository. It will produce a BB file.
 3. Create a new include file with SRC_URI and LIC_FILES_CHKSUM from the BB file.
 
+Automated Parsec testing with runqemu
+=====================================
+
+ The Yocto build system has the ability to run a series of automated tests for qemu images.
+All the tests are actually commands run on the target system over ssh.
+
+ Meta-parsec includes automated unittests which run end to end Parsec tests.
+The tests are run against:
+- all providers pre-configured in the Parsec config file included in the image.
+- PKCS11 and TPM providers with software backends if softhsm and
+  swtpm packages included in the image.
+
+Meta-parsec also contains a recipe for `security-parsec-image` image with Parsec,
+softhsm and swtpm included.
+
+ Please notice that the account you use to run bitbake should have access to `/dev/kvm`.
+You might need to change permissions or add the account into `kvm` unix group.
+
+1. Testing Parsec with your own image where `parsec-service` and `parsec-tool` are already included.
+
+- Add into your `local.conf`:
+```
+INHERIT += "testimage"
+TEST_SUITES = "ping ssh parsec"
+```
+- Build your image
+```bash
+bitbake <your-image>
+```
+- Run tests
+```bash
+bitbake <your-image> -c testimage
+```
+
+2. Testing Parsec with pre-defined `security-parsec-image` image.
+
+- Add into your `local.conf`:
+```
+DISTRO_FEATURES += " tpm2"
+INHERIT += "testimage"
+TEST_SUITES = "ping ssh parsec"
+```
+- Build security-parsec-image image
+```bash
+bitbake security-parsec-image
+```
+- Run tests
+```bash
+bitbake security-parsec-image -c testimage
+```
+
+Output of a successfull tests run should look similar to:
+```
+RESULTS:
+RESULTS - ping.PingTest.test_ping: PASSED (0.05s)
+RESULTS - ssh.SSHTest.test_ssh: PASSED (0.25s)
+RESULTS - parsec.ParsecTest.test_all_providers: PASSED (1.84s)
+RESULTS - parsec.ParsecTest.test_pkcs11_provider: PASSED (2.91s)
+RESULTS - parsec.ParsecTest.test_tpm_provider: PASSED (3.33s)
+SUMMARY:
+security-parsec-image () - Ran 5 tests in 8.386s
+security-parsec-image - OK - All required tests passed (successes=5, skipped=0, failures=0, errors=0)
+```
+
+
 Manual testing with runqemu
 ===========================
 
