BMC/tmp/openbmc.git/meta-security, branch 2.9.0

create gatesgarth branch

2020-12-08T19:32:35+00:00

Reset the following subtrees on gatesgarth: meta-raspberrypi: 09a3c11696(gatesgarth) poky: 943ef2fad8(gatesgarth) meta-openembedded: b9dcf17700(gatesgarth) meta-xilinx: b3e37df5d9(gatesgarth) meta-security: 4583ab9b08(gatesgarth) cherry pick: meta-phosphor: c52fa217b832 Change-Id: I8ad417df218284605f6edfe65798a3b0c99aba12 Signed-off-by: Brad Bishop

meta-security: subtree update:e8c9e69c80..d2ceb5e438

2020-12-01T01:54:57+00:00

Armin Kuster (2): samhain: update to 4.4.2 kas-security-base: Don't create local SSTATE mirror Yi Zhao (3): suricata: unify volatiles file name clamav: unify volatiles file name scap-security-guide: fix build with Python 3.9 Signed-off-by: Andrew Geissler Change-Id: I60c6ba8c22593542165dbd1af0606e01f6473b33

meta-security: subtree update:4c2f7ffd49..e8c9e69c80

2020-10-30T20:42:06+00:00

Armin Kuster (3): meta-security: Add gatesgarth to LAYERSERIES_COMPAT gitlab-ci: add meta-hardening build image gitlab-ci: add building meta-security-compliance pkgs Sajjad Ahmed (1): layer.conf: use += instead of := to update BBFILES Signed-off-by: Andrew Geissler Change-Id: Id5439f3fdfc88fe3c987ee3c8cb7d3ed6a5a6a22

meta-security: subtree update:d6baccc068..4c2f7ffd49

2020-10-16T15:14:41+00:00

Adrian (1): gitignore added Armin Kuster (31): kas: build with ptest. remove apparmor softHSM: add pkg packagegroup-core-security: add softHSM libest: add recipe packagegroup-core-security: add libest package opendnssec: add recipe packagegroup-core-security: add opendnssec to pkg grp gitlab-ci: allow test to fail libseccomp: fix ptest failures. packagegroup-core-security-ptest: remove keyutils-ptest security-test-image: simplify packagegroup-core-security-ptest: remove apparmor: fix build issue with ptest enabled. security-test-image: tweak to get more tests to runn apparmor: update to 3.0 packagegroup-core-security: apparmor 3.0 ptest does not build suricata: fix compiling on gcc10 qemux86-test: add apparmor back apparmor: fix build for on musl ecryptfs-utils: fix musl build libest: fix musl build. sssd: update to latest ltm 1.16.5 packagegroup-core-security: remove clamav from musl image suricata: update to 4.1.9 kas: fixup alt configs gitlab-ci: add qemux86 and qemuarm64 musl builds tpm2-tss: update to 2.4.3 tpm2-totp: update to 0.2.1 tpm2-abrmd: update to 2.3.3 tpm2-tools: update to 4.3.0 tpm2-pkcs11: update to 1.4.0 Mingli Yu (1): scap-security-guide: add expat-native to DEPENDS Naveen Saini (3): initramfs-framework/dmverity: add retry loop for slow boot devices wic: add wks.in for intel dm-verity linux-%/5.x: Add dm-verity fragment as needed Signed-off-by: Andrew Geissler Change-Id: If3a721fdd99bb6e35c82cf4e7485f06cebaef905

