new file mode 100644
@@ -0,0 +1,231 @@
+From f6287d146762b8360bd7099f4724a58eedba7d2a Mon Sep 17 00:00:00 2001
+From: Armin Kuster <akuster808@gmail.com>
+Date: Wed, 14 Jun 2023 07:46:55 -0400
+Subject: [PATCH] scap-security-guide: add openembedded
+
+Signed-off-by: Armin Kuster <akuster808@gmail.com>
+
+Upstream-Status: Pending
+Signed-off-by: Armin Kuster <akuster808@gmail.com>
+
+---
+ CMakeLists.txt | 5 +++
+ build_product | 1 +
+ products/openembedded/CMakeLists.txt | 6 ++++
+ products/openembedded/product.yml | 19 +++++++++++
+ .../openembedded/profiles/standard.profile | 12 +++++++
+ .../openembedded/transforms/constants.xslt | 10 ++++++
+ .../oval/installed_OS_is_openembedded.xml | 33 +++++++++++++++++++
+ .../oval/sysctl_kernel_ipv6_disable.xml | 1 +
+ ssg/constants.py | 5 ++-
+ 9 files changed, 91 insertions(+), 1 deletion(-)
+ create mode 100644 products/openembedded/CMakeLists.txt
+ create mode 100644 products/openembedded/product.yml
+ create mode 100644 products/openembedded/profiles/standard.profile
+ create mode 100644 products/openembedded/transforms/constants.xslt
+ create mode 100644 shared/checks/oval/installed_OS_is_openembedded.xml
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 85ec289644..09ac96784e 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -95,6 +95,7 @@ option(SSG_PRODUCT_UBUNTU1804 "If enabled, the Ubuntu 18.04 SCAP content will be
+ option(SSG_PRODUCT_UBUNTU2004 "If enabled, the Ubuntu 20.04 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
+ option(SSG_PRODUCT_UBUNTU2204 "If enabled, the Ubuntu 22.04 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
+ option(SSG_PRODUCT_UOS20 "If enabled, the Uos 20 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
++option(SSG_PRODUCT_OE "If enabled, the OpenEmbedded SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
+
+
+ option(SSG_CENTOS_DERIVATIVES_ENABLED "If enabled, CentOS derivative content will be built from the RHEL content" TRUE)
+@@ -289,6 +290,7 @@ message(STATUS "Ubuntu 18.04: ${SSG_PRODUCT_UBUNTU1804}")
+ message(STATUS "Ubuntu 20.04: ${SSG_PRODUCT_UBUNTU2004}")
+ message(STATUS "Ubuntu 22.04: ${SSG_PRODUCT_UBUNTU2204}")
+ message(STATUS "Uos 20: ${SSG_PRODUCT_UOS20}")
++message(STATUS "OpenEmbedded nodistro: ${SSG_PRODUCT_OE}")
+
+
+
+@@ -410,6 +412,9 @@ endif()
+ if (SSG_PRODUCT_UOS20)
+ add_subdirectory("products/uos20" "uos20")
+ endif()
++if (SSG_PRODUCT_OE)
++ add_subdirectory("products/openembedded" "openembedded")
++endif()
+
+ # ZIP only contains source datastreams and kickstarts, people who
+ # want sources to build from should get the tarball instead.
+diff --git a/build_product b/build_product
+index fc793cbe70..197d925b7e 100755
+--- a/build_product
++++ b/build_product
+@@ -333,6 +333,7 @@ all_cmake_products=(
+ UBUNTU2204
+ UOS20
+ MACOS1015
++ OPENEMBEDDED
+ )
+
+ DEFAULT_OVAL_MAJOR_VERSION=5
+diff --git a/products/openembedded/CMakeLists.txt b/products/openembedded/CMakeLists.txt
+new file mode 100644
+index 0000000000..1981adf53e
+--- /dev/null
++++ b/products/openembedded/CMakeLists.txt
+@@ -0,0 +1,6 @@
++# Sometimes our users will try to do: "cd openembedded; cmake ." That needs to error in a nice way.
++if ("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}")
++ message(FATAL_ERROR "cmake has to be used on the root CMakeLists.txt, see the Building ComplianceAsCode section in the Developer Guide!")