diff --git a/meta-security/meta-parsec/lib/oeqa/runtime/cases/parsec.py b/meta-security/meta-parsec/lib/oeqa/runtime/cases/parsec.py
new file mode 100644
index 0000000..d3d3f2e
--- /dev/null
+++ b/meta-security/meta-parsec/lib/oeqa/runtime/cases/parsec.py
@@ -0,0 +1,138 @@
+# Copyright (C) 2022 Armin Kuster <akuster808@gmail.com>
+# Copyright (C) 2022 Anton Antonov <Anton.Antonov@arm.com>
+#
+import re
+from tempfile import mkstemp
+
+from oeqa.runtime.case import OERuntimeTestCase
+from oeqa.core.decorator.depends import OETestDepends
+from oeqa.runtime.decorator.package import OEHasPackage
+from oeqa.core.decorator.data import skipIfNotFeature
+
+class ParsecTest(OERuntimeTestCase):
+    @classmethod
+    def setUpClass(cls):
+        cls.toml_file = '/etc/parsec/config.toml'
+
+    def setUp(self):
+        super(ParsecTest, self).setUp()
+        if 'systemd' in self.tc.td['DISTRO_FEATURES']:
+            self.parsec_status='systemctl status -l parsec'
+            self.parsec_reload='systemctl restart parsec'
+        else:
+            self.parsec_status='pgrep -l parsec'
+            self.parsec_reload='/etc/init.d/parsec reload'
+
+    def copy_subconfig(self, cfg, provider):
+        """ Copy a provider configuration to target and append it to Parsec config """
+
+        tmp_fd, tmp_path = mkstemp()
+        with os.fdopen(tmp_fd, 'w') as f:
+            f.write('\n'.join(cfg))
+
+        (status, output) = self.target.copyTo(tmp_path, "%s-%s" % (self.toml_file, provider))
+        self.assertEqual(status, 0, msg='File could not be copied.\n%s' % output)
+        status, output = self.target.run('cat %s-%s >>%s' % (self.toml_file, provider, self.toml_file))
+        os.remove(tmp_path)
+
+    def check_parsec_providers(self, provider=None, prov_id=None):
+        """ Get Parsec providers list and check for one if defined """
+
+        status, output = self.target.run(self.parsec_status)
+        self.assertEqual(status, 0, msg='Parsec service is not running.\n%s' % output)
+
+        status, output = self.target.run('parsec-tool list-providers')
+        self.assertEqual(status, 0, msg='Cannot get a list of Parsec providers.\n%s' % output)
+        if provider and prov_id:
+            self.assertIn("ID: 0x0%d (%s provider)" % (prov_id, provider),
+                          output, msg='%s provider is not configured.' % provider)
+
+    def run_cli_tests(self, prov_id=None):
+        """ Run Parsec CLI end-to-end tests against one or all providers """
+
+        status, output = self.target.run('parsec-cli-tests.sh %s' % ("-%d" % prov_id if prov_id else ""))
+        self.assertEqual(status, 0, msg='Parsec CLI tests failed.\n %s' % output)
+
+    @OEHasPackage(['parsec-service'])
+    @OETestDepends(['ssh.SSHTest.test_ssh'])
+    def test_all_providers(self):
+        """ Test Parsec service with all pre-defined providers """
+
+        self.check_parsec_providers()
+        self.run_cli_tests()
+
+    def configure_tpm_provider(self):
+        """ Create Parsec TPM provider configuration """
+
+        cfg = [
+                '',
+                '[[provider]]',
+                'name = "tpm-provider"',
+                'provider_type = "Tpm"',
+                'key_info_manager = "sqlite-manager"',
+                'tcti = "swtpm:port=2321"',
+                'owner_hierarchy_auth = ""',
+              ]
+        self.copy_subconfig(cfg, "TPM")
+
+        cmds = [
+                'mkdir /tmp/myvtpm',
+                'swtpm socket -d --tpmstate dir=/tmp/myvtpm --tpm2 --ctrl type=tcp,port=2322 --server type=tcp,port=2321 --flags not-need-init',
+                'tpm2_startup -c -T "swtpm:port=2321"',
+                self.parsec_reload,
+               ]
+
+        for cmd in cmds:
+            status, output = self.target.run(cmd)
+            self.assertEqual(status, 0, msg='\n'.join([cmd, output]))
+
+    @OEHasPackage(['parsec-service'])
+    @OEHasPackage(['swtpm'])
+    @skipIfNotFeature('tpm2','Test parsec_tpm_provider requires tpm2 to be in DISTRO_FEATURES')
+    @OETestDepends(['ssh.SSHTest.test_ssh', 'parsec.ParsecTest.test_all_providers'])
+    def test_tpm_provider(self):
+        """ Configure and test Parsec TPM provider with swtpm as a backend """
+
+        prov_id = 3
+        self.configure_tpm_provider()
+        self.check_parsec_providers("TPM", prov_id)
+        self.run_cli_tests(prov_id)
+
+    def configure_pkcs11_provider(self):
+        """ Create Parsec PKCS11 provider configuration """
+
+        status, output = self.target.run('softhsm2-util --init-token --free --label "Parsec Service" --pin 123456 --so-pin 123456')
+        self.assertEqual(status, 0, msg='Failed to init PKCS11 token.\n%s' % output)
+
+        slot = re.search('The token has been initialized and is reassigned to slot (\d*)', output)
+        if slot is None:
+            self.fail('Failed to get PKCS11 slot serial number.\n%s' % output)
+        self.assertNotEqual(slot.group(1), None, msg='Failed to get PKCS11 slot serial number.\n%s' % output)
+
+        cfg = [
+                '',
+                '[[provider]]',
+                'name = "pkcs11-provider"',
+                'provider_type = "Pkcs11"',
+                'key_info_manager = "sqlite-manager"',
+                'library_path = "/usr/lib/softhsm/libsofthsm2.so"',
+                'slot_number = %s' % slot.group(1),
+                'user_pin = "123456"',
+                'allow_export = true',
+              ]
+        self.copy_subconfig(cfg, "PKCS11")
+
+        status, output = self.target.run('for d in /var/lib/softhsm/tokens/*; do chown -R parsec $d; done')
+        status, output = self.target.run(self.parsec_reload)
+        self.assertEqual(status, 0, msg='Failed to reload Parsec.\n%s' % output)
+
+    @OEHasPackage(['parsec-service'])
+    @OEHasPackage(['softhsm'])
+    @OETestDepends(['ssh.SSHTest.test_ssh', 'parsec.ParsecTest.test_all_providers'])
+    def test_pkcs11_provider(self):
+        """ Configure and test Parsec PKCS11 provider with softhsm as a backend """
+
+        prov_id = 2
+        self.configure_pkcs11_provider()
+        self.check_parsec_providers("PKCS #11", prov_id)
+        self.run_cli_tests(prov_id)
diff --git a/meta-security/meta-parsec/recipes-core/images/security-parsec-image.bb b/meta-security/meta-parsec/recipes-core/images/security-parsec-image.bb
new file mode 100644
index 0000000..7add74b
--- /dev/null
+++ b/meta-security/meta-parsec/recipes-core/images/security-parsec-image.bb
@@ -0,0 +1,18 @@
+DESCRIPTION = "A small image for testing Parsec service with MbedCrypto, TPM and PKCS11 providers"
+
+inherit core-image
+
+IMAGE_FEATURES += "ssh-server-openssh"
+
+IMAGE_INSTALL = "\
+    packagegroup-base \
+    packagegroup-core-boot \
+    packagegroup-security-tpm2 \
+    packagegroup-security-parsec \
+    swtpm \
+    softhsm \
+    os-release"
+
+export IMAGE_BASENAME = "security-parsec-image"
+
+IMAGE_ROOTFS_EXTRA_SPACE = "5242880"
diff --git a/meta-security/meta-parsec/recipes-core/packagegroups/packagegroup-security-parsec.bb b/meta-security/meta-parsec/recipes-core/packagegroups/packagegroup-security-parsec.bb
new file mode 100644
index 0000000..0af9c3d
--- /dev/null
+++ b/meta-security/meta-parsec/recipes-core/packagegroups/packagegroup-security-parsec.bb
@@ -0,0 +1,16 @@
+DESCRIPTION = "Parsec Security packagegroup for Poky"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COMMON_LICENSE_DIR}/MIT;md5=0835ade698e0bcf8506ecda2f7b4f302 \
+                    file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
+
+inherit packagegroup
+
+PACKAGES = "\
+    packagegroup-security-parsec \
+    "
+
+SUMMARY:packagegroup-security-parsec = "Security Parsec"
+RDEPENDS:packagegroup-security-parsec = "\
+    parsec-tool \
+    parsec-service \
+    "
diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-service/files/parsec-tmpfiles.conf b/meta-security/meta-parsec/recipes-parsec/parsec-service/files/parsec-tmpfiles.conf
index fe576a2..954bfa3 100644
--- a/meta-security/meta-parsec/recipes-parsec/parsec-service/files/parsec-tmpfiles.conf
+++ b/meta-security/meta-parsec/recipes-parsec/parsec-service/files/parsec-tmpfiles.conf
@@ -1,2 +1,3 @@
 #Type   Path            Mode    User    Group   Age     Argument
 d       /run/parsec     755     parsec  parsec  -       -
+d       /var/lib/parsec 700     parsec  parsec  -       -
diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_1.0.0.bb b/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_1.0.0.bb
index d1d6c07..84539f9 100644
--- a/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_1.0.0.bb
+++ b/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_1.0.0.bb
@@ -15,8 +15,8 @@
 have_TPM = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', 'TPM', '', d)}"
 PACKAGECONFIG:append = " ${@bb.utils.contains('BBFILE_COLLECTIONS', 'tpm-layer', '${have_TPM}', '', d)}"
 