meta-security: subtree update:787ba6faea..d6baccc068

2020-09-18T18:34:49+00:00

Armin Kuster (20): trousers: update to tip upload-error-report: add script to upload errors kas/kas-security-base.yml: lets enable error reporting .gitlab: send error reports cryptsetup-tpm-incubator: drop recipe sssd: Avoid nss function conflicts with glibc nss.h cryptsetup-tpm-incubator: remove reference from other files packagegroup-core-security: dont include suricata on riscv or ppc kas-security-base: add testimage kas: add test config kas: add one dm-verify image build gitlab-ci: add dm-verify-image gitlab-ci: add testimage meta-harden: Add a layer to demo harding OE/YP kas-security-base: define sections as base packagegroup-core-security: add more pkgs to base group apparmor: exclude mips64, not supported kas: add alt and mutli build images kas-security-base: set RPM and disable ptest qemu test: set ptest Charlie Davies (1): clamav: update SO_VER to 9.0.4 Jens Rehsack (2): ibmswtpm2: update to 1637 ibmtpm2tss: add recipe Jonatan Pålsson (1): sssd: Make manpages buildable Qi.Chen@windriver.com (1): nss: update patch to fix do_patch error Zheng Ruoqin (1): trousers: Fix the problem that do_package fails when multilib is enabled. niko.mauno@vaisala.com (12): dm-verity-img.bbclass: Fix bashisms dm-verity-img.bbclass: Reorder parse-time check dm-verity-image-initramfs: Ensure verity hash sync dm-verity-image-initramfs: Bind at do_image instead linux-yocto(-dev): Add dm-verity fragment as needed dm-verity-img.bbclass: Stage verity.env file initramfs-framework: Add dmverity module dm-verity-image-initramfs: Use initramfs-framework dm-verity-initramfs-image: Cosmetic improvements dm-verity-image-initramfs: Add base-passwd package dm-verity-image-initramfs: Drop locales from image beaglebone-yocto-verity.wks.in: Refer IMGDEPLOYDIR Signed-off-by: Andrew Geissler Change-Id: I9f2debc1f48092734569fd106b56cd7bcb6180b7

meta-security: subtree update:066a04425c..787ba6faea

2020-08-21T20:57:24+00:00

Armin Kuster (10): lynis: update to 3.0.0 security images: Move to recipe-core security packagegroups: move to recipes-core packagegroup-security-tpm: add more packages for building packagegroup-core-security: remove clamav for riscv* libsecomp: rv32/rv64 target builds are not supported yet packagegroup-core-security: remove libseccomp for riscv* libseccomp: update to 2.5.0 packagegroup-core-security: restore riscv64 for libssecomp trousers: Several Security fixes Charlie Davies (1): clamav: add INSTALL_CLAMAV_CVD flag to do_install Kai Kang (1): libseccomp: fix cross compile error for mips Yi Zhao (1): ibmswtpm2: upgrade 1563 -> 1628 Signed-off-by: Andrew Geissler Change-Id: I0341c0d4cd61fb6ef7db6a29f9fc60de3caa822f

meta-security: subtree update:547f552c85..066a04425c

2020-07-24T21:10:27+00:00

Armin Kuster (9): python3-oauth2client: add recipe python3-privacyidea: adding initial support for mfa strongswan: add bbappends for tpm changes layer.conf: add dynamic-layer for strongswan strongswan: Add bbappends for ima changes meta-integrity: add dynamic-layer for strongswan add gitlab framework and qemu machine kas: add ima, tpm and tpm2 build configs drop ci-build: it is hiding errors Jeremy Puhlman (2): cryptsetup-tpm-incubator: RPROVIDES cryptsetup and cryptsetup-dev packagegroup-security-tpm2: Depend on preferred provider for cryptsetup Zheng Ruoqin (2): ccs-tools:Fix build error when enable multilib. bastille: Deleted redundant inherit to fix error when enable multilib. Signed-off-by: Andrew Geissler Change-Id: I023e45c8080c3d423cd25cc656da5c1f527295e5

meta-security: subtree update:7831969f8c..547f552c85

2020-07-10T20:55:26+00:00

Armin Kuster (3): suricata: update to 4.1.8 packagegroup-core-security-ptest: update fail2ban ptest pkg name isafw.bbclass: typo in layer name Signed-off-by: Andrew Geissler Change-Id: I1a4a51839d53d75ca7e45ea7b1fdb46a62fe33b9

