Merge remote-tracking branch 'agl/sandbox/ronan/rocko' into HEAD

* agl/sandbox/ronan/rocko: (58 commits)
  Update ulcb conf file
  Remove unsed gstreamer backport
  [GEN3] add preferred version on omx package
  run-(agl-)postinst: Emit progress to console
  meta-security: Remove unused content
  Upgrade wayland-ivi-extension
  Revert "Fix kernel gcc7 issue"
  remove backport commit
  Revert "Fix CVE-2017-1000364 by backporting the patches for gen3"
  Remove fix for optee-os
  Remove gcc 6 fix
  Update rcar gen3 kernel bbappend version
  Update rcar gen3 driver
  Remove porter machine
  dbus-cynara: Upgrade to 1.10.20
  xmlsec1: switch to meta-security version
  systemd: earlier smack label switch
  cynara: upgrade to 0.14.10
  Remove smack recipe
  Integrate parts of meta-intel-iot-security
  ...

Bug-AGL: SPEC-1181

Signed-off-by: Jan-Simon Möller <jsmoeller@linuxfoundation.org>

Conflicts:
	meta-app-framework/recipes-security/cynara/cynara_git.bbappend

Change-Id: I9875fcb31e960038ce6c23165c99b52a3bd1a1c0

10 files changed, 492 insertions, 0 deletions

diff --git a/meta-security/recipes-devtools/e2fsprogs/e2fsprogs.inc b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs.inc
new file mode 100644
index 000000000..09e4ea5bb
--- /dev/null
+++ b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs.inc
@@ -0,0 +1,27 @@
+SUMMARY = "Ext2 Filesystem Utilities"
+DESCRIPTION = "The Ext2 Filesystem Utilities (e2fsprogs) contain all of the standard utilities for creating, \
+fixing, configuring , and debugging ext2 filesystems."
+HOMEPAGE = "http://e2fsprogs.sourceforge.net/"
+
+LICENSE = "GPLv2 & LGPLv2 & BSD & MIT"
+LICENSE_e2fsprogs-e2fsck = "GPLv2"
+LICENSE_e2fsprogs-mke2fs = "GPLv2"
+LICENSE_e2fsprogs-fsck = "GPLv2"
+LICENSE_e2fsprogs-tune2fs = "GPLv2"
+LICENSE_e2fsprogs-badblocks = "GPLv2"
+LIC_FILES_CHKSUM = "file://COPYING;md5=b48f21d765b875bd10400975d12c1ca2 \
+                      file://lib/ext2fs/ext2fs.h;beginline=1;endline=9;md5=596a8dedcb4e731c6b21c7a46fba6bef \
+                      file://lib/e2p/e2p.h;beginline=1;endline=7;md5=8a74ade8f9d65095d70ef2d4bf48e36a \
+                      file://lib/uuid/uuid.h.in;beginline=1;endline=32;md5=dbb8079e114a5f841934b99e59c8820a \
+                      file://lib/uuid/COPYING;md5=58dcd8452651fc8b07d1f65ce07ca8af \
+                      file://lib/et/et_name.c;beginline=1;endline=11;md5=ead236447dac7b980dbc5b4804d8c836 \
+                      file://lib/ss/ss.h;beginline=1;endline=20;md5=6e89ad47da6e75fecd2b5e0e81e1d4a6"
+SECTION = "base"
+DEPENDS = "util-linux"
+
+SRC_URI = "git://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git"
+S = "${WORKDIR}/git"
+
+inherit autotools gettext texinfo pkgconfig multilib_header update-alternatives ptest
+
+BBCLASSEXTEND = "native nativesdk"
diff --git a/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/acinclude.m4 b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/acinclude.m4
new file mode 100644
index 000000000..c0bd7dbde
--- /dev/null
+++ b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/acinclude.m4
@@ -0,0 +1,135 @@
+# Extracted from the package's shipped aclocal.m4. Custom macros should be in
+# acinclude.m4 so running aclocal doesn't blow them away.