-PACKAGECONFIG[ALL] = "all-providers cryptoki/generate-bindings tss-esapi/generate-bindings,,tpm2-tss libts,libts"
-PACKAGECONFIG[TPM] = "tpm-provider tss-esapi/generate-bindings,,tpm2-tss"
+PACKAGECONFIG[ALL] = "all-providers cryptoki/generate-bindings tss-esapi/generate-bindings,,tpm2-tss libts,tpm2-tss libtss2-tcti-device libts"
+PACKAGECONFIG[TPM] = "tpm-provider tss-esapi/generate-bindings,,tpm2-tss,tpm2-tss libtss2-tcti-device"
 PACKAGECONFIG[PKCS11] = "pkcs11-provider cryptoki/generate-bindings,"
 PACKAGECONFIG[MBED-CRYPTO] = "mbed-crypto-provider,"
 PACKAGECONFIG[CRYPTOAUTHLIB] = "cryptoauthlib-provider,"
@@ -25,6 +25,13 @@
 PARSEC_FEATURES = "${@d.getVar('PACKAGECONFIG_CONFARGS',True).strip().replace(' ', ',')}"
 CARGO_BUILD_FLAGS += " --features ${PARSEC_FEATURES}"
 
+export BINDGEN_EXTRA_CLANG_ARGS
+target = "${@d.getVar('TARGET_SYS',True).replace('-', ' ')}"
+BINDGEN_EXTRA_CLANG_ARGS = "${@bb.utils.contains('target', 'arm', \
+                              '--sysroot=${WORKDIR}/recipe-sysroot -I${WORKDIR}/recipe-sysroot/usr/include -mfloat-abi=hard', \
+                              '--sysroot=${WORKDIR}/recipe-sysroot -I${WORKDIR}/recipe-sysroot/usr/include', \
+                              d)}"
+
 inherit systemd
 SYSTEMD_SERVICE:${PN} = "parsec.service"
 
