meta-security: subtree update:775870980b..ca9264b1e1

Anton Antonov (4):
      Use libest "main" branch instead of "master".
      Add meta-parsec layer into meta-security.
      Define secure images with parsec-service and parsec-tool included and add the images into gitlab CI
      Clearly define clang toolchain in Parsec recipes

Armin Kuster (16):
      packagegroup-core-security: drop clamav-cvd
      clamav: upgrade 104.0
      python3-privacyidea: upgrade 3.5.1 -> 3.5.2
      clamav: fix systemd service install
      swtpm: now need python-cryptography, pull in layer
      swtpm: file pip3 issue
      swtpm: fix check for tscd deamon on host
      python3-suricata-update: update to 1.2.1
      suricata: update to 6.0.2
      layer.conf: add dynamic-layer for rust pkg
      README: cleanup
      .gitlab-ci.yml: reorder to speed up builds
      kas-security-base.yml: tweek build vars
      gitlab-ci: fine tune order
      clamav: remove rest of mirror.dat ref
      lkrg-module: Add Linux Kernel Runtime Guard

Ming Liu (2):
      meta: drop IMA_POLICY from policy recipes
      initramfs-framework-ima: introduce IMA_FORCE

Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Change-Id: Ifac35a0d7b7e724f1e30dce5f6634d5d4fc9b5b9

6 files changed, 316 insertions, 0 deletions

diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-service/files/cryptoki.patch b/meta-security/meta-parsec/recipes-parsec/parsec-service/files/cryptoki.patch
new file mode 100644
index 000000000..c23447967
--- /dev/null
+++ b/meta-security/meta-parsec/recipes-parsec/parsec-service/files/cryptoki.patch
@@ -0,0 +1,18 @@
+
+Use cryptoki v0.1.1 which supports the "generate-bindings" feature
+required for building Parsec service 0.7.0 in Yocto.
+
+Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
+Upstream-Status: Submitted
+
+--- a/Cargo.toml	2021-04-01 10:29:50.333687763 +0100
++++ b/Cargo.toml	2021-04-01 10:27:13.051860002 +0100
+@@ -37,7 +37,7 @@
+ version = "1.3.1"
+ 
+ [dependencies.cryptoki]
+-version = "0.1.0"
++version = "0.1.1"
+ features = ["psa-crypto-conversions"]
+ optional = true
+ 
diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-service/files/parsec-tmpfiles.conf b/meta-security/meta-parsec/recipes-parsec/parsec-service/files/parsec-tmpfiles.conf
new file mode 100644
index 000000000..fe576a27f
--- /dev/null
+++ b/meta-security/meta-parsec/recipes-parsec/parsec-service/files/parsec-tmpfiles.conf
@@ -0,0 +1,2 @@
+#Type   Path            Mode    User    Group   Age     Argument
+d       /run/parsec     755     parsec  parsec  -       -
diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-service/files/parsec_init b/meta-security/meta-parsec/recipes-parsec/parsec-service/files/parsec_init
new file mode 100755
index 000000000..58a289727
--- /dev/null
+++ b/meta-security/meta-parsec/recipes-parsec/parsec-service/files/parsec_init
@@ -0,0 +1,63 @@
+#! /bin/sh -e
+
+# ------------------------------------------------------------------------------
+# Copyright (c) 2021, Arm Limited, All Rights Reserved
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#          http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ------------------------------------------------------------------------------
+
+# Parsec Service SysV init script
+
+test -x /usr/libexec/parsec/parsec || exit 0
+
+case "$1" in
+  start)
+    echo -n "Starting Parsec daemon: "
+    if [ ! -f /etc/parsec/config.toml ]; then
+        echo "There is no Parsec service configuration file."
+    else
+        if [ ! -d /run/parsec ]; then
+            mkdir /run/parsec
+            chown parsec:parsec /run/parsec
+            chmod 755 /run/parsec
+        fi
+        # start-stop-daemon used in poky busybox doesn't support
+        # '--chdir' parameter. So, let's do it manually
+        cd /var/lib/parsec
+        RUST_LOG=info start-stop-daemon --oknodo --start --background \
+                --chuid parsec:parsec --exec /usr/libexec/parsec/parsec \
+                -- --config /etc/parsec/config.toml
+        echo "parsec."
+    fi
+    ;;
+  stop)
+    echo -n "Stopping Parsec daemon: "
+    start-stop-daemon --oknodo --stop --exec /usr/libexec/parsec/parsec
+    echo "parsec."