++endif()
++
++ssg_build_product("openembedded")
+diff --git a/products/openembedded/product.yml b/products/openembedded/product.yml
+new file mode 100644
+index 0000000000..9f2f12d737
+--- /dev/null
++++ b/products/openembedded/product.yml
+@@ -0,0 +1,19 @@
++product: openembedded
++full_name: OpemEmbedded
++type: platform
++
++benchmark_id: OPENEMBEDDED
++benchmark_root: "../../linux_os/guide"
++
++profiles_root: "./profiles"
++
++pkg_manager: "dnf"
++
++init_system: "systemd"
++
++cpes_root: "../../shared/applicability"
++cpes:
++ - openembedded:
++ name: "cpe:/o:openembedded"
++ title: "OpenEmbedded nodistro"
++ check_id: installed_OS_is_openembedded
+diff --git a/products/openembedded/profiles/standard.profile b/products/openembedded/profiles/standard.profile
+new file mode 100644
+index 0000000000..44339d716c
+--- /dev/null
++++ b/products/openembedded/profiles/standard.profile
+@@ -0,0 +1,12 @@
++documentation_complete: true
++
++title: 'Sample Security Profile for OpenEmbedded Distros'
++
++description: |-
++ This profile is an sample for use in documentation and example content.
++ The selected rules are standard and should pass quickly on most systems.
++
++selections:
++ - file_owner_etc_passwd
++ - file_groupowner_etc_passwd
++ - file_permissions_etc_passwd
+diff --git a/products/openembedded/transforms/constants.xslt b/products/openembedded/transforms/constants.xslt
+new file mode 100644
+index 0000000000..85e812a7c1
+--- /dev/null
++++ b/products/openembedded/transforms/constants.xslt
+@@ -0,0 +1,10 @@
++<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
++
++<xsl:include href="../../../shared/transforms/shared_constants.xslt"/>
++
++<xsl:variable name="product_long_name">OpenEmbedded nodistro</xsl:variable>
++<xsl:variable name="product_short_name">OE nodistro</xsl:variable>
++<xsl:variable name="product_stig_id_name">empty</xsl:variable>
++<xsl:variable name="prod_type">openembedded</xsl:variable>
++
++</xsl:stylesheet>
+diff --git a/shared/checks/oval/installed_OS_is_openembedded.xml b/shared/checks/oval/installed_OS_is_openembedded.xml
+new file mode 100644
+index 0000000000..17c2873686
+--- /dev/null
++++ b/shared/checks/oval/installed_OS_is_openembedded.xml
+@@ -0,0 +1,33 @@
++<def-group>
++ <definition class="inventory" id="installed_OS_is_openembedded" version="1">
++ <metadata>
++ <title>OpenEmbedded</title>
++ <affected family="unix">
++ <platform>multi_platform_all</platform>
++ </affected>
++ <description>The operating system installed is an OpenEmbedded System</description>
++ </metadata>
++ <criteria comment="System is OpenEmbedded" operator="AND">
++ <extend_definition comment="Installed OS is part of the Unix family" definition_ref="installed_OS_is_part_of_Unix_family" />
++ <criterion comment="OpenEmbedded distro" test_ref="test_os_release" />
++ <criterion comment="OpenEmbedded is installed" test_ref="test_openembedded" />
++ </criteria>
++ </definition>
++
++ <unix:file_test check="all" check_existence="all_exist" comment="/etc/os-release exists" id="test_os_release" version="1">
++ <unix:object object_ref="obj_os_release" />
++ </unix:file_test>
++ <unix:file_object comment="check /etc/os-release file" id="obj_os_release" version="1">
++ <unix:filepath>/etc/os-release</unix:filepath>
++ </unix:file_object>
++
++ <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check OpenEmbedded" id="test_openembedded" version="1">
++ <ind:object object_ref="obj_openembedded" />
++ </ind:textfilecontent54_test>
++ <ind:textfilecontent54_object id="obj_openembedded" version="1" comment="Check OpenEmbedded">
++ <ind:filepath>/etc/os-release</ind:filepath>