+#
+# Signed-off-by: Ross Burton <ross.burton@intel.com>
+
+# from http://autoconf-archive.cryp.to/ax_tls.html
+#
+# This was licensed under the GPL with the following exception:
+#
+# As a special exception, the respective Autoconf Macro's copyright
+# owner gives unlimited permission to copy, distribute and modify the
+# configure scripts that are the output of Autoconf when processing
+# the Macro. You need not follow the terms of the GNU General Public
+# License when using or distributing such scripts, even though
+# portions of the text of the Macro appear in them. The GNU General
+# Public License (GPL) does govern all other use of the material that
+# constitutes the Autoconf Macro.
+#
+# This special exception to the GPL applies to versions of the
+# Autoconf Macro released by the Autoconf Macro Archive. When you make
+# and distribute a modified version of the Autoconf Macro, you may
+# extend this special exception to the GPL to apply to your modified
+# version as well.
+#
+AC_DEFUN([AX_TLS], [
+  AC_MSG_CHECKING(for thread local storage (TLS) class)
+  AC_CACHE_VAL(ac_cv_tls, [
+    ax_tls_keywords="__thread __declspec(thread) none"
+    for ax_tls_keyword in $ax_tls_keywords; do
+       case $ax_tls_keyword in
+          none) ac_cv_tls=none ; break ;;
+          *)
+             AC_TRY_COMPILE(
+                [#include <stdlib.h>
+                 static void
+                 foo(void) {
+                 static ] $ax_tls_keyword [ int bar;
+                 exit(1);
+                 }],
+                 [],
+                 [ac_cv_tls=$ax_tls_keyword ; break],
+                 ac_cv_tls=none
+             )
+          esac
+    done
+])
+
+  if test "$ac_cv_tls" != "none"; then
+    dnl AC_DEFINE([TLS], [], [If the compiler supports a TLS storage class define it to that here])
+    AC_DEFINE_UNQUOTED([TLS], $ac_cv_tls, [If the compiler supports a TLS storage class define it to that here])
+  fi
+  AC_MSG_RESULT($ac_cv_tls)
+])
+
+# ===========================================================================
+#         http://www.nongnu.org/autoconf-archive/check_gnu_make.html
+# ===========================================================================
+#
+# SYNOPSIS
+#
+#   CHECK_GNU_MAKE()
+#
+# DESCRIPTION
+#
+#   This macro searches for a GNU version of make. If a match is found, the
+#   makefile variable `ifGNUmake' is set to the empty string, otherwise it
+#   is set to "#". This is useful for including a special features in a
+#   Makefile, which cannot be handled by other versions of make. The
+#   variable _cv_gnu_make_command is set to the command to invoke GNU make
+#   if it exists, the empty string otherwise.
+#
+#   Here is an example of its use:
+#
+#   Makefile.in might contain:
+#
+#       # A failsafe way of putting a dependency rule into a makefile
+#       $(DEPEND):
+#               $(CC) -MM $(srcdir)/*.c > $(DEPEND)
+#
+#       @ifGNUmake@ ifeq ($(DEPEND),$(wildcard $(DEPEND)))
+#       @ifGNUmake@ include $(DEPEND)
+#       @ifGNUmake@ endif
+#
+#   Then configure.in would normally contain:
+#
+#       CHECK_GNU_MAKE()
+#       AC_OUTPUT(Makefile)
+#
+#   Then perhaps to cause gnu make to override any other make, we could do
+#   something like this (note that GNU make always looks for GNUmakefile
+#   first):
+#
+#       if  ! test x$_cv_gnu_make_command = x ; then
+#               mv Makefile GNUmakefile
+#               echo .DEFAULT: > Makefile ;
+#               echo \  $_cv_gnu_make_command \$@ >> Makefile;
+#       fi
+#
+#   Then, if any (well almost any) other make is called, and GNU make also
+#   exists, then the other make wraps the GNU make.
+#
+# LICENSE
+#
+#   Copyright (c) 2008 John Darrington <j.darrington@elvis.murdoch.edu.au>
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved.
