add meta-app-framework to meta-agl

meta-app-framework is a layer containing the AGL App Framework recipes

4 new layers are added for application framework:
* meta-intel-iot-security/meta-security-smack
* meta-intel-iot-security/meta-security-framework
* meta-agl/meta-agl-security
* meta-agl/meta-app-framework

In the templates files, the following changes were done:
* activation of Smack and Cynara
* modify the tar command to be used to support Smack extended attributes

Change-Id: If369221ca7614fe0072f2a0f99a5051ef2af831d
Signed-off-by: Stephane Desneux <stephane.desneux@iot.bzh>

35 files changed, 804 insertions, 3 deletions

diff --git a/meta-agl/conf/distro/poky-agl.conf b/meta-agl/conf/distro/poky-agl.conf
index 6d6f120fe..e1dac683d 100644
--- a/meta-agl/conf/distro/poky-agl.conf
+++ b/meta-agl/conf/distro/poky-agl.conf
@@ -137,6 +137,20 @@ BB_DANGLINGAPPENDS_WARNONLY = "1"
 
 # enforce security-related compiler flags by default
 require conf/distro/include/security_flags.inc
+
 # required overrides, upstreamed but not merged yet:
 # http://lists.openembedded.org/pipermail/openembedded-devel/2016-June/107727.html
 SECURITY_CFLAGS_pn-llvm3.3 = "${SECURITY_NO_PIE_CFLAGS}"
+
+# enable security features (smack, cynara) - required by Application Framework
+OVERRIDES .= ":smack"
+DISTRO_FEATURES_append = " smack dbus-cynara"
+
+# use tar-native to support SMACK extended attributes independently of host config
+IMAGE_CMD_TAR = "tar --xattrs-include='*'"
+IMAGE_DEPENDS_tar_append = " tar-replacement-native"
+EXTRANATIVEPATH += "tar-native"
+
+# security: enable ssh server in place of dropbear to support PAM on user sessions
+IMAGE_FEATURES += "ssh-server-openssh"
+
diff --git a/meta-app-framework/conf/layer.conf b/meta-app-framework/conf/layer.conf
new file mode 100644
index 000000000..f74ebd658
--- /dev/null
+++ b/meta-app-framework/conf/layer.conf
@@ -0,0 +1,11 @@
+# We have a conf and classes directory, add to BBPATH
+BBPATH .= ":${LAYERDIR}"
+
+# We have recipes-* directories, add to BBFILES
+BBFILES += "${LAYERDIR}/recipes-*/*/*.bb \
+	${LAYERDIR}/recipes-*/*/*.bbappend"
+
+BBFILE_COLLECTIONS += "app-framework"
+BBFILE_PATTERN_app-framework = "^${LAYERDIR}/"
+BBFILE_PRIORITY_app-framework = "7"
+
diff --git a/meta-app-framework/recipes-config/agl-users/agl-users_0.1.bb b/meta-app-framework/recipes-config/agl-users/agl-users_0.1.bb
new file mode 100644
index 000000000..0f61248db
--- /dev/null
+++ b/meta-app-framework/recipes-config/agl-users/agl-users_0.1.bb
@@ -0,0 +1,65 @@
+inherit allarch useradd
+
+SUMMARY = "AGL Users Seed"
+DESCRIPTION = "This is a core framework component that\
+ defines how users are managed and who are the default users."
+
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
+
+
+SRC_URI = ""
+
+
+RDEPENDS_${PN}_append_smack = " smack-userspace"
+DEPENDS_append_smack = " smack-userspace-native"
+
+ALLOW_EMPTY_${PN} = "1"
+
+USERADD_PACKAGES = "${PN}"
+
+USERADD_PARAM_${PN} = "\
+  -g users -d /home/agl-driver -m -K PASS_MAX_DAYS=-1 agl-driver ; \
+  -g users -d /home/agl-passenger -m -K PASS_MAX_DAYS=-1 agl-passenger \
+"
+
+
+do_configure() {
+    :
+}
+
+do_compile() {
+    :
+}
+
+do_install() {
+    :
+}
+
+
+pkg_postinst_${PN}() {
+    #!/bin/sh -e
+
+    # avoid to run on host
+    [ x"$D" != "x" ] && exit 1
+
+    # Drops password
+    passwd -d agl-driver
+    passwd -d agl-passenger
+}
+           
+pkg_postinst_${PN}_smack() {
+    #!/bin/sh -e
+
+    # avoid to run on host
+    [ x"$D" != "x" ] && exit 1
+
+    # Actions to carry out on the device go here
+    for x in /etc/skel /home/*
+    do
+        chsmack -a User::Home $x
+    done
+    passwd -d agl-driver
+    passwd -d agl-passenger
+}
+           
diff --git a/meta-app-framework/recipes-core/af-binder/af-binder_1.0.bb b/meta-app-framework/recipes-core/af-binder/af-binder_1.0.bb
new file mode 100644
index 000000000..4fcff66e7
--- /dev/null
+++ b/meta-app-framework/recipes-core/af-binder/af-binder_1.0.bb
@@ -0,0 +1,73 @@
+SUMMARY = "HTTP REST interface to automotive backends for HTML5 UI support"
+DESCRIPTION = "Automotive-Framework-Binder Daemon provides a HTTP REST \
+interface to various automotive-oriented plugins (sound, radio...), \
+allowing HTML5 UIs to send platform-specific requests in a secure way."