@@ -35,7 +42,7 @@
 # The file should also be included into SRC_URI then
 PARSEC_CONFIG ?= "${S}/config.toml"
 
-do_install:append () {
+do_install () {
     # Binaries
     install -d -m 700 -o parsec -g parsec "${D}${libexecdir}/parsec"
     install -m 700 -o parsec -g parsec "${WORKDIR}/build/target/${CARGO_TARGET_SUBDIR}/parsec" ${D}${libexecdir}/parsec/parsec
@@ -44,9 +51,6 @@
     install -d -m 700 -o parsec -g parsec "${D}${sysconfdir}/parsec"
     install -m 400 -o parsec -g parsec "${PARSEC_CONFIG}" ${D}${sysconfdir}/parsec/config.toml
 
-    # Data dir
-    install -d -m 700 -o parsec -g parsec "${D}${localstatedir}/lib/parsec"
-
     if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
         install -d ${D}${systemd_unitdir}/system
         install -m 644 ${S}/systemd-daemon/parsec.service ${D}${systemd_unitdir}/system
@@ -58,6 +62,8 @@
     if ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'true', 'false', d)}; then
         install -d ${D}${sysconfdir}/init.d
         install -m 755 ${WORKDIR}/parsec_init ${D}${sysconfdir}/init.d/parsec
+        # Data dir
+        install -d -m 700 -o parsec -g parsec "${D}${localstatedir}/lib/parsec"
     fi
 }
 
@@ -65,12 +71,12 @@
 USERADD_PACKAGES = "${PN}"
 USERADD_PARAM:${PN} = "-r -g parsec -s /bin/false -d ${localstatedir}/lib/parsec parsec"
 GROUPADD_PARAM:${PN} = "-r parsec"
+GROUPMEMS_PARAM:${PN} = "${@bb.utils.contains('PACKAGECONFIG_CONFARGS', 'tpm-provider', '-a parsec -g tss', '', d)}"
 
 FILES:${PN} += " \
     ${sysconfdir}/parsec/config.toml \
     ${libexecdir}/parsec/parsec \
     ${systemd_unitdir}/system/parsec.service \
-    ${localstatedir}/lib/parsec \
     ${libdir}/tmpfiles.d/parsec-tmpfiles.conf \
     ${sysconfdir}/init.d/parsec \
 "
diff --git a/meta-security/meta-tpm/classes/sanity-meta-tpm.bbclass b/meta-security/meta-tpm/classes/sanity-meta-tpm.bbclass
index 2f8b52d..1ab03c8 100644
--- a/meta-security/meta-tpm/classes/sanity-meta-tpm.bbclass
+++ b/meta-security/meta-tpm/classes/sanity-meta-tpm.bbclass
@@ -2,7 +2,9 @@
 tpm_machinecheck[eventmask] = "bb.event.SanityCheck"
 python tpm_machinecheck() {
     skip_check = e.data.getVar('SKIP_META_TPM_SANITY_CHECK') == "1"
-    if 'tpm' not in e.data.getVar('DISTRO_FEATURES').split() and not skip_check:
+    if 'tpm' not in e.data.getVar('DISTRO_FEATURES').split() and \
+       'tpm2' not in e.data.getVar('DISTRO_FEATURES').split() and \
+       not skip_check:
         bb.warn("You have included the meta-tpm layer, but \
 'tpm or tpm2' has not been enabled in your DISTRO_FEATURES. Some bbappend files \
 and preferred version setting may not take effect. See the meta-tpm README \
diff --git a/meta-security/meta-tpm/lib/oeqa/runtime/cases/tpm2.py b/meta-security/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
index c6f9d92..c2c95e7 100644
--- a/meta-security/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
+++ b/meta-security/meta-tpm/lib/oeqa/runtime/cases/tpm2.py
@@ -16,28 +16,45 @@
         if expected_endlines:
             self.fail('Missing expected line endings:\n  %s' % '\n  '.join(expected_endlines))
 
-    @OEHasPackage(['tpm2-tss'])
-    @OEHasPackage(['tpm2-abrmd'])
     @OEHasPackage(['tpm2-tools'])
-    @OEHasPackage(['ibmswtpm2'])
+    @OEHasPackage(['tpm2-abrmd'])
+    @OEHasPackage(['swtpm'])
     @OETestDepends(['ssh.SSHTest.test_ssh'])
-    def test_tpm2_sim(self):
+    def test_tpm2_swtpm_socket(self):
         cmds = [
-                'tpm_server &',
-                'tpm2-abrmd --allow-root --tcti=mssim &'
+                'mkdir /tmp/myvtpm',
+                'swtpm socket --tpmstate dir=/tmp/myvtpm --tpm2 --ctrl type=tcp,port=2322 --server type=tcp,port=2321 --flags not-need-init &',
+                'export TPM2TOOLS_TCTI="swtpm:port=2321"',
+                'tpm2_startup -c'
                ]
 
         for cmd in cmds:
             status, output = self.target.run(cmd)
             self.assertEqual(status, 0, msg='\n'.join([cmd, output]))
 