+#
+# Note: Modified by Ted Ts'o to add @ifNotGNUMake@
+
+AC_DEFUN(
+        [CHECK_GNU_MAKE], [ AC_CACHE_CHECK( for GNU make,_cv_gnu_make_command,
+                _cv_gnu_make_command='' ;
+dnl Search all the common names for GNU make
+                for a in "$MAKE" make gmake gnumake ; do
+                        if test -z "$a" ; then continue ; fi ;
+                        if  ( sh -c "$a --version" 2> /dev/null | grep GNU  2>&1 > /dev/null ) ;  then
+                                _cv_gnu_make_command=$a ;
+                                break;
+                        fi
+                done ;
+        ) ;
+dnl If there was a GNU version, then set @ifGNUmake@ to the empty string, '#' otherwise
+        if test  "x$_cv_gnu_make_command" != "x"  ; then
+                ifGNUmake='' ;
+                ifNotGNUmake='#' ;
+        else
+                ifGNUmake='#' ;
+                ifNotGNUmake='' ;
+                AC_MSG_RESULT("Not found");
+        fi
+        AC_SUBST(ifGNUmake)
+        AC_SUBST(ifNotGNUmake)
+] )
diff --git a/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/mkdir.patch b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/mkdir.patch
new file mode 100644
index 000000000..2a3aeff61
--- /dev/null
+++ b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/mkdir.patch
@@ -0,0 +1,18 @@
+Upstream-Status: Inappropriate [configuration]
+
+Signed-off-by: Mei Lei <lei.mei@intel.com>
+
+diff --git a/configure.ac b/configure.ac
+index c1fe224..f5ac628 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1374,7 +1374,8 @@ if test -n "$WITH_DIET_LIBC" ; then
+ 	INCLUDES="$INCLUDES -D_REENTRANT"
+ fi
+ AC_SUBST(INCLUDES)
+-AM_MKINSTALLDIRS
++MKINSTALLDIRS="mkdir -p"
++AC_SUBST(MKINSTALLDIRS)
+ dnl
+ dnl Build CFLAGS
+ dnl
diff --git a/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/ptest.patch b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/ptest.patch
new file mode 100644
index 000000000..ef1ce5872
--- /dev/null
+++ b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/ptest.patch
@@ -0,0 +1,67 @@
+diff --git a/tests/Makefile.in b/tests/Makefile.in
+index 60cf655..ce220f1 100644
+--- a/tests/Makefile.in
++++ b/tests/Makefile.in
+@@ -18,7 +18,7 @@ test_one: $(srcdir)/test_one.in Makefile mke2fs.conf
+ 	@echo "#!/bin/sh" > test_one
+ 	@echo "HTREE=y" >> test_one
+ 	@echo "QUOTA=y" >> test_one
+-	@echo "SRCDIR=@srcdir@" >> test_one
++	@echo "SRCDIR=/usr/lib/e2fsprogs/ptest/test" >> test_one
+ 	@echo "DIFF_OPTS=@UNI_DIFF_OPTS@" >> test_one
+ 	@cat $(srcdir)/test_one.in >> test_one
+ 	@chmod +x test_one
+@@ -26,7 +26,7 @@ test_one: $(srcdir)/test_one.in Makefile mke2fs.conf
+ test_script: test_one test_script.in Makefile mke2fs.conf
+ 	@echo "Creating test_script..."