+HOMEPAGE = "https://gerrit.automotivelinux.org/gerrit/#/admin/projects/src/app-framework-binder"
+
+LICENSE = "Apache-2.0"
+LIC_FILES_CHKSUM = "file://LICENSE-2.0.txt;md5=3b83ef96387f14655fc854ddc3c6bd57"
+
+DEPENDS = "file json-c libmicrohttpd systemd util-linux"
+DEPENDS += "alsa-lib glib-2.0 gssdp gupnp gupnp-av pulseaudio"
+
+SRC_URI_git = "git://gerrit.automotivelinux.org/gerrit/src/app-framework-binder;protocol=https;branch=1.0"
+SRC_URI_files = ""
+SRC_URI = "${SRC_URI_git} \
+           ${SRC_URI_files} \
+          "
+
+SRCREV = "897aa6a130eab1eb716fcc13e650fb5833a7ce32"
+S = "${WORKDIR}/git"
+
+inherit cmake pkgconfig
+
+FILES_${PN} += "${datadir}"
+
+#############################################
+# setup meta package
+#############################################
+PACKAGES += "${PN}-meta"
+ALLOW_EMPTY_${PN}-meta = "1"
+
+#############################################
+# setup sample plugin packages
+#############################################
+PACKAGES_DYNAMIC = "${PN}-plugin-*"
+
+python populate_packages_prepend () {
+    afb_libdir = d.expand('${libdir}/afb')
+    postinst = d.getVar('plugin_postinst', True)
+    pkgs = []
+    pkgs_dbg = []
+
+    pkgs += do_split_packages(d, afb_libdir, '(.*)-api\.so$', d.expand('${PN}-plugin-%s'), 'AFB plugin for %s', postinst=postinst, extra_depends=d.expand('${PN}'))
+    pkgs += do_split_packages(d, afb_libdir, '(.*(?!-api))\.so$', d.expand('${PN}-plugin-%s'), 'AFB plugin for %s', postinst=postinst, extra_depends=d.expand('${PN}'))
+
+    pkgs_dbg += do_split_packages(d, oe.path.join(afb_libdir, ".debug"), '(.*)-api\.so$', d.expand('${PN}-plugin-%s-dbg'), 'AFB plugin for %s, debug info', postinst=postinst, extra_depends=d.expand('${PN}'))
+    pkgs_dbg += do_split_packages(d, oe.path.join(afb_libdir, ".debug"), '(.*(?!-api))\.so$', d.expand('${PN}-plugin-%s-dbg'), 'AFB plugin for %s, debug info', postinst=postinst, extra_depends=d.expand('${PN}'))
+
+    metapkg = d.getVar('PN', True) + '-meta'
+    d.setVar('RDEPENDS_' + metapkg, ' '.join(pkgs))
+}
+
+#############################################
+# setup libafbwsc package
+#############################################
+PACKAGES =+ "libafbwsc libafbwsc-dev libafbwsc-dbg"
+
+FILES_libafbwsc = "\
+	${libdir}/libafbwsc.so.* \
+"
+FILES_libafbwsc-dev = "\
+	${includedir}/afb/afb-wsj1.h \
+	${includedir}/afb/afb-ws-client.h \
+	${bindir}/afb-client-demo \
+	${libdir}/libafbwsc.so \
+	${libdir}/pkgconfig/libafbwsc.pc \
+"
+FILES_libafbwsc-dbg = "\
+	${libdir}/.debug/libafbwsc.so.* \
+	${bindir}/.debug/afb-client-demo \
+"
+RDEPENDS_libafbwsc-dbg += "${PN}-dbg libafbwsc-dev"
+
diff --git a/meta-app-framework/recipes-core/af-main/af-main/Hack-to-allow-the-debugging.patch b/meta-app-framework/recipes-core/af-main/af-main/Hack-to-allow-the-debugging.patch
new file mode 100644
index 000000000..44e8bce1e
--- /dev/null
+++ b/meta-app-framework/recipes-core/af-main/af-main/Hack-to-allow-the-debugging.patch
@@ -0,0 +1,29 @@
+From a4fbfb88f1b7c4f4287d9279767220fae80d26da Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Bollo?= <jose.bollo@iot.bzh>
+Date: Thu, 21 Jan 2016 15:07:29 +0100
+Subject: [PATCH] Hack to allow the debugging
+
+This is a temporarily fix to continue debugging
+afm-main. This should be removed later.
+
+Change-Id: I2f10f0cb1fce2ee30bd0754ad2e7bc8e2f6513aa
+---
+ conf/afm-user-daemon.conf | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/conf/afm-user-daemon.conf b/conf/afm-user-daemon.conf
+index 801c7ae..98a3152 100644
+--- a/conf/afm-user-daemon.conf
++++ b/conf/afm-user-daemon.conf
+@@ -25,7 +25,7 @@
+         </policy>
+ 
+         <policy context="default">
+-                <deny own="org.AGL.afm.user"/>
++                <allow own="org.AGL.afm.user"/>
+                 <allow send_destination="org.AGL.afm.system"/>
+         </policy>
+ 
+-- 
+2.1.4
+
diff --git a/meta-app-framework/recipes-core/af-main/af-main_1.0.bb b/meta-app-framework/recipes-core/af-main/af-main_1.0.bb
new file mode 100644
index 000000000..a29b071ac
--- /dev/null
+++ b/meta-app-framework/recipes-core/af-main/af-main_1.0.bb
@@ -0,0 +1,95 @@
+# NOTE: using libcap-native and setcap in install doesn't work
+# NOTE: there is no SYSTEMD_USER_SERVICE_...
+# NOTE: maybe setting afm_name to agl-framework is cleaner but has implications
+# NOTE: there is a hack of security for using groups and dbus (to be checked)
+# NOTE: using ZIP programs creates directories with mode 777 (very bad)
+
+inherit cmake pkgconfig useradd systemd
+
+SUMMARY = "AGL Framework Main part"
+DESCRIPTION = "\
+This is a core framework component for managing \
+applications, widgets, and components. \
+"
+
+HOMEPAGE = "https://gerrit.automotivelinux.org/gerrit/#/admin/projects/src/app-framework-main"
+LICENSE = "Apache-2.0"
+LIC_FILES_CHKSUM = "file://COPYING;md5=3b83ef96387f14655fc854ddc3c6bd57"
+
+SRC_URI_git = "git://gerrit.automotivelinux.org/gerrit/src/app-framework-main;protocol=https;branch=1.0"
+SRC_URI_files = ""
+SRC_URI = "${SRC_URI_git} \
+           ${SRC_URI_files} \
+          "
+
+SRCREV = "d0fdae3af6998efdce4c6ba0c5d650898c9c5b27"
+
+SECTION = "base"
+
+S = "${WORKDIR}/git"
+
+DEPENDS = "openssl libxml2 xmlsec1 systemd libzip json-c security-manager libcap-native af-binder"
+
+afm_name    = "afm"
+afm_confdir = "${sysconfdir}/${afm_name}"
+afm_datadir = "${datadir}/${afm_name}"
+afb_plugin_dir = "${libdir}/afb"
+
+EXTRA_OECMAKE = "\
+	-DUSE_LIBZIP=1 \
+	-DUSE_SIMULATION=0 \
+	-Dafm_name=${afm_name} \
+	-Dafm_confdir=${afm_confdir} \
+	-Dafm_datadir=${afm_datadir} \
+	-DUNITDIR_USER=${systemd_user_unitdir} \
+	-DUNITDIR_SYSTEM=${systemd_system_unitdir} \
+"
+
+USERADD_PACKAGES = "${PN}"
+USERADD_PARAM_${PN} = "-g ${afm_name} -d ${afm_datadir} -r ${afm_name}"
+GROUPADD_PARAM_${PN} = "-r ${afm_name}"
+
+SYSTEMD_SERVICE_${PN} = "afm-system-daemon.service"
+SYSTEMD_AUTO_ENABLE = "enable"
+
+FILES_${PN} += "\
+	${@bb.utils.contains('DISTRO_FEATURES', 'systemd', '${systemd_user_unitdir}/afm-user-daemon.service', '', d)} \
+"
+
+RDEPENDS_${PN}_append_smack = " smack-userspace"
+DEPENDS_append_smack = " smack-userspace-native"
+
+# short hack here
+SRC_URI += " file://Hack-to-allow-the-debugging.patch"
+
+do_install_append() {
+    if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
+        mkdir -p ${D}${sysconfdir}/systemd/user/default.target.wants
+        ln -sf ${systemd_user_unitdir}/afm-user-daemon.service ${D}${sysconfdir}/systemd/user/default.target.wants
+    fi
+}
+