+    ;;
+  reload)
+    echo -n "Reloading Parsec daemon: "
+    start-stop-daemon --stop --signal SIGHUP --exec /usr/libexec/parsec/parsec
+    echo "parsec."
+    ;;
+  restart|force-reload)
+    $0 stop
+    $0 start
+    ;;
+  *)
+    echo "Usage: /etc/init.d/parsec {start|stop|restart|reload|force-reload}"
+    exit 1
+esac
+
+exit 0
diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-service/files/systemd.patch b/meta-security/meta-parsec/recipes-parsec/parsec-service/files/systemd.patch
new file mode 100644
index 000000000..c01ff065c
--- /dev/null
+++ b/meta-security/meta-parsec/recipes-parsec/parsec-service/files/systemd.patch
@@ -0,0 +1,19 @@
+
+Run the Parsec service as parsec user in /var/lib/parsec/ working directory.
+
+Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
+Upstream-Status: Inappropriate [deployment configuration]
+
+--- a/systemd-daemon/parsec.service	2021-03-28 18:34:18.703196235 +0100
++++ b/systemd-daemon/parsec.service	2021-03-28 18:35:14.279830299 +0100
+@@ -3,7 +3,9 @@
+ Documentation=https://parallaxsecond.github.io/parsec-book/parsec_service/install_parsec_linux.html
+ 
+ [Service]
+-WorkingDirectory=/home/parsec/
++User=parsec
++Group=parsec
++WorkingDirectory=/var/lib/parsec/
+ ExecStart=/usr/libexec/parsec/parsec --config /etc/parsec/config.toml
+ 
+ [Install]
diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.7.0.bb b/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.7.0.bb
new file mode 100644
index 000000000..0e149558c
--- /dev/null
+++ b/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.7.0.bb
@@ -0,0 +1,67 @@
+SUMMARY = "Platform AbstRaction for SECurity Daemon"
+HOMEPAGE = "https://github.com/parallaxsecond/parsec"
+LICENSE = "Apache-2.0"
+
+inherit cargo
+
+SRC_URI += "crate://crates.io/parsec-service/${PV} \
+            file://parsec_init \
+            file://systemd.patch \
+            file://parsec-tmpfiles.conf \
+"
+
+DEPENDS = "tpm2-tss"
+TOOLCHAIN = "clang"
+
+CARGO_BUILD_FLAGS += " --features all-providers,cryptoki/generate-bindings,tss-esapi/generate-bindings"
+
+inherit systemd
+SYSTEMD_SERVICE_${PN} = "parsec.service"
+
+inherit update-rc.d
+INITSCRIPT_NAME = "parsec"
+
+# A local file can be defined in build/local.conf
+# The file should also be included into SRC_URI then
+PARSEC_CONFIG ?= "${S}/config.toml"
+
+do_install_append () {
+    # Binaries
+    install -d -m 700 -o parsec -g parsec "${D}${libexecdir}/parsec"
+    install -m 700 -o parsec -g parsec "${WORKDIR}/build/target/${CARGO_TARGET_SUBDIR}/parsec" ${D}${libexecdir}/parsec/parsec
+
+    # Config file
+    install -d -m 700 -o parsec -g parsec "${D}${sysconfdir}/parsec"
+    install -m 400 -o parsec -g parsec "${PARSEC_CONFIG}" ${D}${sysconfdir}/parsec/config.toml
+
+    # Data dir
+    install -d -m 700 -o parsec -g parsec "${D}${localstatedir}/lib/parsec"
+
+    if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
+        install -d ${D}${systemd_unitdir}/system
+        install -m 644 ${S}/systemd-daemon/parsec.service ${D}${systemd_unitdir}/system
+
+        install -d ${D}${libdir}/tmpfiles.d
+        install -m 644 ${WORKDIR}/parsec-tmpfiles.conf ${D}${libdir}/tmpfiles.d
+    fi
+
+    if ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'true', 'false', d)}; then
+        install -d ${D}${sysconfdir}/init.d
+        install -m 755 ${WORKDIR}/parsec_init ${D}${sysconfdir}/init.d/parsec