-    @OETestDepends(['tpm2.Tpm2Test.test_tpm2_sim'])
-    def test_tpm2(self):
-         (status, output) = self.target.run('tpm2_pcrlist')
+    @OETestDepends(['tpm2.Tpm2Test.test_tpm2_swtpm_socket'])
+    def test_tpm2_pcrread(self):
+         (status, output) = self.target.run('tpm2_pcrread')
          expected_endlines = []
-         expected_endlines.append('sha1 :')
-         expected_endlines.append('  0  : 0000000000000000000000000000000000000003')
-         expected_endlines.append('  1  : 0000000000000000000000000000000000000000')
+         expected_endlines.append('  sha1:')
+         expected_endlines.append('    0 : 0x0000000000000000000000000000000000000000')
+         expected_endlines.append('    1 : 0x0000000000000000000000000000000000000000')
+         expected_endlines.append('  sha256:')
+         expected_endlines.append('    0 : 0x0000000000000000000000000000000000000000000000000000000000000000')
+         expected_endlines.append('    1 : 0x0000000000000000000000000000000000000000000000000000000000000000')
+
 
          self.check_endlines(output, expected_endlines)
 
+
+    @OEHasPackage(['p11-kit'])
+    @OEHasPackage(['tpm2-pkcs11'])
+    @OETestDepends(['tpm2.Tpm2Test.test_tpm2_swtpm_socket'])
+    def test_tpm2_pkcs11(self):
+         (status, output) = self.target.run('p11-kit list-modules -v')
+         self.assertEqual(status, 0, msg="Modules missing: %s" % output)
+
+    @OETestDepends(['tpm2.Tpm2Test.test_tpm2_pkcs11'])
+    def test_tpm2_swtpm_reset(self):
+         (status, output) = self.target.run('swtpm_ioctl -i --tcp :2322')
+         self.assertEqual(status, 0, msg="swtpm reset failed: %s" % output)
diff --git a/meta-security/meta-tpm/recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_1.8.0.bb b/meta-security/meta-tpm/recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_1.8.0.bb
index a9174e6..e8812d0 100644
--- a/meta-security/meta-tpm/recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_1.8.0.bb
+++ b/meta-security/meta-tpm/recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_1.8.0.bb
@@ -27,8 +27,13 @@
 do_install:append() {
     install -d ${D}${libdir}/pkcs11
     install -d ${D}${datadir}/p11-kit
+
+    # remove symlinks
     rm -f ${D}${libdir}/pkcs11/libtpm2_pkcs11.so
 
+    #install lib
+    install -m 755 ${B}/src/.libs/libtpm2_pkcs11.so ${D}${libdir}/pkcs11/libtpm2_pkcs11.so
+
     cd ${S}/tools
     export PYTHONPATH="${D}${PYTHON_SITEPACKAGES_DIR}"
     ${PYTHON_PN} setup.py install --root="${D}" --prefix="${prefix}" --install-lib="${PYTHON_SITEPACKAGES_DIR}" --optimize=1 --skip-build
@@ -48,5 +53,5 @@
     ${datadir}/p11-kit/* \
     "
 