+ 	@echo "#!/bin/sh" > test_script
+-	@echo "SRCDIR=@srcdir@" >> test_script
++	@echo "SRCDIR=/usr/lib/e2fsprogs/ptest/test" >> test_script
+ 	@cat $(srcdir)/test_script.in >> test_script
+ 	@chmod +x test_script
+ 
+diff --git a/tests/test_config b/tests/test_config
+index 7f39157..c815a44 100644
+--- a/tests/test_config
++++ b/tests/test_config
+@@ -3,24 +3,24 @@
+ #
+ 
+ unset LANG LANGUAGE LC_ADDRESS LC_ALL LC_COLLATE LC_CTYPE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME PAGER
+-FSCK="$USE_VALGRIND ../e2fsck/e2fsck"
+-MKE2FS="$USE_VALGRIND ../misc/mke2fs"
+-DUMPE2FS="$USE_VALGRIND ../misc/dumpe2fs"
+-TUNE2FS="$USE_VALGRIND ../misc/tune2fs"
+-CHATTR="$USE_VALGRIND../misc/chattr"
+-LSATTR="$USE_VALGRIND ../misc/lsattr"
+-E2IMAGE="$USE_VALGRIND ../misc/e2image"
+-E2IMAGE_EXE="../misc/e2image"
+-DEBUGFS="$USE_VALGRIND ../debugfs/debugfs"
+-DEBUGFS_EXE="../debugfs/debugfs"
+-TEST_BITS="../debugfs/debugfs"
+-RESIZE2FS_EXE="../resize/resize2fs"
++FSCK="$USE_VALGRIND e2fsck"
++MKE2FS="$USE_VALGRIND mke2fs"
++DUMPE2FS="$USE_VALGRIND dumpe2fs"
++TUNE2FS="$USE_VALGRIND tune2fs"
++CHATTR="$USE_VALGRIND chattr"
++LSATTR="$USE_VALGRIND lsattr"
++E2IMAGE="$USE_VALGRIND e2image"
++E2IMAGE_EXE="/sbin/e2image"
++DEBUGFS="$USE_VALGRIND debugfs"
++DEBUGFS_EXE="/sbin/debugfs"
++TEST_BITS="/sbin/debugfs"
++RESIZE2FS_EXE="/sbin/resize2fs"
+ RESIZE2FS="$USE_VALGRIND $RESIZE2FS_EXE"
+-E2UNDO_EXE="../misc/e2undo"
++E2UNDO_EXE="/sbin/e2undo"
+ E2UNDO="$USE_VALGRIND $E2UNDO_EXE"
+-TEST_REL=../tests/progs/test_rel
+-TEST_ICOUNT=../tests/progs/test_icount
+-CRCSUM=../tests/progs/crcsum
++TEST_REL=./progs/test_rel
++TEST_ICOUNT=./progs/test_icount
++CRCSUM=./progs/crcsum
+ CLEAN_OUTPUT="sed -f $cmd_dir/filter.sed"
+ LD_LIBRARY_PATH=../lib:../lib/ext2fs:../lib/e2p:../lib/et:../lib/ss:${LD_LIBRARY_PATH}
+ DYLD_LIBRARY_PATH=../lib:../lib/ext2fs:../lib/e2p:../lib/et:../lib/ss:${DYLD_LIBRARY_PATH}
diff --git a/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/quiet-debugfs.patch b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/quiet-debugfs.patch
new file mode 100644
index 000000000..830e9d57a
--- /dev/null
+++ b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/quiet-debugfs.patch
@@ -0,0 +1,19 @@
+When executing a script don't echo every command, as we do this for entire
+filesystems at rootfs time.
+
+Upstream-Status: Inappropriate
+Signed-off-by: Ross Burton <ross.burton@intel.com>
+
+diff --git a/debugfs/debugfs.c b/debugfs/debugfs.c
+index 5590295..ac57292 100644
+--- a/debugfs/debugfs.c
++++ b/debugfs/debugfs.c
+@@ -2378,7 +2378,7 @@ static int source_file(const char *cmd_file, int ss_idx)
+ 		cp = strchr(buf, '\r');
+ 		if (cp)
+ 			*cp = 0;
+-		printf("debugfs: %s\n", buf);
++		/*printf("debugfs: %s\n", buf);*/
+ 		retval = ss_execute_line(ss_idx, buf);
+ 		if (retval) {
+ 			ss_perror(ss_idx, retval, buf);
diff --git a/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/remove.ldconfig.call.patch b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/remove.ldconfig.call.patch
new file mode 100644
index 000000000..f3e6eb778
--- /dev/null
+++ b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/remove.ldconfig.call.patch
@@ -0,0 +1,44 @@
+From b139e03ac2f72e644e547c7ee9b1514383af4d97 Mon Sep 17 00:00:00 2001
+From: Andrei Dinu <andrei.adrianx.dinu@intel.com>
+Date: Wed, 30 Jan 2013 15:22:04 +0200
+Subject: [PATCH] When /etc/ld.so.cache is writeable by user running bitbake
+ then it creates invalid cache (in my case libstdc++.so
+ cannot be found after building zlib(-native) and I have to
+ call touch */libstdc++.so && /sbin/ldconfig to fix it.
+
+So remove ldconfig call from make install-libs
+
+Patch authored by Martin Jansa.