+    fi
+}
+
+inherit useradd
+USERADD_PACKAGES = "${PN}"
+USERADD_PARAM_${PN} = "-r -g parsec -s /bin/false -d ${localstatedir}/lib/parsec parsec"
+GROUPADD_PARAM_${PN} = "-r parsec"
+
+FILES_${PN} += " \
+    ${sysconfdir}/parsec/config.toml \
+    ${libexecdir}/parsec/parsec \
+    ${systemd_unitdir}/system/parsec.service \
+    ${libdir}/tmpfiles.d/parsec-tmpfiles.conf \
+    ${sysconfdir}/init.d/parsec \
+"
+
+require parsec-service_${PV}.inc
diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.7.0.inc b/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.7.0.inc
new file mode 100644
index 000000000..59a47f92a
--- /dev/null
+++ b/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.7.0.inc
@@ -0,0 +1,147 @@
+# This file is created from parsec-service repository Cargo.lock using cargo-bitbake tool
+
+SRC_URI += " \
+    crate://crates.io/aho-corasick/0.7.15 \
+    crate://crates.io/ansi_term/0.11.0 \
+    crate://crates.io/anyhow/1.0.38 \
+    crate://crates.io/atty/0.2.14 \
+    crate://crates.io/autocfg/1.0.1 \
+    crate://crates.io/base64/0.12.3 \
+    crate://crates.io/base64/0.13.0 \
+    crate://crates.io/bincode/1.3.2 \
+    crate://crates.io/bindgen/0.56.0 \
+    crate://crates.io/bindgen/0.57.0 \
+    crate://crates.io/bitfield/0.13.2 \
+    crate://crates.io/bitflags/1.2.1 \
+    crate://crates.io/byteorder/1.3.4 \
+    crate://crates.io/bytes/0.5.6 \
+    crate://crates.io/bytes/1.0.1 \
+    crate://crates.io/cc/1.0.67 \
+    crate://crates.io/cexpr/0.4.0 \
+    crate://crates.io/cfg-if/1.0.0 \
+    crate://crates.io/clang-sys/1.1.1 \
+    crate://crates.io/clap/2.33.3 \
+    crate://crates.io/cmake/0.1.45 \
+    crate://crates.io/cryptoauthlib-sys/0.1.0 \
+    crate://crates.io/cryptoki-sys/0.1.1 \
+    crate://crates.io/cryptoki/0.1.1 \
+    crate://crates.io/derivative/2.2.0 \
+    crate://crates.io/either/1.6.1 \
+    crate://crates.io/enumflags2/0.6.4 \
+    crate://crates.io/enumflags2_derive/0.6.4 \
+    crate://crates.io/env_logger/0.8.3 \
+    crate://crates.io/fixedbitset/0.2.0 \
+    crate://crates.io/getrandom/0.2.2 \
+    crate://crates.io/glob/0.3.0 \
+    crate://crates.io/hashbrown/0.9.1 \
+    crate://crates.io/heck/0.3.2 \
+    crate://crates.io/hermit-abi/0.1.18 \
+    crate://crates.io/hex/0.4.3 \
+    crate://crates.io/hostname-validator/1.0.0 \
+    crate://crates.io/humantime/2.1.0 \
+    crate://crates.io/indexmap/1.6.2 \
+    crate://crates.io/itertools/0.8.2 \
+    crate://crates.io/itertools/0.9.0 \
+    crate://crates.io/lazy_static/1.4.0 \
+    crate://crates.io/lazycell/1.3.0 \
+    crate://crates.io/libc/0.2.89 \
+    crate://crates.io/libloading/0.7.0 \
+    crate://crates.io/log/0.4.14 \
+    crate://crates.io/mbox/0.5.0 \
+    crate://crates.io/memchr/2.3.4 \
+    crate://crates.io/multimap/0.8.3 \
+    crate://crates.io/nom/5.1.2 \
+    crate://crates.io/num-bigint/0.3.2 \
+    crate://crates.io/num-complex/0.3.1 \
+    crate://crates.io/num-derive/0.3.3 \
+    crate://crates.io/num-integer/0.1.44 \
+    crate://crates.io/num-iter/0.1.42 \
+    crate://crates.io/num-rational/0.3.2 \
+    crate://crates.io/num-traits/0.2.14 \
+    crate://crates.io/num/0.3.1 \
+    crate://crates.io/num_cpus/1.13.0 \
+    crate://crates.io/oid/0.1.1 \
+    crate://crates.io/parsec-interface/0.24.0 \
+    crate://crates.io/peeking_take_while/0.1.2 \