+pkg_postinst_${PN}() {
+    mkdir -p $D${afm_datadir}/applications $D${afm_datadir}/icons
+    setcap cap_mac_override,cap_dac_override=ie $D${bindir}/afm-system-daemon
+    setcap cap_mac_override,cap_mac_admin,cap_setgid=ie $D${bindir}/afm-user-daemon
+}
+
+pkg_postinst_${PN}_smack() {
+    mkdir -p $D${afm_datadir}/applications $D${afm_datadir}/icons
+    chown ${afm_name}:${afm_name} $D${afm_datadir} $D${afm_datadir}/applications $D${afm_datadir}/icons
+    chsmack -a 'System::Shared' -t $D${afm_datadir} $D${afm_datadir}/applications $D${afm_datadir}/icons
+    setcap cap_mac_override,cap_dac_override=ie $D${bindir}/afm-system-daemon
+    setcap cap_mac_override,cap_mac_admin,cap_setgid=ie $D${bindir}/afm-user-daemon
+}
+
+PACKAGES =+ "${PN}-afbplugin ${PN}-afbplugin-dbg"
+FILES_${PN}-afbplugin = " ${afb_plugin_dir}/afm-main-plugin.so "
+FILES_${PN}-afbplugin-dbg = " ${afb_plugin_dir}/.debug/afm-main-plugin.so "
+
+PACKAGES =+ "${PN}-tools ${PN}-tools-dbg"
+FILES_${PN}-tools = "${bindir}/wgtpkg-*"
+FILES_${PN}-tools-dbg = "${bindir}/.debug/wgtpkg-*"
+
+BBCLASSEXTEND = "native nativesdk"
+
diff --git a/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-app-framework-examples.bb b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-app-framework-examples.bb
new file mode 100644
index 000000000..e95b7548b
--- /dev/null
+++ b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-app-framework-examples.bb
@@ -0,0 +1,16 @@
+SUMMARY = "AGL Application Framework examples"
+DESCRIPTION = "The set of examples associated to the AGL Application Framework"
+LICENSE = "MIT"
+
+inherit packagegroup
+
+PACKAGES = "\
+    packagegroup-agl-app-framework-examples \
+    "
+
+ALLOW_EMPTY_${PN} = "1"
+
+RDEPENDS_${PN} += "\
+	afm-client \
+	afb-client \
+    "
diff --git a/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-app-framework.bb b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-app-framework.bb
new file mode 100644
index 000000000..c5b4b5366
--- /dev/null
+++ b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-app-framework.bb
@@ -0,0 +1,17 @@
+SUMMARY = "AGL Application Framework core packages"
+DESCRIPTION = "The set of packages required by the AGL Application Framework"
+LICENSE = "MIT"
+
+inherit packagegroup
+
+PACKAGES = "\
+    packagegroup-agl-app-framework \
+    "
+
+ALLOW_EMPTY_${PN} = "1"
+
+RDEPENDS_${PN} += "\
+	af-binder \
+	af-main \
+	web-runtime \
+    "
diff --git a/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-core-security.bbappend b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-core-security.bbappend
new file mode 100644
index 000000000..0c9efe465
--- /dev/null
+++ b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-core-security.bbappend
@@ -0,0 +1,9 @@
+RDEPENDS_${PN} += "\
+	xmlsec1 \
+	cynara \
+	dbus-cynara \
+	security-manager \
+	security-manager-policy \
+	agl-users \
+    "
+
diff --git a/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-core.bbappend b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-core.bbappend
new file mode 100644
index 000000000..ad09e5ddf
--- /dev/null
+++ b/meta-app-framework/recipes-core/packagegroups/packagegroup-agl-core.bbappend
@@ -0,0 +1,3 @@
+RDEPENDS_${PN} += "\
+   packagegroup-agl-app-framework \
+   "
diff --git a/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime b/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime
new file mode 100755
index 000000000..ca712e155
--- /dev/null
+++ b/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec /usr/bin/qt5/qmlscene "$1" /usr/bin/web-runtime-webkit.qml
diff --git a/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime-webkit.qml b/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime-webkit.qml
new file mode 100644
index 000000000..d18b672cd
--- /dev/null
+++ b/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime-webkit.qml
@@ -0,0 +1,13 @@
+import QtQuick 2.1
+import QtQuick.Controls 1.1
+import QtWebKit 3.0
+
+ApplicationWindow {
+	width: 1024
+	height: 768
+	visible: true
+	WebView {
+		url: Qt.application.arguments[1]
+		anchors.fill: parent
+	}
+}
diff --git a/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime.qml b/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime.qml
new file mode 100644
index 000000000..afe8a77d0
--- /dev/null
+++ b/meta-app-framework/recipes-core/web-runtime/web-runtime/web-runtime.qml
@@ -0,0 +1,13 @@
+import QtQuick 2.1
+import QtQuick.Controls 1.1
+import QtWebEngine 1.1
+
+ApplicationWindow {
+	width: 1024
+	height: 768
+	visible: true
+	WebEngineView {
+		url: Qt.application.arguments[1]
+		anchors.fill: parent
+	}
+}
diff --git a/meta-app-framework/recipes-core/web-runtime/web-runtime_0.1.bb b/meta-app-framework/recipes-core/web-runtime/web-runtime_0.1.bb
new file mode 100644
index 000000000..9df4dff2d
--- /dev/null
+++ b/meta-app-framework/recipes-core/web-runtime/web-runtime_0.1.bb
@@ -0,0 +1,34 @@
+inherit allarch
+
+SUMMARY = "Provides the 'web-runtime' command"
+DESCRIPTION = "The command 'web-runtime' is an abstraction that allows to "
+
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
+
+SRC_URI = "\
+	file://web-runtime;md5sum=00cdb6980e03cf8c8f7d60dd978c61d7 \
+	file://web-runtime.qml;md5sum=5d6a379e9b7e5654319e5ba638824a58 \
+	file://web-runtime-webkit.qml;md5sum=4daf9df39078634c27a7923d37e82e3d \
+"
+
+RDEPENDS_${PN} = "qtwebkit-qmlplugins"
+
+do_configure() {
+    :
+}
+
+do_install() {
+    install -d ${D}${bindir}
+    install -m 0755 ${WORKDIR}/web-runtime ${D}${bindir}/web-runtime
+    install -m 0644 ${WORKDIR}/web-runtime.qml ${D}${bindir}/web-runtime.qml
+    install -m 0644 ${WORKDIR}/web-runtime-webkit.qml ${D}${bindir}/web-runtime-webkit.qml
+}
+
+do_install_append_rcar-gen2() {
+	# workaround for porter board: force the use of libEGL provided by mesa at runtime
+	# otherwise, the proprietary libEGL is used and a problem then occurs due to a missing EGL function
+    sed -i 's|^\(exec /usr/bin/qt5/qmlscene\)|LD_PRELOAD=/usr/lib/libEGL.so \1|g' ${D}${bindir}/web-runtime
+}
+
+
diff --git a/meta-app-framework/recipes-example/afb-client/afb-client_1.0.bb b/meta-app-framework/recipes-example/afb-client/afb-client_1.0.bb
new file mode 100644
index 000000000..54a8216c4
--- /dev/null
+++ b/meta-app-framework/recipes-example/afb-client/afb-client_1.0.bb
@@ -0,0 +1,29 @@
+SUMMARY = "HTML5 demo template for AFB"
+DESCRIPTION = "afb-client is a sample AngularJS/HTML5 application using \
+Application Framework Binder with token plugin."