+
+Upstream-Status: Inappropriate [disable feature]
+
+Signed-off-by: Scott Garman <scott.a.garman@intel.com>
+Signed-off-by: Andrei Dinu <andrei.adrianx.dinu@intel.com>
+---
+ lib/Makefile.elf-lib |    3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/lib/Makefile.elf-lib b/lib/Makefile.elf-lib
+index 78479d3..4a4a5ac 100644
+--- a/lib/Makefile.elf-lib
++++ b/lib/Makefile.elf-lib
+@@ -50,8 +50,6 @@ install-shlibs install:: $(ELF_LIB) installdirs-elf-lib $(DEP_INSTALL_SYMLINK)
+ 	$(E) "	SYMLINK $(libdir)/$(ELF_IMAGE).so"
+ 	$(Q) $(INSTALL_SYMLINK) $(ELF_INSTALL_DIR)/$(ELF_SONAME) \
+ 		$(libdir)/$(ELF_IMAGE).so $(DESTDIR)
+-	$(E) "	LDCONFIG"
+-	$(Q) -$(LDCONFIG)
+ 
+ install-strip: install
+ 	$(E) "	STRIP-LIB $(ELF_INSTALL_DIR)/$(ELF_LIB)"
+@@ -67,7 +65,6 @@ uninstall-shlibs uninstall::
+ 	$(RM) -f $(DESTDIR)$(ELF_INSTALL_DIR)/$(ELF_LIB) \
+ 		$(DESTDIR)$(ELF_INSTALL_DIR)/$(ELF_SONAME) \
+ 		$(DESTDIR)$(libdir)/$(ELF_IMAGE).so
+-	-$(LDCONFIG)
+ 
+ clean::
+ 	$(RM) -rf elfshared
+-- 
+1.7.9.5
+
diff --git a/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/run-ptest b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/run-ptest
new file mode 100644
index 000000000..1ac251324
--- /dev/null
+++ b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs/run-ptest
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+cd ./test
+./test_script &>../test.log
+if [ $? -eq 0 ]
+then
+	echo "PASS: e2fsprogs"
+	rm test.log
+else
+	echo "FAIL: e2fsprogs"
+fi
diff --git a/meta-security/recipes-devtools/e2fsprogs/e2fsprogs_%.bbappend b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs_%.bbappend
new file mode 100644
index 000000000..35dd361d4
--- /dev/null
+++ b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs_%.bbappend
@@ -0,0 +1,14 @@
+FILESEXTRAPATHS_prepend := "${THISDIR}/files:"
+
+# Applying this patch is optional. Only some versions
+# of e2fsprogs need it. So try to apply it, but if it fails,
+# continue and hope the patch wasn't needed. If it is needed
+# and got skipped, the oeqa Smack tests will catch the failure.
+SRC_URI += "file://ext_attr.c-fix-adding-multiple-xattrs-during-image-c.patch;apply=no"
+
+do_patch[postfuncs] += "patch_xattr_support"
+patch_xattr_support () {
+    cd ${S}
+    cp lib/ext2fs/ext_attr.c lib/ext2fs/ext_attr.c.orig
+    patch lib/ext2fs/ext_attr.c <${WORKDIR}/ext_attr.c-fix-adding-multiple-xattrs-during-image-c.patch && rm lib/ext2fs/ext_attr.c.orig || mv lib/ext2fs/ext_attr.c.orig lib/ext2fs/ext_attr.c
+}
diff --git a/meta-security/recipes-devtools/e2fsprogs/e2fsprogs_git.bb b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs_git.bb
new file mode 100644
index 000000000..bc2d201a4
--- /dev/null
+++ b/meta-security/recipes-devtools/e2fsprogs/e2fsprogs_git.bb
@@ -0,0 +1,106 @@
+COREDIR = "${COREBASE}/meta/recipes-devtools/e2fsprogs"
+
+# This recipe is a copy of a e2fsprogs 1.42.99+1.43 from OE-core master and
+# only meant to be used when the current OE-core does not have that version yet.
+python () {
+    import os
+    upstream = os.path.join(d.getVar('COREDIR', True), 'e2fsprogs_1.42.9.bb')
+    if not os.path.exists(upstream):
+        raise bb.parse.SkipRecipe("This recipe replaces e2fsprogs 1.42.9 in OE-core. e2fsprogs from OE-core is something else and thus either recent enough to have xattr support or (less likely) something unexpected.")