-RDEPENDS:${PN} = "tpm2-tools"
-RDEPENDS:${PN}-tools += "${PYTHON_PN}-setuptools ${PYTHON_PN}-pyyaml ${PYTHON_PN}-cryptography ${PYTHON_PN}-pyasn1-modules"
+RDEPENDS:${PN} = "p11-kit tpm2-tools "
+RDEPENDS:${PN}-tools = "${PYTHON_PN}-pyyaml ${PYTHON_PN}-cryptography ${PYTHON_PN}-pyasn1-modules"
diff --git a/meta-security/meta-tpm/recipes-tpm2/tpm2-tools/tpm2-tools_5.2.bb b/meta-security/meta-tpm/recipes-tpm2/tpm2-tools/tpm2-tools_5.2.bb
index f924038..c20af7e 100644
--- a/meta-security/meta-tpm/recipes-tpm2/tpm2-tools/tpm2-tools_5.2.bb
+++ b/meta-security/meta-tpm/recipes-tpm2/tpm2-tools/tpm2-tools_5.2.bb
@@ -16,3 +16,6 @@
     # do not extract the version number from git
     sed -i -e 's/m4_esyscmd_s(\[git describe --tags --always --dirty\])/${PV}/' ${S}/configure.ac
 }
+
+# need tss-esys
+RDEPENDS:${PN} = "libtss2 tpm2-abrmd"
diff --git a/meta-security/recipes-core/packagegroup/packagegroup-core-security.bb b/meta-security/recipes-core/packagegroup/packagegroup-core-security.bb
index fefc66d..9010054 100644
--- a/meta-security/recipes-core/packagegroup/packagegroup-core-security.bb
+++ b/meta-security/recipes-core/packagegroup/packagegroup-core-security.bb
@@ -10,7 +10,6 @@
     packagegroup-security-utils \
     packagegroup-security-scanners \
     packagegroup-security-audit \
-    packagegroup-security-hardening \
     packagegroup-security-ids  \
     packagegroup-security-mac  \
     ${@bb.utils.contains("DISTRO_FEATURES", "ptest", "packagegroup-meta-security-ptest-packages", "", d)} \
@@ -20,7 +19,6 @@
     packagegroup-security-utils \
     packagegroup-security-scanners \
     packagegroup-security-audit \
-    packagegroup-security-hardening \
     packagegroup-security-ids  \
     packagegroup-security-mac  \
     ${@bb.utils.contains("DISTRO_FEATURES", "ptest", "packagegroup-meta-security-ptest-packages", "", d)} \
@@ -35,8 +33,6 @@
     keyutils \
     nmap \
     pinentry \
-    python3-privacyidea \
-    python3-fail2ban \
     softhsm \
     sshguard \
     ${@bb.utils.contains_any("TUNE_FEATURES", "riscv32 ", "", " libseccomp",d)} \
@@ -47,8 +43,6 @@
 SUMMARY:packagegroup-security-scanners = "Security scanners"
 RDEPENDS:packagegroup-security-scanners = "\
     isic \
-    nikto \
-    checksecurity \
     ${@bb.utils.contains_any("TUNE_FEATURES", "riscv32 riscv64", "", " clamav clamav-daemon clamav-freshclam",d)} \
     "
 RDEPENDS:packagegroup-security-scanners:remove:libc-musl = "clamav clamav-daemon clamav-freshclam"
@@ -59,15 +53,10 @@
     redhat-security \
     "
 
-SUMMARY:packagegroup-security-hardening = "Security Hardening tools"
-RDEPENDS:packagegroup-security-hardening = " \
-    bastille \
-    "
-
 SUMMARY:packagegroup-security-ids = "Security Intrusion Detection systems"
 RDEPENDS:packagegroup-security-ids = " \
     samhain-standalone \
-    ${@bb.utils.contains("BBLAYERS", "meta-rust", "suricata","", d)} \
+    suricata \
     ossec-hids \
     aide \
     "
@@ -92,7 +81,6 @@
     ptest-runner \
     samhain-standalone-ptest \
     ${@bb.utils.contains("BBLAYERS", "meta-rust", "suricata-ptest","", d)} \
-    python3-fail2ban-ptest \
     ${@bb.utils.contains("DISTRO_FEATURES", "smack", "smack-ptest", "",d)} \
 "
 
diff --git a/meta-security/recipes-ids/aide/aide_0.17.3.bb b/meta-security/recipes-ids/aide/aide_0.17.4.bb
similarity index 90%
rename from meta-security/recipes-ids/aide/aide_0.17.3.bb
rename to meta-security/recipes-ids/aide/aide_0.17.4.bb
index b1fb58d..6bc2bfe 100644
--- a/meta-security/recipes-ids/aide/aide_0.17.3.bb
+++ b/meta-security/recipes-ids/aide/aide_0.17.4.bb
@@ -8,7 +8,7 @@
 SRC_URI = "https://github.com/aide/aide/releases/download/v${PV}/${BPN}-${PV}.tar.gz \
            file://aide.conf"
 
-SRC_URI[sha256sum] = "a2eb1883cafaad056fbe43ee1e8ae09fd36caa30a0bc8edfea5d47bd67c464f8"
+SRC_URI[sha256sum] = "c81505246f3ffc2e76036d43a77212ae82895b5881d9b9e25c1361b1a9b7a846"
 
 inherit autotools pkgconfig
 
@@ -20,7 +20,7 @@
 PACKAGECONFIG[zlib] = "--with-zlib, --without-zlib, zlib, zlib "
 PACKAGECONFIG[xattr] = "--with-xattr, --without-xattr, attr, attr"
 PACKAGECONFIG[curl] = "--with-curl, --without-curl, curl, libcurl"
-PACKAGECONFIG[audit] = "--with-audit, --without-audit,"
+PACKAGECONFIG[audit] = "--with-audit, --without-audit,audit"
 PACKAGECONFIG[gcrypt] = "--with-gcrypt, --without-gcrypt, libgcrypt, libgcrypt"
 PACKAGECONFIG[mhash] = "--with-mhash, --without-mhash, libmhash, libmhash"
 PACKAGECONFIG[e2fsattrs] = "--with-e2fsattrs, --without-e2fsattrs, e2fsprogs, e2fsprogs"
diff --git a/meta-security/recipes-ids/ossec/ossec-hids_3.6.0.bb b/meta-security/recipes-ids/ossec/ossec-hids_3.7.0.bb
similarity index 98%
rename from meta-security/recipes-ids/ossec/ossec-hids_3.6.0.bb
rename to meta-security/recipes-ids/ossec/ossec-hids_3.7.0.bb
index b0759b1..c211f03 100644
--- a/meta-security/recipes-ids/ossec/ossec-hids_3.6.0.bb
+++ b/meta-security/recipes-ids/ossec/ossec-hids_3.7.0.bb
@@ -9,7 +9,7 @@
            file://0002-Makefile-don-t-set-uid-gid.patch \
            "
 