+HOMEPAGE = "http://www.iot.bzh"
+
+LICENSE = "GPLv3+"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=6cb04bdb88e11107e3af4d8e3f301be5"
+
+#DEPENDS = "nodejs-native"
+RDEPENDS_${PN} = "af-binder af-binder-plugin-authlogin"
+
+SRC_URI_git = "git://gerrit.automotivelinux.org/gerrit/src/app-framework-demo;protocol=https;branch=1.0"
+SRC_URI_files = "file://afb-client \
+          "
+SRC_URI = "${SRC_URI_git} \
+           ${SRC_URI_files} \
+          "
+SRCREV = "9e9b459fa27d7a359a060024c9639b99b45813d5"
+S = "${WORKDIR}/git/afb-client"
+
+do_install () {
+  mkdir -p ${D}/${datadir}/agl/afb-client
+  cp -ra ${S}/dist.prod/* ${D}/${datadir}/agl/afb-client/
+
+  mkdir -p ${D}/${bindir}
+  install -m 0755 ${WORKDIR}/afb-client ${D}/${bindir}/afb-client
+}
+
+FILES_${PN} += "${datadir}"
diff --git a/meta-app-framework/recipes-example/afb-client/files/afb-client b/meta-app-framework/recipes-example/afb-client/files/afb-client
new file mode 100644
index 000000000..99e6aa968
--- /dev/null
+++ b/meta-app-framework/recipes-example/afb-client/files/afb-client
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+if [ -z "${XDG_RUNTIME_DIR+1}" ]; then
+  export XDG_RUNTIME_DIR=/run/user/$UID
+fi
+LD_PRELOAD=/usr/lib/libEGL.so /usr/bin/qt5/qmlscene http://localhost:1234/opa /usr/share/agl/afb-viewer.qml
+
diff --git a/meta-app-framework/recipes-example/afm-client/afm-client_1.0.bb b/meta-app-framework/recipes-example/afm-client/afm-client_1.0.bb
new file mode 100644
index 000000000..b624b6bab
--- /dev/null
+++ b/meta-app-framework/recipes-example/afm-client/afm-client_1.0.bb
@@ -0,0 +1,40 @@
+SUMMARY = "Sample client for AFM to install/start/stop/remove applications"
+DESCRIPTION = "afm-client is a sample AngularJS/HTML5 application using \
+Application Framework Manager to install, start, stop, or remove \
+applications provided as .wgt widget packages."
+HOMEPAGE = "http://www.iot.bzh"
+
+inherit systemd
+
+LICENSE = "GPLv3+"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=6cb04bdb88e11107e3af4d8e3f301be5"
+
+#DEPENDS = "nodejs-native"
+RDEPENDS_${PN} = "af-main af-binder af-main-afbplugin af-binder-plugin-demopost af-binder-plugin-authlogin"
+
+SRC_URI_git = "git://gerrit.automotivelinux.org/gerrit/src/app-framework-demo;protocol=https;branch=1.0"
+SRC_URI_files = "file://afm-client \
+           file://afm-client.service \
+          "
+SRC_URI = "${SRC_URI_git} \
+           ${SRC_URI_files} \
+          "
+SRCREV = "9e9b459fa27d7a359a060024c9639b99b45813d5"
+S = "${WORKDIR}/git/afm-client"
+
+do_install () {
+  mkdir -p ${D}/${datadir}/agl/afm-client
+  cp -ra ${S}/dist.prod/* ${D}/${datadir}/agl/afm-client/
+
+  mkdir -p ${D}/${bindir}
+  install -m 0755 ${WORKDIR}/afm-client ${D}/${bindir}/afm-client
+
+  if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
+    install -d ${D}${systemd_user_unitdir}
+    install -d ${D}${sysconfdir}/systemd/user/default.target.wants
+    install -m 0644 ${WORKDIR}/afm-client.service ${D}/${systemd_user_unitdir}/afm-client.service
+    ln -sf ${systemd_user_unitdir}/afm-client.service ${D}${sysconfdir}/systemd/user/default.target.wants
+  fi
+}
+
+FILES_${PN} += "${datadir} ${systemd_user_unitdir}"
diff --git a/meta-app-framework/recipes-example/afm-client/files/afm-client b/meta-app-framework/recipes-example/afm-client/files/afm-client
new file mode 100644
index 000000000..ba868e93d
--- /dev/null
+++ b/meta-app-framework/recipes-example/afm-client/files/afm-client
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+if [ -z "${XDG_RUNTIME_DIR+1}" ]; then
+  export XDG_RUNTIME_DIR=/run/user/$UID
+fi
+LD_PRELOAD=/usr/lib/libEGL.so /usr/bin/web-runtime http://localhost:1236/opa
+
diff --git a/meta-app-framework/recipes-example/afm-client/files/afm-client.service b/meta-app-framework/recipes-example/afm-client/files/afm-client.service
new file mode 100644
index 000000000..688c91fd8
--- /dev/null
+++ b/meta-app-framework/recipes-example/afm-client/files/afm-client.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Simplest application manager
+
+[Service]
+ExecStart=/usr/bin/afb-daemon --mode=remote --port=1234 --token='' --sessiondir=/home/root/.afb-daemon --rootdir=/usr/share/agl/afm-client --alias=/icons:/usr/share/afm/icons
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+
diff --git a/meta-app-framework/recipes-support/libcap/libcap/removing-capability-enforcement.patch b/meta-app-framework/recipes-support/libcap/libcap/removing-capability-enforcement.patch
new file mode 100644
index 000000000..fd01c19e9
--- /dev/null
+++ b/meta-app-framework/recipes-support/libcap/libcap/removing-capability-enforcement.patch
@@ -0,0 +1,79 @@
+From c34b2725817d4fd1fd6878bbb16617cb9e3e3a70 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Bollo?= <jose.bollo@iot.bzh>