+    crate://crates.io/petgraph/0.5.1 \
+    crate://crates.io/picky-asn1-der/0.2.4 \
+    crate://crates.io/picky-asn1-x509/0.4.0 \
+    crate://crates.io/picky-asn1/0.3.1 \
+    crate://crates.io/pkg-config/0.3.19 \
+    crate://crates.io/ppv-lite86/0.2.10 \
+    crate://crates.io/proc-macro-error-attr/1.0.4 \
+    crate://crates.io/proc-macro-error/1.0.4 \
+    crate://crates.io/proc-macro2/1.0.24 \
+    crate://crates.io/prost-build/0.6.1 \
+    crate://crates.io/prost-build/0.7.0 \
+    crate://crates.io/prost-derive/0.6.1 \
+    crate://crates.io/prost-derive/0.7.0 \
+    crate://crates.io/prost-types/0.6.1 \
+    crate://crates.io/prost-types/0.7.0 \
+    crate://crates.io/prost/0.6.1 \
+    crate://crates.io/prost/0.7.0 \
+    crate://crates.io/psa-crypto-sys/0.8.0 \
+    crate://crates.io/psa-crypto/0.8.0 \
+    crate://crates.io/quote/1.0.9 \
+    crate://crates.io/rand/0.8.3 \
+    crate://crates.io/rand_chacha/0.3.0 \
+    crate://crates.io/rand_core/0.6.2 \
+    crate://crates.io/rand_hc/0.3.0 \
+    crate://crates.io/redox_syscall/0.2.5 \
+    crate://crates.io/regex-syntax/0.6.23 \
+    crate://crates.io/regex/1.4.5 \
+    crate://crates.io/remove_dir_all/0.5.3 \
+    crate://crates.io/rust-cryptoauthlib/0.1.0 \
+    crate://crates.io/rustc-hash/1.1.0 \
+    crate://crates.io/rustc_version/0.2.3 \
+    crate://crates.io/same-file/1.0.6 \
+    crate://crates.io/sd-notify/0.2.0 \
+    crate://crates.io/secrecy/0.7.0 \
+    crate://crates.io/semver-parser/0.7.0 \
+    crate://crates.io/semver/0.9.0 \
+    crate://crates.io/serde/1.0.124 \
+    crate://crates.io/serde_bytes/0.11.5 \
+    crate://crates.io/serde_derive/1.0.124 \
+    crate://crates.io/shlex/0.1.1 \
+    crate://crates.io/signal-hook-registry/1.3.0 \
+    crate://crates.io/signal-hook/0.3.7 \
+    crate://crates.io/stable_deref_trait/1.2.0 \
+    crate://crates.io/strsim/0.8.0 \
+    crate://crates.io/structopt-derive/0.4.14 \
+    crate://crates.io/structopt/0.3.21 \
+    crate://crates.io/strum_macros/0.19.4 \
+    crate://crates.io/syn/1.0.64 \
+    crate://crates.io/synstructure/0.12.4 \
+    crate://crates.io/tempfile/3.2.0 \
+    crate://crates.io/termcolor/1.1.2 \
+    crate://crates.io/textwrap/0.11.0 \
+    crate://crates.io/thiserror-impl/1.0.24 \
+    crate://crates.io/thiserror/1.0.24 \
+    crate://crates.io/threadpool/1.8.1 \
+    crate://crates.io/toml/0.5.8 \
+    crate://crates.io/tss-esapi-sys/0.1.0 \
+    crate://crates.io/tss-esapi/5.0.0 \
+    crate://crates.io/unicode-segmentation/1.7.1 \
+    crate://crates.io/unicode-width/0.1.8 \
+    crate://crates.io/unicode-xid/0.2.1 \
+    crate://crates.io/users/0.11.0 \
+    crate://crates.io/uuid/0.8.2 \
+    crate://crates.io/vec_map/0.8.2 \
+    crate://crates.io/version/3.0.0 \
+    crate://crates.io/version_check/0.9.3 \
+    crate://crates.io/walkdir/2.3.1 \
+    crate://crates.io/wasi/0.10.2+wasi-snapshot-preview1 \
+    crate://crates.io/which/3.1.1 \
+    crate://crates.io/which/4.0.2 \
+    crate://crates.io/winapi-i686-pc-windows-gnu/0.4.0 \
+    crate://crates.io/winapi-util/0.1.5 \
+    crate://crates.io/winapi-x86_64-pc-windows-gnu/0.4.0 \
+    crate://crates.io/winapi/0.3.9 \
+    crate://crates.io/zeroize/1.2.0 \
+    crate://crates.io/zeroize_derive/1.0.1 \
+    file://cryptoki.patch \
+"
+
+LIC_FILES_CHKSUM = " \
+    file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57 \
+"