[yocto] [meta-security][PATCH 00/14] Port over meta-integrity

Copied meta-integrity from meta-intel-iot-security that Intel created, to carry on maintenance. This update that code base to work on master. runtime test passes on Arm H/w and qemux86-64 Armin Kuster (14): meta-integrity: port over from meta-intel-iot-security layer.conf: add LAYERSERIES_C

[yocto] [meta-security][PATCH 02/14] layer.conf: add LAYERSERIES_COMPAT

Signed-off-by: Armin Kuster --- meta-integrity/conf/layer.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-integrity/conf/layer.conf b/meta-integrity/conf/layer.conf index e8bb268..2f696cf 100644 --- a/meta-integrity/conf/layer.conf +++ b/meta-integrity/conf/layer.conf @@ -20,3 +20

[yocto] [meta-security][PATCH 03/14] README: update

Signed-off-by: Armin Kuster --- meta-integrity/README.md | 5 + 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/meta-integrity/README.md b/meta-integrity/README.md index ba96d8e..5bef76e 100644 --- a/meta-integrity/README.md +++ b/meta-integrity/README.md @@ -24,12 +24,9 @@ This

[yocto] [meta-security][PATCH 05/14] ima.cfg: update to 5.0 kernel

Signed-off-by: Armin Kuster --- .../recipes-kernel/linux/linux/ima.cfg| 28 ++- .../linux/linux/ima_evm_root_ca.cfg | 6 ++-- 2 files changed, 18 insertions(+), 16 deletions(-) diff --git a/meta-integrity/recipes-kernel/linux/linux/ima.cfg b/meta-integrity/rec

[yocto] [meta-security][PATCH 04/14] ima-evm-utils: cleanup and update to tip

update to tip backported patches to fix build issues. fix native support Signed-off-by: Armin Kuster --- .../ima-evm-utils/ima-evm-utils.inc | 19 -- ...link-to-libcrypto-instead-of-OpenSSL.patch | 65 +++ ...ls-replace-INCLUDES-with-AM_CPPFLAGS.patch | 43 +

[yocto] [meta-security][PATCH 01/14] meta-integrity: port over from meta-intel-iot-security

Signed-off-by: Armin Kuster --- meta-integrity/README.md | 253 ++ meta-integrity/classes/ima-evm-rootfs.bbclass | 92 +++ meta-integrity/conf/layer.conf| 22 ++ .../data/debug-keys/privkey_ima.pem | 16 ++ meta-integrity/data/

[yocto] [meta-security][PATCH 07/14] base-files: add appending to automount securityfs

Signed-off-by: Armin Kuster --- meta-integrity/recipes-core/base-files/base-files-ima.inc| 5 + meta-integrity/recipes-core/base-files/base-files_%.bbappend | 1 + 2 files changed, 6 insertions(+) create mode 100644 meta-integrity/recipes-core/base-files/base-files-ima.inc create mode 1

[yocto] [meta-security][PATCH 10/14] policy: add ima appraise all policy

Signed-off-by: Armin Kuster --- .../files/ima_policy_appraise_all | 29 +++ .../ima-policy-appraise-all_1.0.bb| 18 2 files changed, 47 insertions(+) create mode 100644 meta-integrity/recipes-security/ima_policy_appraise_all/files/ima_policy_

[yocto] [meta-security][PATCH 08/14] ima-policy-hashed: add new recipe

Signed-off-by: Armin Kuster --- .../ima_policy_hashed/files/ima_policy_hashed | 77 +++ .../ima-policy-hashed_1.0.bb | 20 + 2 files changed, 97 insertions(+) create mode 100644 meta-integrity/recipes-security/ima_policy_hashed/files/ima_policy_hashed creat

[yocto] [meta-security][PATCH 13/14] runtime qa: moderize ima test

Signed-off-by: Armin Kuster --- meta-integrity/lib/oeqa/runtime/__init__.py | 0 meta-integrity/lib/oeqa/runtime/cases/ima.py | 129 +++ meta-integrity/lib/oeqa/runtime/ima.py | 82 3 files changed, 129 insertions(+), 82 deletions(-) delete mode 100644 meta

[yocto] [meta-security][PATCH 09/14] ima_policy_simple: add another sample policy

Signed-off-by: Armin Kuster --- .../ima_policy_simple/files/ima_policy_simple | 4 .../ima_policy_simple/ima-policy-simple_1.0.bb | 18 ++ 2 files changed, 22 insertions(+) create mode 100644 meta-integrity/recipes-security/ima_policy_simple/files/ima_policy_simple creat

[yocto] [meta-security][PATCH 14/14] image: add image for testing

Signed-off-by: Armin Kuster --- .../images/integrity-image-minimal.bb | 22 +++ 1 file changed, 22 insertions(+) create mode 100644 meta-integrity/recipes-core/images/integrity-image-minimal.bb diff --git a/meta-integrity/recipes-core/images/integrity-image-minimal.bb

[yocto] [meta-security][PATCH 06/14] linux: update bbappend

remove untested code Signed-off-by: Armin Kuster --- .../recipes-kernel/linux/linux-%.bbappend | 117 +- 1 file changed, 2 insertions(+), 115 deletions(-) diff --git a/meta-integrity/recipes-kernel/linux/linux-%.bbappend b/meta-integrity/recipes-kernel/linux/linux-%.bbappen

[yocto] [meta-security][PATCH 11/14] data: remove policies

Signed-off-by: Armin Kuster --- meta-integrity/data/ima_policy_appraise_all | 29 meta-integrity/data/ima_policy_hashed | 77 - meta-integrity/data/ima_policy_simple | 4 -- 3 files changed, 110 deletions(-) delete mode 100644 meta-integrity/data/ima_pol

[yocto] [meta-security][PATCH 12/14] initramfs: clean up to pull in packages.

Signed-off-by: Armin Kuster --- .../initrdscripts/initramfs-framework-ima.bb | 12 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima.bb b/meta-integrity/recipes-core/initrdscripts/initramfs-framew

[yocto] [meta-cgl][PATCH 1/2] crmsh: do not use unstable github archive tarballs

Since commit [21f84fc insane: add sanity checks to SRC_URI] applied in oe-core, do not use unstable github archive tarballs Signed-off-by: Hongxu Jia --- meta-cgl-common/recipes-cgl/crmsh/crmsh_3.0.3.bb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/meta-cgl-common/rec

[yocto] [meta-selinux][PATCH] setools: do not use unstable github archive tarballs

Since commit [21f84fc insane: add sanity checks to SRC_URI] applied in oe-core, do not use unstable github archive tarballs Signed-off-by: Hongxu Jia --- recipes-security/setools/setools_4.1.1.bb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/recipes-security/setools/s

[yocto] [meta-cgl][PATCH 2/2] pacemaker: do not use unstable github archive tarballs

Since commit [21f84fc insane: add sanity checks to SRC_URI] applied in oe-core, do not use unstable github archive tarballs Signed-off-by: Hongxu Jia --- meta-cgl-common/recipes-cgl/pacemaker/pacemaker_1.1.19.bb | 7 +++ 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/meta-cgl-