+Date: Fri, 22 Jan 2016 16:23:59 +0100
+Subject: [PATCH] removing capability enforcement
+
+Change-Id: Idb724192ceab176a611bbed45c0ebc9c8eb5dd30
+---
+ progs/setcap.c | 43 -------------------------------------------
+ 1 file changed, 43 deletions(-)
+
+diff --git a/progs/setcap.c b/progs/setcap.c
+index 83090ae..01faa17 100644
+--- a/progs/setcap.c
++++ b/progs/setcap.c
+@@ -58,7 +58,6 @@ static int read_caps(int quiet, const char *filename, char *buffer)
+ 
+ int main(int argc, char **argv)
+ {
+-    int tried_to_cap_setfcap = 0;
+     char buffer[MAXCAP+1];
+     int retval, quiet=0, verify=0;
+     cap_t mycaps;
+@@ -150,53 +149,11 @@ int main(int argc, char **argv)
+ 		printf("%s: OK\n", *argv);
+ 	    }
+ 	} else {
+-	    if (!tried_to_cap_setfcap) {
+-		capflag = CAP_SETFCAP;
+-
+-		/*
+-		 * Raise the effective CAP_SETFCAP.
+-		 */
+-		if (cap_set_flag(mycaps, CAP_EFFECTIVE, 1, &capflag, CAP_SET)
+-		    != 0) {
+-		    perror("unable to manipulate CAP_SETFCAP - "
+-			   "try a newer libcap?");
+-		    exit(1);
+-		}
+-		if (cap_set_proc(mycaps) != 0) {
+-		    perror("unable to set CAP_SETFCAP effective capability");
+-		    exit(1);
+-		}
+-		tried_to_cap_setfcap = 1;
+-	    }
+ 	    retval = cap_set_file(*++argv, cap_d);
+ 	    if (retval != 0) {
+-		int explained = 0;
+-#ifdef linux
+-		cap_value_t cap;
+-		cap_flag_value_t per_state;
+-
+-		for (cap = 0;
+-		     cap_get_flag(cap_d, cap, CAP_PERMITTED, &per_state) != -1;
+-		     cap++) {
+-		    cap_flag_value_t inh_state, eff_state;
+-
+-		    cap_get_flag(cap_d, cap, CAP_INHERITABLE, &inh_state);
+-		    cap_get_flag(cap_d, cap, CAP_EFFECTIVE, &eff_state);
+-		    if ((inh_state | per_state) != eff_state) {
+-			fprintf(stderr, "NOTE: Under Linux, effective file capabilities must either be empty, or\n"
+-				"      exactly match the union of selected permitted and inheritable bits.\n");
+-			explained = 1;
+-			break;
+-		    }
+-		}
+-#endif /* def linux */
+-		
+ 		fprintf(stderr,
+ 			"Failed to set capabilities on file `%s' (%s)\n",
+ 			argv[0], strerror(errno));
+-		if (!explained) {
+-		    usage();
+-		}
+ 	    }
+ 	}
+ 	if (cap_d) {
+-- 
+2.1.4
+
diff --git a/meta-app-framework/recipes-support/libcap/libcap_%.bbappend b/meta-app-framework/recipes-support/libcap/libcap_%.bbappend
new file mode 100644
index 000000000..fbe893501
--- /dev/null
+++ b/meta-app-framework/recipes-support/libcap/libcap_%.bbappend
@@ -0,0 +1,5 @@
+FILESEXTRAPATHS_append_class-native := ":${THISDIR}/${PN}"
+SRC_URI_append_class-native = " file://removing-capability-enforcement.patch"
+PACKAGECONFIG_class-native ?= "attr"
+DEPENDS_append_class-native = " attr-native"
+
diff --git a/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd/allows-upgrade.patch b/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd/allows-upgrade.patch
new file mode 100644
index 000000000..b35d9705e
--- /dev/null
+++ b/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd/allows-upgrade.patch
@@ -0,0 +1,14 @@
+diff -Naur a/src/microhttpd/connection.c b/src/microhttpd/connection.c
+--- a/src/microhttpd/connection.c	2016-04-20 11:35:50.259534537 +0000
++++ b/src/microhttpd/connection.c	2016-04-20 11:29:46.291569583 +0000
+@@ -733,8 +733,7 @@
+   {
+     if (NULL == end)
+       return MHD_YES;
+-    if ( (MHD_str_equal_caseless_ (end, "close")) ||
+-         (MHD_str_equal_caseless_ (end, "upgrade")) )
++    if ( (MHD_str_equal_caseless_ (end, "close")) )
+       return MHD_NO;
+    return MHD_YES;
+   }
+
diff --git a/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd_0.9.48.bb b/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd_0.9.48.bb
new file mode 100644
index 000000000..892009e3e
--- /dev/null
+++ b/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd_0.9.48.bb
@@ -0,0 +1,27 @@
+DESCRIPTION = "A small C library that is supposed to make it easy to run an HTTP server as part of another application"
+HOMEPAGE = "http://www.gnu.org/software/libmicrohttpd/"
+LICENSE = "LGPL-2.1+"
+LIC_FILES_CHKSUM = "file://COPYING;md5=9331186f4f80db7da0e724bdd6554ee5"
+SECTION = "net"
+DEPENDS = "libgcrypt gnutls file"
+
+SRC_URI = "http://ftp.gnu.org/gnu/libmicrohttpd/${BPN}-${PV}.tar.gz"
+SRC_URI[md5sum] = "9c298c890088a91fe0d7ac3fec9d0097"
+SRC_URI[sha256sum] = "87667e158f2bf8c691a002e256ffe30885d4121a9ee4143af0320c47cdf8a2a4"
+
+inherit autotools lib_package
+
+# disable spdy, because it depends on openssl
+EXTRA_OECONF += "--disable-static --with-gnutls=${STAGING_LIBDIR}/../"
+
+PACKAGECONFIG ?= "curl"
+PACKAGECONFIG_append_class-target = "\
+        ${@base_contains('DISTRO_FEATURES', 'largefile', 'largefile', '', d)} \
+"
+PACKAGECONFIG[largefile] = "--enable-largefile,--disable-largefile,,"