-SRCREV = "1303c78e2c67d7acee0508cb00c3bc63baaa27c2"
+SRCREV = "1ecffb1b884607cb12e619f9ab3c04f530801083"
 
 UPSTREAM_CHECK_COMMITS = "1"
 
diff --git a/meta-security/recipes-ids/samhain/samhain.inc b/meta-security/recipes-ids/samhain/samhain.inc
index df9e215..eb8592d 100644
--- a/meta-security/recipes-ids/samhain/samhain.inc
+++ b/meta-security/recipes-ids/samhain/samhain.inc
@@ -3,7 +3,7 @@
 LICENSE     = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=8ca43cbc842c2336e835926c2166c28b"
 
-PV = "4.4.7"
+PV = "4.4.9"
 
 SRC_URI = "https://la-samhna.de/archive/samhain_signed-${PV}.tar.gz \
            file://${INITSCRIPT_NAME}.init \
@@ -21,7 +21,7 @@
            file://samhain-fix-initializer-element-is-not-constant.patch \
            "
 
-SRC_URI[sha256sum] = "0aa978accb635000c2d9170f307bff8a95836f8ec01615a53dbd9c2af9564d44"
+SRC_URI[sha256sum] = "dd85bf2f90db3ce616a09608e650f3707a4d69aa1e1fe718f8b359ce0aafc198"
 
 UPSTREAM_CHECK_URI = "https://www.la-samhna.de/samhain/archive.html"
 UPSTREAM_CHECK_REGEX = "samhain_signed-(?P<pver>(\d+(\.\d+)+))\.tar"
diff --git a/meta-security/recipes-ids/suricata/libhtp_0.5.39.bb b/meta-security/recipes-ids/suricata/libhtp_0.5.40.bb
similarity index 90%
rename from meta-security/recipes-ids/suricata/libhtp_0.5.39.bb
rename to meta-security/recipes-ids/suricata/libhtp_0.5.40.bb
index 80c9014..08e285e 100644
--- a/meta-security/recipes-ids/suricata/libhtp_0.5.39.bb
+++ b/meta-security/recipes-ids/suricata/libhtp_0.5.40.bb
@@ -5,7 +5,7 @@
 LIC_FILES_CHKSUM = "file://LICENSE;beginline=1;endline=2;md5=596ab7963a1a0e5198e5a1c4aa621843"
 
 SRC_URI = "git://github.com/OISF/libhtp.git;protocol=https;branch=0.5.x"
-SRCREV = "6b70803c45894da7a591b2305498335e6df4f9a3"
+SRCREV = "1733478f7fd09e936fea2e024f1d228d40741df2"
 
 DEPENDS = "zlib"
 
diff --git a/meta-security/recipes-ids/suricata/suricata_6.0.4.bb b/meta-security/recipes-ids/suricata/suricata_6.0.5.bb
similarity index 97%
rename from meta-security/recipes-ids/suricata/suricata_6.0.4.bb
rename to meta-security/recipes-ids/suricata/suricata_6.0.5.bb
index 31244f3..913e64e 100644
--- a/meta-security/recipes-ids/suricata/suricata_6.0.4.bb
+++ b/meta-security/recipes-ids/suricata/suricata_6.0.5.bb
@@ -5,7 +5,7 @@
 LIC_FILES_CHKSUM = "file://LICENSE;beginline=1;endline=2;md5=c70d8d3310941dcdfcd1e02800a1f548"
 
 SRC_URI = "http://www.openinfosecfoundation.org/download/suricata-${PV}.tar.gz"
-SRC_URI[sha256sum] = "a8f197e33d1678689ebbf7bc1abe84934c465d22c504c47c2c7e9b74aa042d0d"
+SRC_URI[sha256sum] = "0d4197047c84ba070dfc6b1d9f9ee92f52a71403bfac0e29b2554bb21fe00754"
 
 DEPENDS = "lz4 libhtp"
 
@@ -121,7 +121,8 @@
 
 B = "${S}"
 
