summaryrefslogtreecommitdiffstats
path: root/meta-security/recipes-security
AgeCommit message (Collapse)AuthorFilesLines
2020-12-17SPEC-3723: restructure meta-aglJan-Simon Moeller31-1986/+0
Goal is to reach a minimal meta-agl-core as base for IVI and IC work at the same time. Trim dependencies and move most 'demo' related recipes to meta-agl-demo. v2: changed to bbapend + .inc , added description v3: testbuild of all images v4: restore -test packagegroup and -qa images, compare manifests and adapt packagegroups. v5: rebased v6: merged meta-agl-distro into meta-agl-core, due to dependency on meta-oe, moved -test packagegroup and -qa images to own layer meta-agl-core-test v7: Fixed comments from Paul Barker v8: Update the markdown files v9: restore wayland/weston/agl-compositor recipes/appends, reworked to move app f/w specific changes to bbappends in meta-app-framework and only demo specific weston-init changes to meta-agl-demo v10: fix s/agldemo/aglcore/ missed in weston-init.bbappend Description: This patch is part 1 out of 2 large patches that implement the layer rework discussed during the previous workshop. Essentially meta-agl-core is the small but versatile new core layer of AGL serving as basis for the work done by the IC and IVI EGs. All demo related work is moved to meta-agl-demo in the 2nd patchset. This should be applied together as atomic change. The resulting meta-agl/* follows these guidelines: - only bsp adaptations in meta-agl-bsp - remove the agl-profile-* layers for simplicity -- the packagegroup-agl(-profile)-graphical and so on have been kept in meta-agl-demo - meta-agl-profile-core is now meta-agl-core - meta-agl-core does pass yocto-check-layer -- therefore use the bbappend + conditional + .inc file construct found in meta-virtualization - meta-agl/meta-security has been merged into meta-agl/meta-app-framework - meta-netboot does pass yocto-check-layer - meta-pipewire does pass yocto-check-layer Migration: All packagegroups are preserved but they're now enabled by 'agl-demo'. Bug-AGL: SPEC-3723 Signed-off-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org> Signed-off-by: Scott Murray <scott.murray@konsulko.com> Change-Id: Ia6c6e5e6ce2b4ffa69ea94959cdc57c310ba7c53 Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/25769
2020-11-18cynagora: Bump version 2.1José Bollo2-4/+4
The version 2.1 fixes a critical database issue. Bug-AGL: SPEC-3677 Change-Id: I93fadbd1c12799d412724ea3e887d4910c74bbb1 Signed-off-by: José Bollo <jose.bollo@iot.bzh> Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/25552 ci-image-build: Jenkins Job builder account <agl-jobbuilder@automotivelinux.org> ci-image-boot-test: Jenkins Job builder account <agl-jobbuilder@automotivelinux.org> Tested-by: Jenkins Job builder account <agl-jobbuilder@automotivelinux.org> Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
2020-04-27meta-security: update to audit 2.8.5Scott Murray11-3179/+266
Update audit recipe with version 2.8.5 recipe from meta-selinux (as of commit 03baa60) to fix build issues against dunfell related to python2 removal. Adding meta-selinux to the manifest for the one recipe seems like overkill for now; it might be worthwhile asking upstream about moving it to meta-security to allow dropping a local copy altogether. Bug-AGL: SPEC-3302 Signed-off-by: Scott Murray <scott.murray@konsulko.com> Change-Id: I83a2e65201f9f02fcce843f4bc6b65a2304ef899
2020-04-27Update distro_features_check usageScott Murray2-2/+2
Replace distro_features_check usage with features_check to work with dunfell, which has removed distro_features_check. Bug-AGL: SPEC-3302 Signed-off-by: Scott Murray <scott.murray@konsulko.com> Change-Id: I46ef0d0feaa5515dd664de4cc5a9691e2ebe109b
2020-02-21Merge remote-tracking branch 'agl/next'Jan-Simon Möller6-122/+0
