mbox series

[meta-security,00/18] various updates

Message ID 20241220140441.271395-1-mikko.rapeli@linaro.org
Headers show
Series various updates | expand

Message

Mikko Rapeli Dec. 20, 2024, 2:04 p.m. UTC 
Hi,

I'm trying to setup a build and test configuration
which uses swtpm as discrete TPM device outside of qemu
so that TPM device gets used from u-boot firmware to all the
way in target system with systemd.

The final build and test configuration needs more work but
these updates have been needed so far. A lot of the tests
executed via kas are currently failing on qemuarm64 and hence
these changes. Some issues with smack etc still remain
but these already improve the tests a bit.

I'd like to know if there is some specific test configuration
used in CI or similar, then I can try to make sure things
work there first. I'll do testing on qemuarm, qemuarm64 and
possibly genericarm64 if that would be acceptable upstream.

Mikko Rapeli (18):
  kas-security-base.yml: replace debug-tweaks
  kas-security-alt.yml: fix systemd config
  chkrootkit: change download from Ubuntu to Debian
  apparmor: update from 3.1.3 to 4.0.3
  oeqa runtime clamav.py: use curl if ping fails
  libtpm: update from 0.9.6 to 0.10.0
  libtpm: rename to libtpms
  libtpms: set CVE_PRODUCT
  swtpm: update from 0.8.2 to 0.10.0
  tpm2-tools: add dependency to efivar
  u-boot: enable TPM support via "tpm2" in MACHINE_FEATURES
  systemd: enable TPM support
  systemd-boot: enable TPM support via "tpm2" in DISTRO_FEATURES
  harden.conf: exapand debug-tweaks
  linux-yocto: enable ecryptfs
  ecryptfs-utils: depend on ecryptfs kernel module
  oeqa runtime clamav.py: skip test_freshclam_download with systemd
  oeqa runtime ima.py: skip without "integrity" in DISTRO_FEATURES

 kas/kas-security-alt.yml                      |  2 +-
 kas/kas-security-base.yml                     |  2 +-
 lib/oeqa/runtime/cases/clamav.py              |  4 +-
 meta-hardening/conf/distro/harden.conf        |  2 +-
 meta-integrity/lib/oeqa/runtime/cases/ima.py  |  1 +
 .../distro/include/maintainers-meta-tpm.inc   |  2 +-
 meta-tpm/recipes-bsp/u-boot/u-boot_%.bbappend |  2 +-
 .../packagegroup-security-vtpm.bb             |  2 +-
 .../systemd/systemd-boot_%.bbappend           |  7 ++
 .../recipes-core/systemd/systemd_%.bbappend   | 17 +++++
 .../{libtpm_0.9.6.bb => libtpms_0.10.0.bb}    |  8 +-
 .../swtpm/{swtpm_0.8.2.bb => swtpm_0.10.0.bb} | 10 +--
 .../recipes-tpm2/tpm2-tools/tpm2-tools_5.7.bb |  2 +-
 recipes-kernel/linux/linux-yocto_security.inc |  1 +
 .../{apparmor_3.1.3.bb => apparmor_4.0.3.bb}  |  8 +-
 .../0001-fail.py-handle-missing-cgitb.patch   | 74 +++++++++++++++++++
 recipes-scanners/rootkits/chkrootkit_0.57.bb  |  2 +-
 .../ecryptfs-utils/ecryptfs-utils_111.bb      |  5 +-
 18 files changed, 129 insertions(+), 22 deletions(-)
 create mode 100644 meta-tpm/recipes-core/systemd/systemd-boot_%.bbappend
 create mode 100644 meta-tpm/recipes-core/systemd/systemd_%.bbappend
 rename meta-tpm/recipes-tpm/libtpm/{libtpm_0.9.6.bb => libtpms_0.10.0.bb} (76%)
 rename meta-tpm/recipes-tpm/swtpm/{swtpm_0.8.2.bb => swtpm_0.10.0.bb} (92%)
 rename recipes-mac/AppArmor/{apparmor_3.1.3.bb => apparmor_4.0.3.bb} (96%)
 create mode 100644 recipes-mac/AppArmor/files/0001-fail.py-handle-missing-cgitb.patch