-PACKAGECONFIG ??= "jansson file pcre yaml python pcap cap-ng net nfnetlink nss nspr "
+# nfnetlink has a dependancy to meta-networking
+PACKAGECONFIG ??= "jansson file pcre yaml python pcap cap-ng net nss nspr "
 PACKAGECONFIG:append = " ${@bb.utils.contains('DISTRO_FEATURES', 'ptest', 'unittests', '', d)}"
 
 PACKAGECONFIG[pcre] = "--with-libpcre-includes=${STAGING_INCDIR} --with-libpcre-libraries=${STAGING_LIBDIR}, ,libpcre ," 
diff --git a/meta-security/recipes-perl/perl/lib-perl_0.63.bb b/meta-security/recipes-perl/perl/lib-perl_0.63.bb
index 4c964d5..25d0890 100644
--- a/meta-security/recipes-perl/perl/lib-perl_0.63.bb
+++ b/meta-security/recipes-perl/perl/lib-perl_0.63.bb
@@ -26,3 +26,10 @@
 	export LIBC="$(find ${STAGING_DIR_TARGET}/${base_libdir}/ -name 'libc-*.so')"
 	cpan_do_compile
 }
+
+do_install:append() {
+   # Man pages here conflict wtih the main perl documentation
+   for page in ${D}${mandir}/man*/*; do
+        mv $page $(dirname $page)/${BPN}-$(basename $page)
+    done
+}
diff --git a/meta-security/recipes-scanners/arpwatch/arpwatch_3.1.bb b/meta-security/recipes-scanners/arpwatch/arpwatch_3.1.bb
index c152b8c..c8d31cf 100644
--- a/meta-security/recipes-scanners/arpwatch/arpwatch_3.1.bb
+++ b/meta-security/recipes-scanners/arpwatch/arpwatch_3.1.bb
@@ -3,7 +3,7 @@
 HOME_PAGE = "http://ee.lbl.gov/"
 LIC_FILES_CHKSUM = "file://configure;md5=74ca964ed34fda7b46c6fe3e50bded9d"
 
-DEPENDS += "libpcap postfix"
+DEPENDS += "libpcap"
 
 SRC_URI = "https://ee.lbl.gov/downloads/arpwatch/${BP}.tar.gz \
            file://arpwatch.conf \
@@ -21,7 +21,11 @@
 APRWATCH_FROM ?= "root "
 ARPWATH_REPLY ?= "${ARPWATCH_UID}"
 
-EXTRA_OECONF = " --srcdir=${S} --with-watcher=email=${APRWATCH_FROM} --with-watchee=email=${ARPWATH_REPLY}"
+PACKAGECONFIG ??= ""
+
+PACKACONFIG[email] = "-with-watcher=email=${APRWATCH_FROM} --with-watchee=email=${ARPWATH_REPLY}, , postfix, postfix postfix-cfg"
+
+EXTRA_OECONF:append = " --srcdir=${S}"
 
 CONFIGUREOPTS = " --build=${BUILD_SYS} \
           --host=${HOST_SYS} \
@@ -76,4 +80,4 @@
 FILES:${PN} = "${bindir} ${sbindir} ${prefix}/etc/rc.d \
                ${sysconfdir} /var/lib/arpwatch"
 
-RDEPENDS:${PN} = "libpcap postfix postfix-cfg"
+RDEPENDS:${PN} = "libpcap"
diff --git a/meta-security/recipes-security/fscrypt/fscrypt_1.0.0.bb b/meta-security/recipes-security/fscrypt/fscrypt_1.0.0.bb
index 663d8e2..8147fe6 100644
--- a/meta-security/recipes-security/fscrypt/fscrypt_1.0.0.bb
+++ b/meta-security/recipes-security/fscrypt/fscrypt_1.0.0.bb
@@ -8,19 +8,19 @@
 LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://src/${GO_IMPORT}/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
 
-BBCLASSEXTEND = "native nativesdk"
-
 # fscrypt depends on go and libpam
 DEPENDS += "go-native libpam"
 
 SRCREV = "92b1e9a8670ccd3916a7d24a06cab1e4c9815bc4"
 SRC_URI = "git://github.com/google/fscrypt.git;branch=master;protocol=https"
+
 GO_IMPORT = "import"
 
-S = "${WORKDIR}/git"
+inherit go goarch features_check
 
-inherit go
-inherit goarch
+REQUIRED_DISTRO_FEATURES = "pam"
+
+S = "${WORKDIR}/git"
 
 do_compile() {
 	export GOARCH=${TARGET_GOARCH}
@@ -47,3 +47,5 @@
 	install -d ${D}/${bindir}
 	install ${S}/src/${GO_IMPORT}/bin/fscrypt ${D}/${bindir}/fscrypt
 }
+
+BBCLASSEXTEND = "native nativesdk"