meta-security: subtree update:95fe86eb98..7831969f8c

2020-06-27T05:15:04+00:00

Alexander Kanavin (1): apparmor: pull in coreutils/findutils only when not using systemd as init manager Armin Kuster (7): tpm2-tools: update to 4.1.3 tpm2-tss: update to 2.4.1 tpm2-tss-engine: add branch to SRC_URI & update to tip tpm2-pkcs11: update 1.2.0 libtpm: update to 0.7.2 openscap: update to 1.3.3 tpm2-tcti-uefi: drop patch no longer needed Jeremy Puhlman (2): clamav: resolve multilib issues tripwire: Remove makefiles from the man directories. Kai Kang (1): sssd: disable build secrets Signed-off-by: Andrew Geissler Change-Id: I1e19d2563541504bcf89f1f70c680bd7e7e62d6c

meta-security: subtree update:b72cc7f87c..95fe86eb98

2020-05-21T20:43:47+00:00

André Draszik (1): linux-yocto: update the bbappend to 5.x Armin Kuster (36): README: add pull request option sssd: drop py2 support python3-fail2ban: update to latest Apparmor: fix some runtime depends linux-yocto-dev: remove "+" checksecurity: fix runtime issues buck-security: fix rdebends and minor style cleanup swtpm: fix configure error ecryptfs-utils: search nspr header files in ${STAGING_INCDIR}/nspr directory bastille: convert to py3 tpm2-tools: update to 4.1.1 tpm2-tcti-uefi: fix build issue for i386 machine tpm2-tss: update to 2.3.2 ibmswtpm2: update to 1563 python3-fail2ban: add 2-3 conversion changes google-authenticator-libpam: install module in pam location apparmor: update to tip clamav: add bison-native to depend meta-security-isafw: import layer from Intel isafw: fix to work against master layer.conf: add zeus README.md: update to new maintainer clamav-native: missed bison fix secuirty*-image: remove dead var and minor cleanup libtpm: fix build issue over pod2man sssd: python2 not supported libseccomp: update to 2.4.3 lynis: add missing rdepends fail2ban: change hardcoded sysklogd to VIRTUAL-RUNTIME_base-utils-syslog chkrootkit: add rootkit recipe clamav: move to recipes-scanners checksec: move to recipe-scanners checksecurity: move to recipes-scanners buck-security: move to recipes-scanners arpwatch: add new recipe buck-security: fix runtime issue with missing per module Bartosz Golaszewski (3): linux: drop the bbappend for linux v4.x series classes: provide a class for generating dm-verity meta-data images dm-verity: add a working example for BeagleBone Black Haseeb Ashraf (1): samhain: dnmalloc hash fix for aarch64 and mips64 Jan Luebbe (2): apparmor: fix wrong executable permission on service file apparmor: update to 2.13.4 Jonatan Pålsson (10): README: Add meta-python to list of layer deps sssd: Add PACKAGECONFIG for python2 sssd: Fix typo in PACKAGECONFIG. cyrpto -> crypto sssd: DEPEND on nss if nothing else is chosen sssd: Sort PACKAGECONFIG entries sssd: Add autofs PACKAGECONFIG sssd: Add sudo PACKAGECONFIG sssd: Add missing files to SYSTEMD_SERVICE sssd: Add missing DEPENDS on jansson sssd: Add infopipe PACKAGECONFIG Kai Kang (1): sssd: fix for ldblibdir and systemd etc Martin Jansa (1): layer.conf: update LAYERSERIES_COMPAT for dunfell Mingli Yu (1): linux-yocto: update the bbappend to 5.x Pierre-Jean Texier via Lists.Yoctoproject.Org (1): google-authenticator-libpam: upgrade 1.07 -> 1.08 Yi Zhao (5): samhain: fix build with new version attr scap-security-guide: fix xml parsing error when build remediation files scap-security-guide: pass the correct schema file path to openscap-native openscap-daemon: add missing runtime dependencies samhain-server: add volatile file for systemd Change-Id: I3d4a4055cb9420e97d3eacf8436d9b048d34733f Signed-off-by: Andrew Geissler