* agl/next: meta-agl-bsp: Add CONFIG_LSM workaround for 5.1+ kernels meta-agl-profile-cluster-qt5: disable qtbase patches zeus updates for dragonboard-410c meta-security: activates dbus-cynagora recipes-graphics/wayland/weston: Expose weston_output_damage() meta-agl-profile-core: tweak udisks2 configuration for AGL meta-agl-bsp/meta-arago: update weston bbappend [RCAR] Update rcar driver weston 7 bsp 3.21.0 [RCAR] Update rcar driver weston 7 bsp 3.21.0 [RCAR] Split ADSP path for ulcb and ulcb-kf Fix nss-localuser post install meta-agl-bsp: meta-raspberrypi: handle zeus upgrade meta-agl-profile-core: add patch for systemd-udevd SECLABEL crash meta-security: disable dbus-cynara patches meta-agl-bsp: handle ptest-runner upgrade meta-agl-distro: Add inc file for next branch over-rides meta-agl-distro: BBMASK problematic upstream meta-security bbappend meta-agl-distro: prefer linux-yocto 4.19 LTS kernel meta-agl-profile-graphical-qt5: enable qt5location services meta-agl-profile-core: update most recipe meta-agl-profile-core: update neardal recipe Update base local.conf.sample meta-agl-profile-graphical: don't always build agl-compositor meta-agl-profile-graphical: update weston and weston-init meta-agl-profile-graphical: update wayland-ivi-extension for weston 7.0.0 meta-agl-distro: add polkit to DISTRO_FEATURES meta-agl-profile-core: update fontconfig bbappend meta-agl-profile-core: switch to udisks2 meta-security: handle systemd upgrade meta-agl-profile-graphical-qt5: handle qtwayland upgrade meta-agl-profile-core: handle freetype upgrade meta-agl-bsp meta-agl-profile-core: upgrade to opencv 4.x meta-agl-profile-core: update rtl-sdr recipe for zeus meta-security meta-app-framework: handle xmlsec1 upgrade meta-agl-profile-graphical: upgrade to gstreamer 1.16 meta-agl-profile-core: remove libmicrohttpd backport meta-agl-profile-core: remove backported curl and nghttp2 recipes meta-agl-profile-core: remove libnfc recipe meta-agl-profile-core: remove connman backport meta-agl-profile-graphical: remove weston 5.0.0 patches meta-agl-profile-core: remove old glibc patch meta-agl-bsp/meta-intel: remove linux-firmware_git.bbappend meta-agl-bsp: remove weston and wayland-protocols backports meta-app-framework: remove libzip recipe meta-security: remove keyutils recipe Declare layer compatibility with zeus Change-Id: Ie8ee1e37958279e7cf2d503c54ffacb46ba0c31c
2020-02-14cynagora: Fix protocol and start issuesJosé Bollo1-1/+1
Includes: * 384f2e7 Fix bug on unknown commands * 68ccab4 Fix a bug in protocol * 218dad2 Change cynagora service Bug-AGL: SPEC-3002 Bug-AGL: SPEC-3166 Bug-AGL: SPEC-3168 Change-Id: I671296d7f6512c1fcf2abda3bd707fbda1c63446 Signed-off-by: José Bollo <jose.bollo@iot.bzh>
2020-02-14security-manager: Restrict socket accessesJosé Bollo2-0/+35
Ensure that only members of the group and the owner can access the security manager. Bug-AGL: SPEC-3146 Change-Id: Ia529be6b4ef425d03be31f0d2e2d623fa6ac091e Signed-off-by: José Bollo <jose.bollo@iot.bzh>
2020-01-22meta-security meta-app-framework: handle xmlsec1 upgradeScott Murray1-3/+0
Remove now unneeded meta-security xmlsec1 bbappend, and update the bbappend in meta-app-framework to work with the new xmlsec1 1.2.28 recipe in oe-core. Bug-AGL: SPEC-2932 Change-Id: If57b7c9fa2a4d2b8f9470dd67e95b4579d1210c7 Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2020-01-22meta-security: remove keyutils recipeScott Murray5-119/+0
Remove keyutils 1.5.8 recipe since meta-oe has a newer 1.6 recipe. Bug-AGL: SPEC-2932 Change-Id: I0a0d2507922c0d705eb064577c0a2a8fcc081d3f Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2019-12-19cynagoauth: Add a basic OAuth serverJosé Bollo1-0/+23
cynagoauth is a basic OAuth2 server implementing delivery of tokens based on the Smack label of the client. Bug-AGL: SPEC-2550 Bug-AGL: SPEC-2968 Bug-AGL: SPEC-3032 Change-Id: I93aa1864ac68ec51963a25e80150879ea88a5766 Signed-off-by: José Bollo <jose.bollo@iot.bzh>
2019-12-19cynagora: Bump versionJosé Bollo1-2/+2
Includes: * 23bc103 agent-at: Move field separator from : to ; * c29761c Improve integration of cynagora Bug-AGL: SPEC-2968 Change-Id: I83af517b446f0a55de253568b17069b6231d3034 Signed-off-by: José Bollo <jose.bollo@iot.bzh>
2019-12-03security-manager: Improve integrationJosé Bollo18-208/+396