+PACKAGECONFIG[curl] = "--enable-curl,--disable-curl,curl,"
+
+do_compile_append() {
+	sed -i s:-L${STAGING_LIBDIR}::g libmicrohttpd.pc
+}
+
diff --git a/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd_0.9.48.bbappend b/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd_0.9.48.bbappend
new file mode 100644
index 000000000..c26b8119f
--- /dev/null
+++ b/meta-app-framework/recipes-support/libmicrohttpd/libmicrohttpd_0.9.48.bbappend
@@ -0,0 +1,5 @@
+
+FILESEXTRAPATHS_append := ":${THISDIR}/${PN}"
+SRC_URI += " file://allows-upgrade.patch"
+
+
diff --git a/meta-app-framework/recipes-support/libzip/libzip_1.1.1.bb b/meta-app-framework/recipes-support/libzip/libzip_1.1.1.bb
new file mode 100644
index 000000000..450971176
--- /dev/null
+++ b/meta-app-framework/recipes-support/libzip/libzip_1.1.1.bb
@@ -0,0 +1,32 @@
+inherit autotools
+
+SUMMARY = "Library providing support for handling zip files"
+DESCRIPTION = "\
+ This library is wrapping zlib and allows \
+ to easily create, browse, inflate of deflate \
+ the zip files. \
+ It also provides tools for zip comparing, merging or browsing.\
+"
+
+HOMEPAGE = "http://nih.at/libzip/index.html"
+LICENSE = "BSD"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=23ebf7ca347ed9703b4ef40824d0ef66"
+
+SRC_URI = "http://nih.at/libzip/libzip-1.1.1.tar.xz;md5sum=0c86a1a94fbc3ec6724801036726ae1f"
+
+#SRC_URI = "hg://hg.nih.at/libzip;module=libzip;protocol=http"
+#SRCREV = "5895e34af7f9"
+#S = "${HGDIR}"
+
+SECTION = "base"
+
+DEPENDS = "zlib"
+
+RDEPENDS_${PN} = "zlib"
+
+PROVIDES += "${PN}-tools"
+RDEPENDS_${PN}-tools = "${PN}"
+FILES_${PN}-tools = "${bindir}/zipcmp ${bindir}/zipmerge ${bindir}/ziptool"
+
+BBCLASSEXTEND = "native nativesdk"
+
diff --git a/meta-app-framework/recipes-support/xmlsec1/xmlsec1/Only-require-libxslt-in-.pc-files-when-necessary.patch b/meta-app-framework/recipes-support/xmlsec1/xmlsec1/Only-require-libxslt-in-.pc-files-when-necessary.patch
new file mode 100644
index 000000000..c92df77f0
--- /dev/null
+++ b/meta-app-framework/recipes-support/xmlsec1/xmlsec1/Only-require-libxslt-in-.pc-files-when-necessary.patch
@@ -0,0 +1,115 @@
+From 1e39acf581ef47876b058da41774cbc92560d797 Mon Sep 17 00:00:00 2001
+From: Manuel Bachmann <manuel.bachmann@iot.bzh>
+Date: Wed, 27 Jan 2016 14:16:40 +0100
+Subject: [PATCH] Only require libxslt in .pc files when necessary
+
+If we build xmlsec without libxslt ("--without-libxslt" at
+configure time), dependent packages will still require it
+because it is unconditionally mentioned in .pc files (used
+by pkg-config).
+
+We now make sure that this dependency is mentioned only if
+the configure script validates libxslt presence.
+
+Signed-off-by: Manuel Bachmann <manuel.bachmann@iot.bzh>
+---
+ configure.in         | 4 ++++
+ xmlsec-gcrypt.pc.in  | 2 +-
+ xmlsec-gnutls.pc.in  | 2 +-
+ xmlsec-nss.pc.in     | 2 +-
+ xmlsec-openssl.pc.in | 2 +-
+ xmlsec.pc.in         | 2 +-
+ 6 files changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/configure.in b/configure.in
+index 7d976d0..a8350a9 100644
+--- a/configure.in
++++ b/configure.in
+@@ -255,6 +255,7 @@ dnl ==========================================================================
+ dnl find libxslt
+ dnl ==========================================================================
+ XMLSEC_NO_LIBXSLT="1"
++LIBXSLT_COND="libxslt >="
+ LIBXSLT_MIN_VERSION=1.0.20
+ LIBXSLT_CONFIG="xslt-config"
+ LIBXSLT_CFLAGS=""
+@@ -324,6 +325,8 @@ fi
+ if test "z$LIBXSLT_FOUND" = "zyes" ; then
+     XMLSEC_NO_LIBXSLT="0"
+ else
++    LIBXSLT_COND=""
++    LIBXSLT_MIN_VERSION=""
+     XMLSEC_DEFINES="$XMLSEC_DEFINES -DXMLSEC_NO_XSLT=1"
+ fi
+ 
+@@ -332,6 +335,7 @@ AC_SUBST(LIBXSLT_CFLAGS)
+ AC_SUBST(LIBXSLT_LIBS)
+ AC_SUBST(LIBXSLT_CONFIG)
+ AC_SUBST(LIBXSLT_MIN_VERSION)
++AC_SUBST(LIBXSLT_COND)
+ 
+ dnl ==========================================================================
+ dnl See if we can find a crypto library
+diff --git a/xmlsec-gcrypt.pc.in b/xmlsec-gcrypt.pc.in
+index 1c00496..33bc2ff 100644
+--- a/xmlsec-gcrypt.pc.in
++++ b/xmlsec-gcrypt.pc.in
+@@ -6,6 +6,6 @@ includedir=@includedir@
+ Name: xmlsec1-gcrypt
+ Version: @VERSION@
+ Description: XML Security Library implements XML Signature and XML Encryption standards
+-Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ libxslt >= @LIBXSLT_MIN_VERSION@
++Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ @LIBXSLT_COND@ @LIBXSLT_MIN_VERSION@
+ Cflags: -DXMLSEC_CRYPTO=\"gcrypt\" @XMLSEC_GCRYPT_CFLAGS@
+ Libs: @XMLSEC_GCRYPT_LIBS@
+diff --git a/xmlsec-gnutls.pc.in b/xmlsec-gnutls.pc.in
+index e538cd4..d01cf82 100644
+--- a/xmlsec-gnutls.pc.in
++++ b/xmlsec-gnutls.pc.in
+@@ -6,6 +6,6 @@ includedir=@includedir@
+ Name: xmlsec1-gnutls
+ Version: @VERSION@
+ Description: XML Security Library implements XML Signature and XML Encryption standards