+}
+
+
+require e2fsprogs.inc
+
+SRC_URI += "file://acinclude.m4 \
+            file://remove.ldconfig.call.patch \
+            file://quiet-debugfs.patch \
+            file://run-ptest \
+            file://ptest.patch \
+            file://mkdir.patch \
+"
+
+SRCREV = "0f26747167cc9d82df849b0aad387bf824f04544"
+PV = "1.42.99+1.43+git${SRCPV}"
+UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>\d+\.\d+(\.\d+)*)$"
+
+EXTRA_OECONF += "--libdir=${base_libdir} --sbindir=${base_sbindir} \
+                --enable-elf-shlibs --disable-libuuid --disable-uuidd \
+                --disable-libblkid --enable-verbose-makecmds"
+
+EXTRA_OECONF_darwin = "--libdir=${base_libdir} --sbindir=${base_sbindir} --enable-bsd-shlibs"
+
+PACKAGECONFIG ??= ""
+PACKAGECONFIG[fuse] = '--enable-fuse2fs,--disable-fuse2fs,fuse'
+
+do_configure_prepend () {
+	cp ${WORKDIR}/acinclude.m4 ${S}/
+}
+
+do_install () {
+	oe_runmake 'DESTDIR=${D}' install
+	oe_runmake 'DESTDIR=${D}' install-libs
+	# We use blkid from util-linux now so remove from here
+	rm -f ${D}${base_libdir}/libblkid*
+	rm -rf ${D}${includedir}/blkid
+	rm -f ${D}${base_libdir}/pkgconfig/blkid.pc
+	rm -f ${D}${base_sbindir}/blkid
+	rm -f ${D}${base_sbindir}/fsck
+	rm -f ${D}${base_sbindir}/findfs
+
+	# e2initrd_helper and the pkgconfig files belong in libdir
+	if [ ! ${D}${libdir} -ef ${D}${base_libdir} ]; then
+		install -d ${D}${libdir}
+		mv ${D}${base_libdir}/e2initrd_helper ${D}${libdir}
+		mv ${D}${base_libdir}/pkgconfig ${D}${libdir}
+	fi
+
+	oe_multilib_header ext2fs/ext2_types.h
+	install -d ${D}${base_bindir}
+	mv ${D}${bindir}/chattr ${D}${base_bindir}/chattr.e2fsprogs
+
+	install -v -m 755 ${S}/contrib/populate-extfs.sh ${D}${base_sbindir}/
+}
+
+do_install_append_class-target() {
+	# Clean host path in compile_et, mk_cmds
+	sed -i -e "s,ET_DIR=\"${S}/lib/et\",ET_DIR=\"${datadir}/et\",g" ${D}${bindir}/compile_et
+	sed -i -e "s,SS_DIR=\"${S}/lib/ss\",SS_DIR=\"${datadir}/ss\",g" ${D}${bindir}/mk_cmds
+}
+
+RDEPENDS_e2fsprogs = "e2fsprogs-badblocks"
+RRECOMMENDS_e2fsprogs = "e2fsprogs-mke2fs e2fsprogs-e2fsck"
+
+PACKAGES =+ "e2fsprogs-e2fsck e2fsprogs-mke2fs e2fsprogs-tune2fs e2fsprogs-badblocks e2fsprogs-resize2fs"
+PACKAGES =+ "libcomerr libss libe2p libext2fs"
+
+FILES_e2fsprogs-resize2fs = "${base_sbindir}/resize2fs*"
+FILES_e2fsprogs-e2fsck = "${base_sbindir}/e2fsck ${base_sbindir}/fsck.ext*"
+FILES_e2fsprogs-mke2fs = "${base_sbindir}/mke2fs ${base_sbindir}/mkfs.ext* ${sysconfdir}/mke2fs.conf"
+FILES_e2fsprogs-tune2fs = "${base_sbindir}/tune2fs ${base_sbindir}/e2label"
+FILES_e2fsprogs-badblocks = "${base_sbindir}/badblocks"
+FILES_libcomerr = "${base_libdir}/libcom_err.so.*"
+FILES_libss = "${base_libdir}/libss.so.*"
+FILES_libe2p = "${base_libdir}/libe2p.so.*"
+FILES_libext2fs = "${libdir}/e2initrd_helper ${base_libdir}/libext2fs.so.*"