This fixes some issues encountered by the current integration of the security-manager: - its recipes is spread in too much directories (see SPEC-2092) - its initialization should be checked (see SPEC-2091) - the location of the database has to be changed (see SPEC-1717 that provided a workaround) All in one, I decided to create that ticket that summarize the work that can be quickly achieved to answer all this issues that are tightly coupled. Bug-AGL: SPEC-2972 Bug-AGL: SPEC-2092 Bug-AGL: SPEC-2091 Bug-AGL: SPEC-1717 Change-Id: I7af941c25cfa1624d76c2e8f512f6535918912f0 Signed-off-by: José Bollo <jose.bollo@iot.bzh>
2019-11-07Cynagora: Replace cynara with cynagoraJosé Bollo13-718/+72
Shift from the permission database cynara to cynagora permission database with a compatibility library. The cache size required by dbus-cynara is updated because that size is now a count of bytes, not a count of entries. Bug-AGL: SPEC-2844 Change-Id: I9a81de6e3b8bcb94adc0bb05c63183c2eda3f310 Signed-off-by: José Bollo <jose.bollo@iot.bzh>
2019-08-16dbus-cynara: Simplifies build recipeJosé Bollo1-2/+0
Simplifies the way of building dbus-cynara by removing the specific recipes in favour of a recipe for dbus that handles the class-target build feature. It requires to remove fake dependencies of cynara. This is a suggestion of Tom Rini. Bug-AGL: SPEC-1839 Change-Id: Id7a736eb4b73cdb679fa9dde30e9ad8e56c2894e Signed-off-by: José Bollo <jose.bollo@iot.bzh>
2019-04-04Upgrade to thudScott Murray17-267/+401
Changes include: - Add LAYERSERIES_COMPAT definitions to layer.conf files - Remove now unnecessary SECURITY_*FLAGS over-rides from distro configuration - Set intel-corei7-64 preferred kernel version to 4.19 to match latest linux-intel kernel available in meta-intel - Update qemuarm preferred kernel version to 4.18 to match latest linux-yocto - Update firmware package and devicetree file names for raspberrypi3 - Remove linux-firmware bbappend specific to raspberrypi, it seems no longer required and breaks the cross SDK build - Update linux-intel bbappend to 4.19, remove now unnecessary patch - Remove now unnecessary lttng-modules backport - Update linux-raspberrypi bbappend to 4.14 kernel - Added kernel configuration fragment for raspberrypi to disable Kprobes. This is required until linux-raspberrypi is updated to greater than 4.14.104 to avoid a build failure in lttng-modules related to a check for known breakage in the kernel CONFIG_OPTPROBES code. - Replace obsolete base_conditional usage with oe.utils.conditional - Add gstreamer1.0-plugins-bad bbappend for raspberrypi3 to disable faad PACKAGECONFIG to avoid commercial license issues - Remove unused and unbuildable Vayu gstreamer recipes - Update linux-ti-staging bbappend for new BSP kernel - Regen dcan2_pinmux_enable.patch for linux-ti-staging to remove fuzz warning, and remove upstreamed fix_dcan_addresses.patch - Remove ipumm-fw from meta-agl-bsp/meta-ti, as newer version is available in the upstream BSP - Update meta-agl-bsp/meta-ti weston patch to apply against 5.0.0 - Update meta-agl-bsp/meta-ti wayland-ivi-extension patch to apply against 2.2.0 - Add ti-sgx-ddk-km patch to add AGL toolchain configuration file - Remove now unnecessary fdtoverlay recipe - Update core.cfg and ivishell.cfg in weston-ini-conf recipe to handle move of ivi-controller.so configuration in Weston 5.0.0 - Update connman-ncurses patch to remove fuzz warning - Add installation of systemd over-ride file for run-postinsts.service in run-postinsts bbappend to workaround race condition between ldconfig.service and the /sbin/ldconfig invocations in the post-install scripts run by run-postinsts.service. The observed failure was cynara's post-install script failing and its database not being created. - Remove now unnecessary valgrind backport - Add patches to fix most driver compilation against newer kernels - Update libmicrohttpd bbappend - Remove libssp-dev from agl-image-graphical-qt5-crosssdk and agl-demo-platform-html5-crosssdk, upstream have removed it from non-mingw32 platform SDKs - Update wayland-ivi-extension recipe to build 2.2.0, and update local patches - Update weston patches for 5.0.0. Patches: 0016-ivi-shell_add_screen_remove_layer_api.patch 0017-ivi-shell-register-ivi_layout_interface.patch have been removed as they have been applied upstream and are no longer necessary. Patches: 0018-compositor-add-output-type-to-weston_output.patch 0019-compositor-drm-introduce-drm_get_dmafd_from_view.patch (both related to Waltham) have been disabled for now as they need significant rework. - Remove weston-conf RRECOMMENDS in weston bbappend to avoid conflict with weston-ini-conf - Add OECMAKE_GENERATOR = "Unix Makefiles" to aglwgt.bbclass to work around CMake+ninja issue in cmake-apps-module - Update dbus cynara patches for 1.12.10 - Add do_install_append in cynara recipe to remove /var/cynara from cynara package so the directory creation and labelling in the post-install scriptlet will function as intended - Remove now unnecessary e2fsprogs backport - Remove now unnecessary libcap-ng backport - Update pulseaudio patches to remove fuzz warnings - Update neardal patch to remove fuzz warning - Update freetype patch to remove fuzz warning - Rename opencv bbappend to 3.% to handle 3.x backports in upstream - Updated qtwayland patch to remove fuzz warning Changes from Stephane Desneux <stephane.desneux@iot.bzh>: - Remove wayland-ivi-extension PREFERRED_VERSION - Remove now unnecessary nativesdk-cmake patch - Remove now unnecessary ptest-runner patches - Remove now unnecessary harfbuzz patches - Disable waltham-transmitter as it does not build against weston 5.0.0 - Update af-main, cynara, and security-manager to use pkg_postinst_ontarget - Bump connman-ncurses revision to avoid deprecated ncurses functions - Update libva package usage with new intel-vaapi-driver name - Add patches to security-manager to fix compilation with gcc8 - Updated systemd bbappend Changes from Jan-Simon Möller <jsmoeller@linuxfoundation.org>: - Remove meta-agl-bsp/ROCKO.FIXMEs - Remove linux-yocto_4.12.bbappend and now unnecessary associated patch - Remove now unneeded kern-tools-native patch - Bump gstreamer PREFERRED_VERSIONs to 1.14.x - Remove latencytop from packagegroup-agl-core-devel, it has been dropped by upstream - Remove now unnecessary rpm patches - Update pulseaudio bbappend to 12.2 - Update opencv bbappend to 3.4 - Update freetype bbappend to 2.9.1 - Update dbus bbappend to 1.12.10 - Update weston bbappend to 5.0.0 - Update cynara patches to remove fuzz warnings - Add patch to cynara to fix compilation with gcc8 - Add xmlsec1 bbappend to clear EXTRA_OECONF to fix compilation on sumo or newer Changes from Ronan Le Martet <ronan.lemartet@iot.bzh>: - Update meta-rcar-gen3-adas layer gstreamer1.0-plugin-vspfilter bbappend to version 1.0.1 Known issues (marked with FIXME): - CMake+ninja issue in cmake-apps-module has been worked around with OECMAKE_GENERATOR - waltham-transmitter and the patches to weston related to it have been disabled - Currently unclear if patch to libcap-native is actually required or not Bug-AGL: SPEC-1837 Change-Id: I7b8b9ef667aec2d229952eace6663dfc761654d0 Signed-off-by: Scott Murray <scott.murray@konsulko.com>
2018-09-28Move security manager database under /var/localAnton Gerasimov1-1/+1
It is critical for agl-sota feature Bug-AGL: SPEC-1717 Change-Id: Ia4060721e3a092d13934d3af575199e67e356e71 Signed-off-by: Anton Gerasimov <anton.gerasimov@here.com>
2018-04-01Remove upstreamed patch for typo in verify3Jan-Simon Möller2-14/+0
Upstream recipe has fix included. Change-Id: Ice5b699c9fbd25ec9b1dceb0bdac8f669cec9b0f Signed-off-by: Jan-Simon Möller <jsmoeller@linuxfoundation.org>
2018-03-27xmlsec1: Fix compilation issue in examplesJosé Bollo2-0/+14
When the feature agl-ptest is selected, it leads to a compilation error due to an unexpected character in the file examples/verify3.c. Bug-AGL: SPEC-1353 Change-Id: Idcda2eed181636a9229b4a666a1ef31eddc6309c Signed-off-by: José Bollo <jose.bollo@iot.bzh>
2018-02-13cynara: upgrade to 0.14.10José Bollo10-225/+462
Change-Id: I33caaa8a435e0b36afff43c4199428ae9336d612 Signed-off-by: José Bollo <jose.bollo@iot.bzh>
2018-02-13Remove smack recipeJosé Bollo2-29/+2
smack user space library is provided by meta-security Change-Id: Ifb5e88e5f5a1aab3e695ab91a56d8c55c33fd004 Signed-off-by: José Bollo <jose.bollo@iot.bzh>
2018-02-13Integrate parts of meta-intel-iot-securityJosé Bollo40-0/+5079
Adds the recipes of the sub layers - meta-security-framework - meta-security-smack Change-Id: I618608008a3b3d1d34adb6e38048110f13ac0643 Signed-off-by: José Bollo <jose.bollo@iot.bzh>