+-Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ libxslt >= @LIBXSLT_MIN_VERSION@
++Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ @LIBXSLT_COND@ @LIBXSLT_MIN_VERSION@
+ Cflags: -DXMLSEC_CRYPTO=\"gnutls\" @XMLSEC_GNUTLS_CFLAGS@
+ Libs: @XMLSEC_GNUTLS_LIBS@
+diff --git a/xmlsec-nss.pc.in b/xmlsec-nss.pc.in
+index a6d6c5c..75f0232 100644
+--- a/xmlsec-nss.pc.in
++++ b/xmlsec-nss.pc.in
+@@ -6,6 +6,6 @@ includedir=@includedir@
+ Name: xmlsec1-nss
+ Version: @VERSION@
+ Description: XML Security Library implements XML Signature and XML Encryption standards
+-Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ libxslt >= @LIBXSLT_MIN_VERSION@ @NSPR_PACKAGE@ >= @MOZILLA_MIN_VERSION@ @NSS_PACKAGE@ >= @MOZILLA_MIN_VERSION@
++Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ @LIBXSLT_COND@ @LIBXSLT_MIN_VERSION@ @NSPR_PACKAGE@ >= @MOZILLA_MIN_VERSION@ @NSS_PACKAGE@ >= @MOZILLA_MIN_VERSION@
+ Cflags: -DXMLSEC_CRYPTO=\"nss\" -DXMLSEC_CRYPTO_NSS=1 @XMLSEC_CORE_CFLAGS@
+ Libs: -L${libdir} -lxmlsec1-nss @XMLSEC_CORE_LIBS@
+diff --git a/xmlsec-openssl.pc.in b/xmlsec-openssl.pc.in
+index 85ee2b0..e9d0651 100644
+--- a/xmlsec-openssl.pc.in
++++ b/xmlsec-openssl.pc.in
+@@ -6,6 +6,6 @@ includedir=@includedir@
+ Name: xmlsec1-openssl
+ Version: @VERSION@
+ Description: XML Security Library implements XML Signature and XML Encryption standards
+-Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ libxslt >= @LIBXSLT_MIN_VERSION@ 
++Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ @LIBXSLT_COND@ @LIBXSLT_MIN_VERSION@
+ Cflags: -DXMLSEC_CRYPTO=\"openssl\" @XMLSEC_OPENSSL_CFLAGS@
+ Libs: @XMLSEC_OPENSSL_LIBS@
+diff --git a/xmlsec.pc.in b/xmlsec.pc.in
+index a750ab8..14ea670 100644
+--- a/xmlsec.pc.in
++++ b/xmlsec.pc.in
+@@ -6,6 +6,6 @@ includedir=@includedir@
+ Name: xmlsec1
+ Version: @VERSION@
+ Description: XML Security Library implements XML Signature and XML Encryption standards
+-Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ libxslt >= @LIBXSLT_MIN_VERSION@ 
++Requires: libxml-2.0 >= @LIBXML_MIN_VERSION@ @LIBXSLT_COND@ @LIBXSLT_MIN_VERSION@ 
+ Cflags: -DXMLSEC_CRYPTO=\"@XMLSEC_CRYPTO@\" -DXMLSEC_CRYPTO_DYNAMIC_LOADING=1 @XMLSEC_CORE_CFLAGS@
+ Libs: -L${libdir} @XMLSEC_CORE_LIBS@ 
+-- 
+2.6.2
+
diff --git a/meta-app-framework/recipes-support/xmlsec1/xmlsec1_1.%.bbappend b/meta-app-framework/recipes-support/xmlsec1/xmlsec1_1.%.bbappend
new file mode 100644
index 000000000..539a88f1e
--- /dev/null
+++ b/meta-app-framework/recipes-support/xmlsec1/xmlsec1_1.%.bbappend
@@ -0,0 +1,4 @@
+FILESEXTRAPATHS_append := ":${THISDIR}/${PN}"
+SRC_URI += "file://Only-require-libxslt-in-.pc-files-when-necessary.patch"
+
+DEPENDS += "libxml2"
diff --git a/templates/dra7xx-evm/conf/bblayers.conf.sample b/templates/dra7xx-evm/conf/bblayers.conf.sample
index 44338f72f..7fcd94986 100644
--- a/templates/dra7xx-evm/conf/bblayers.conf.sample
+++ b/templates/dra7xx-evm/conf/bblayers.conf.sample
@@ -13,6 +13,10 @@ BBLAYERS ?= " \
   ##OEROOT##/../meta-agl/meta-ivi-common \
   ##OEROOT##/../meta-agl/meta-agl \
   ##OEROOT##/../meta-agl/meta-agl-bsp \
+  ##OEROOT##/../meta-agl/meta-agl-security \
+  ##OEROOT##/../meta-agl/meta-app-framework \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-smack \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-framework \
   ##OEROOT##/../meta-openembedded/meta-oe \
   ##OEROOT##/../meta-openembedded/meta-multimedia \
   ##OEROOT##/../meta-openembedded/meta-efl \
diff --git a/templates/dragonboard-410c/conf/bblayers.conf.sample b/templates/dragonboard-410c/conf/bblayers.conf.sample
index 63245f75e..58eb130d8 100644
--- a/templates/dragonboard-410c/conf/bblayers.conf.sample
+++ b/templates/dragonboard-410c/conf/bblayers.conf.sample
@@ -13,6 +13,10 @@ BBLAYERS ?= " \
   ##OEROOT##/../meta-agl/meta-ivi-common \
   ##OEROOT##/../meta-agl/meta-agl \
   ##OEROOT##/../meta-agl/meta-agl-bsp \
+  ##OEROOT##/../meta-agl/meta-agl-security \
+  ##OEROOT##/../meta-agl/meta-app-framework \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-smack \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-framework \
   ##OEROOT##/../meta-openembedded/meta-oe \
   ##OEROOT##/../meta-openembedded/meta-multimedia \
   ##OEROOT##/../meta-openembedded/meta-efl \
diff --git a/templates/intel-corei7-64/conf/bblayers.conf.sample b/templates/intel-corei7-64/conf/bblayers.conf.sample
index 4bf44d5d1..cf6b4395a 100644
--- a/templates/intel-corei7-64/conf/bblayers.conf.sample
+++ b/templates/intel-corei7-64/conf/bblayers.conf.sample
@@ -13,6 +13,10 @@ BBLAYERS ?= " \
   ##OEROOT##/../meta-agl/meta-ivi-common \
   ##OEROOT##/../meta-agl/meta-agl \
   ##OEROOT##/../meta-agl/meta-agl-bsp \
+  ##OEROOT##/../meta-agl/meta-agl-security \