+FILES_${PN}-dev += "${datadir}/*/*.awk ${datadir}/*/*.sed ${base_libdir}/*.so"
+
+ALTERNATIVE_${PN} = "chattr"
+ALTERNATIVE_PRIORITY = "100"
+ALTERNATIVE_LINK_NAME[chattr] = "${base_bindir}/chattr"
+ALTERNATIVE_TARGET[chattr] = "${base_bindir}/chattr.e2fsprogs"
+
+ALTERNATIVE_${PN}-doc = "fsck.8"
+ALTERNATIVE_LINK_NAME[fsck.8] = "${mandir}/man8/fsck.8"
+
+RDEPENDS_${PN}-ptest += "${PN} ${PN}-tune2fs coreutils procps bash"
+
+do_compile_ptest() {
+	oe_runmake -C ${B}/tests
+}
+
+do_install_ptest() {
+	cp -a ${B}/tests ${D}${PTEST_PATH}/test
+	cp -a ${S}/tests/* ${D}${PTEST_PATH}/test
+	sed -e 's!../e2fsck/e2fsck!e2fsck!g' -i ${D}${PTEST_PATH}/test/*/expect*
+}
diff --git a/meta-security/recipes-devtools/e2fsprogs/files/ext_attr.c-fix-adding-multiple-xattrs-during-image-c.patch b/meta-security/recipes-devtools/e2fsprogs/files/ext_attr.c-fix-adding-multiple-xattrs-during-image-c.patch
new file mode 100644
index 000000000..67b8b68fb
--- /dev/null
+++ b/meta-security/recipes-devtools/e2fsprogs/files/ext_attr.c-fix-adding-multiple-xattrs-during-image-c.patch
@@ -0,0 +1,51 @@
+From 3b2b0922e031628f313f5480c4f1f9413c6656bf Mon Sep 17 00:00:00 2001
+From: Richard Purdie <richard.purdie@linuxfoundation.org>
+Date: Wed, 10 Feb 2016 15:51:43 +0100
+Subject: [PATCH] ext_attr.c: fix adding multiple xattrs during image creation
+
+http://www.nongnu.org/ext2-doc/ext2.html#CONTRIB-EXTENDED-ATTRIBUTES
+contains the small snippet that "The entry descriptors are sorted by
+attribute name, so that two extended attribute blocks can be compared
+efficiently".
+
+The libext2fs code in e2fsprogs needs to be taught about this minor
+sorting detail. Otherwise creating an image with "mkfs.ext -d" from a
+filesystem that reports xattrs in listxattr() in an order that does
+not match the expected order will lead to an image where listxattr()
+reports all xattrs, but reading some values fails with ENODATA.
+
+[Patch from RP, commit message from Patrick and RP]
+
+Upstream-Status: Pending [https://bugzilla.yoctoproject.org/show_bug.cgi?id=8992]
+---
+ lib/ext2fs/ext_attr.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/lib/ext2fs/ext_attr.c b/lib/ext2fs/ext_attr.c
+index 0a4f8c0..be8f9c3 100644
+--- a/lib/ext2fs/ext_attr.c
++++ b/lib/ext2fs/ext_attr.c
+@@ -258,6 +258,7 @@ static struct ea_name_index ea_names[] = {
+ static int attr_compare(const void *a, const void *b)
+ {
+ 	const struct ext2_xattr *xa = a, *xb = b;
++	size_t len;
+ 
+ 	if (xa->name == NULL)
+ 		return +1;
+@@ -267,7 +268,11 @@ static int attr_compare(const void *a, const void *b)
+ 		return -1;
+ 	else if (!strcmp(xb->name, "system.data"))
+ 		return +1;
+-	return 0;
++	len = strlen(xa->name) - strlen(xb->name);
++	if (len)
++		return len;
++
++	return strcmp(xa->name, xb->name);
+ }
+ 
+ static const char *find_ea_prefix(int index)
+-- 
+2.1.4
+