++ <ind:pattern operation="pattern match">^ID=nodistro$</ind:pattern>
++ <ind:instance datatype="int">1</ind:instance>
++ </ind:textfilecontent54_object>
++
++</def-group>
+diff --git a/shared/checks/oval/sysctl_kernel_ipv6_disable.xml b/shared/checks/oval/sysctl_kernel_ipv6_disable.xml
+index affb9770cb..4f22df262c 100644
+--- a/shared/checks/oval/sysctl_kernel_ipv6_disable.xml
++++ b/shared/checks/oval/sysctl_kernel_ipv6_disable.xml
+@@ -8,6 +8,7 @@
+ <platform>multi_platform_debian</platform>
+ <platform>multi_platform_example</platform>
+ <platform>multi_platform_fedora</platform>
++ <platform>multi_platform_openembedded</platform>
+ <platform>multi_platform_opensuse</platform>
+ <platform>multi_platform_ol</platform>
+ <platform>multi_platform_rhcos</platform>
+diff --git a/ssg/constants.py b/ssg/constants.py
+index f66ba008fa..630fbdfcb9 100644
+--- a/ssg/constants.py
++++ b/ssg/constants.py
+@@ -219,6 +219,7 @@ FULL_NAME_TO_PRODUCT_MAPPING = {
+ "Ubuntu 20.04": "ubuntu2004",
+ "Ubuntu 22.04": "ubuntu2204",
+ "UnionTech OS Server 20": "uos20",
++ "OpenEmbedded": "openembedded",
+ "Not Applicable" : "example"
+ }
+
+@@ -267,7 +268,7 @@ REFERENCES = dict(
+
+ MULTI_PLATFORM_LIST = ["rhel", "fedora", "rhv", "debian", "ubuntu",
+ "opensuse", "sle", "ol", "ocp", "rhcos",
+- "example", "eks", "alinux", "uos", "anolis"]
++ "example", "eks", "alinux", "uos", "anolis", "openembedded"]
+
+ MULTI_PLATFORM_MAPPING = {
+ "multi_platform_alinux": ["alinux2", "alinux3"],
+@@ -285,6 +286,7 @@ MULTI_PLATFORM_MAPPING = {
+ "multi_platform_sle": ["sle12", "sle15"],
+ "multi_platform_ubuntu": ["ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204"],
+ "multi_platform_uos": ["uos20"],
++ "multi_platform_openembedded": ["openembedded"],
+ }
+
+ RHEL_CENTOS_CPE_MAPPING = {
+@@ -454,6 +456,7 @@ MAKEFILE_ID_TO_PRODUCT_MAP = {
+ 'ocp': 'Red Hat OpenShift Container Platform',
+ 'rhcos': 'Red Hat Enterprise Linux CoreOS',
+ 'eks': 'Amazon Elastic Kubernetes Service',
++ 'openembedded': 'OpenEmbedded',
+ }
+
+ # References that can not be used with product-qualifiers
+--
+2.34.1
+
@@ -7,25 +7,20 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=9bfa86579213cb4c6adaffface6b2820"
LICENSE = "BSD-3-Clause"
SRCREV = "dad85502ce8da722a6afc391346c41cee61e90a9"
-SRC_URI = "git://github.com/ComplianceAsCode/content.git;branch=master;protocol=https"
+SRC_URI = "git://github.com/ComplianceAsCode/content.git;branch=master;protocol=https \
+ file://0001-scap-security-guide-add-openembedded.patch "
DEPENDS = "openscap-native python3-pyyaml-native python3-jinja2-native libxml2-native expat-native coreutils-native"
S = "${WORKDIR}/git"
+B = "${S}/build"
inherit cmake pkgconfig python3native python3targetconfig
-STAGING_OSCAP_BUILDDIR = "${TMPDIR}/work-shared/openscap/oscap-build-artifacts"
-export OSCAP_CPE_PATH="${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/cpe"
-export OSCAP_SCHEMA_PATH="${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/schemas"
-export OSCAP_XSLT_PATH="${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/xsl"
-
OECMAKE_GENERATOR = "Unix Makefiles"
-EXTRA_OECMAKE += "-DENABLE_PYTHON_COVERAGE=OFF -DSSG_PRODUCT_DEFAULT=OFF -DSSG_PRODUCT_EXAMPLE=ON"
-
-B = "${S}/build"
+EXTRA_OECMAKE += "-DENABLE_PYTHON_COVERAGE=OFF -DSSG_PRODUCT_DEFAULT=OFF -DSSG_PRODUCT_OE=ON"
do_configure[depends] += "openscap-native:do_install"
Signed-off-by: Armin Kuster <akuster808@gmail.com> --- ...scap-security-guide-add-openembedded.patch | 231 ++++++++++++++++++ .../scap-security-guide_0.1.67.bb | 13 +- 2 files changed, 235 insertions(+), 9 deletions(-) create mode 100644 recipes-compliance/scap-security-guide/files/0001-scap-security-guide-add-openembedded.patch