+  ##OEROOT##/../meta-agl/meta-app-framework \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-smack \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-framework \
   ##OEROOT##/../meta-openembedded/meta-oe \
   ##OEROOT##/../meta-openembedded/meta-multimedia \
   ##OEROOT##/../meta-openembedded/meta-efl \
diff --git a/templates/qemux86-64/conf/bblayers.conf.sample b/templates/qemux86-64/conf/bblayers.conf.sample
index acdf7efc8..032bfb02a 100644
--- a/templates/qemux86-64/conf/bblayers.conf.sample
+++ b/templates/qemux86-64/conf/bblayers.conf.sample
@@ -13,6 +13,10 @@ BBLAYERS ?= " \
   ##OEROOT##/../meta-agl/meta-ivi-common \
   ##OEROOT##/../meta-agl/meta-agl \
   ##OEROOT##/../meta-agl/meta-agl-bsp \
+  ##OEROOT##/../meta-agl/meta-agl-security \
+  ##OEROOT##/../meta-agl/meta-app-framework \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-smack \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-framework \
   ##OEROOT##/../meta-openembedded/meta-oe \
   ##OEROOT##/../meta-openembedded/meta-multimedia \
   ##OEROOT##/../meta-openembedded/meta-efl \
diff --git a/templates/qemux86/conf/bblayers.conf.sample b/templates/qemux86/conf/bblayers.conf.sample
index acdf7efc8..e6858dfce 100644
--- a/templates/qemux86/conf/bblayers.conf.sample
+++ b/templates/qemux86/conf/bblayers.conf.sample
@@ -5,7 +5,7 @@ LCONF_VERSION = "6"
 BBPATH = "${TOPDIR}"
 BBFILES ?= ""
 
-# AGL layers for QEMUx86-64
+# AGL layers for QEMUx86
 BBLAYERS ?= " \
   ##OEROOT##/meta \
   ##OEROOT##/meta-yocto \
@@ -13,6 +13,10 @@ BBLAYERS ?= " \
   ##OEROOT##/../meta-agl/meta-ivi-common \
   ##OEROOT##/../meta-agl/meta-agl \
   ##OEROOT##/../meta-agl/meta-agl-bsp \
+  ##OEROOT##/../meta-agl/meta-agl-security \
+  ##OEROOT##/../meta-agl/meta-app-framework \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-smack \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-framework \
   ##OEROOT##/../meta-openembedded/meta-oe \
   ##OEROOT##/../meta-openembedded/meta-multimedia \
   ##OEROOT##/../meta-openembedded/meta-efl \
diff --git a/templates/raspberrypi2/conf/bblayers.conf.sample b/templates/raspberrypi2/conf/bblayers.conf.sample
index e87a65020..09aa37bc0 100644
--- a/templates/raspberrypi2/conf/bblayers.conf.sample
+++ b/templates/raspberrypi2/conf/bblayers.conf.sample
@@ -5,7 +5,7 @@ LCONF_VERSION = "6"
 BBPATH = "${TOPDIR}"
 BBFILES ?= ""
 
-# AGL layers for TI vayu
+# AGL layers for Raspberry PI 2
 BBLAYERS ?= " \
   ##OEROOT##/meta \
   ##OEROOT##/meta-yocto \
@@ -13,6 +13,10 @@ BBLAYERS ?= " \
   ##OEROOT##/../meta-agl/meta-ivi-common \
   ##OEROOT##/../meta-agl/meta-agl \
   ##OEROOT##/../meta-agl/meta-agl-bsp \
+  ##OEROOT##/../meta-agl/meta-agl-security \
+  ##OEROOT##/../meta-agl/meta-app-framework \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-smack \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-framework \
   ##OEROOT##/../meta-openembedded/meta-oe \
   ##OEROOT##/../meta-openembedded/meta-multimedia \
   ##OEROOT##/../meta-openembedded/meta-efl \
diff --git a/templates/raspberrypi3/conf/bblayers.conf.sample b/templates/raspberrypi3/conf/bblayers.conf.sample
index e87a65020..7cc9ba6cb 100644
--- a/templates/raspberrypi3/conf/bblayers.conf.sample
+++ b/templates/raspberrypi3/conf/bblayers.conf.sample
@@ -5,7 +5,7 @@ LCONF_VERSION = "6"
 BBPATH = "${TOPDIR}"
 BBFILES ?= ""
 
-# AGL layers for TI vayu
+# AGL layers for Raspberry PI 3
 BBLAYERS ?= " \
   ##OEROOT##/meta \
   ##OEROOT##/meta-yocto \
@@ -13,6 +13,10 @@ BBLAYERS ?= " \
   ##OEROOT##/../meta-agl/meta-ivi-common \
   ##OEROOT##/../meta-agl/meta-agl \
   ##OEROOT##/../meta-agl/meta-agl-bsp \
+  ##OEROOT##/../meta-agl/meta-agl-security \
+  ##OEROOT##/../meta-agl/meta-app-framework \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-smack \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-framework \
   ##OEROOT##/../meta-openembedded/meta-oe \
   ##OEROOT##/../meta-openembedded/meta-multimedia \
   ##OEROOT##/../meta-openembedded/meta-efl \
diff --git a/templates/wandboard/conf/bblayers.conf.sample b/templates/wandboard/conf/bblayers.conf.sample
index e3b6a881e..828017815 100644
--- a/templates/wandboard/conf/bblayers.conf.sample
+++ b/templates/wandboard/conf/bblayers.conf.sample
@@ -13,6 +13,10 @@ BBLAYERS ?= " \
   ##OEROOT##/../meta-agl/meta-ivi-common \
   ##OEROOT##/../meta-agl/meta-agl \
   ##OEROOT##/../meta-agl/meta-agl-bsp \
+  ##OEROOT##/../meta-agl/meta-agl-security \
+  ##OEROOT##/../meta-agl/meta-app-framework \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-smack \
+  ##OEROOT##/../meta-intel-iot-security/meta-security-framework \
   ##OEROOT##/../meta-openembedded/meta-oe \
   ##OEROOT##/../meta-openembedded/meta-multimedia \
   ##OEROOT##/../meta-openembedded/meta-efl \