diff options
author | Andrew Geissler <geissonator@yahoo.com> | 2020-05-15 22:16:47 +0300 |
---|---|---|
committer | Andrew Geissler <geissonator@yahoo.com> | 2020-05-21 23:43:47 +0300 |
commit | 1fe918a07084c878d72cf8a7d1707f6598cc438f (patch) | |
tree | 4c68407364bab78c848876a89613f8075f2954f9 /meta-security/recipes-core | |
parent | c182c62dd929fe69b57a12bc04099fcd09b5d436 (diff) | |
download | openbmc-1fe918a07084c878d72cf8a7d1707f6598cc438f.tar.xz |
meta-security: subtree update:b72cc7f87c..95fe86eb98
André Draszik (1):
linux-yocto: update the bbappend to 5.x
Armin Kuster (36):
README: add pull request option
sssd: drop py2 support
python3-fail2ban: update to latest
Apparmor: fix some runtime depends
linux-yocto-dev: remove "+"
checksecurity: fix runtime issues
buck-security: fix rdebends and minor style cleanup
swtpm: fix configure error
ecryptfs-utils: search nspr header files in ${STAGING_INCDIR}/nspr directory
bastille: convert to py3
tpm2-tools: update to 4.1.1
tpm2-tcti-uefi: fix build issue for i386 machine
tpm2-tss: update to 2.3.2
ibmswtpm2: update to 1563
python3-fail2ban: add 2-3 conversion changes
google-authenticator-libpam: install module in pam location
apparmor: update to tip
clamav: add bison-native to depend
meta-security-isafw: import layer from Intel
isafw: fix to work against master
layer.conf: add zeus
README.md: update to new maintainer
clamav-native: missed bison fix
secuirty*-image: remove dead var and minor cleanup
libtpm: fix build issue over pod2man
sssd: python2 not supported
libseccomp: update to 2.4.3
lynis: add missing rdepends
fail2ban: change hardcoded sysklogd to VIRTUAL-RUNTIME_base-utils-syslog
chkrootkit: add rootkit recipe
clamav: move to recipes-scanners
checksec: move to recipe-scanners
checksecurity: move to recipes-scanners
buck-security: move to recipes-scanners
arpwatch: add new recipe
buck-security: fix runtime issue with missing per module
Bartosz Golaszewski (3):
linux: drop the bbappend for linux v4.x series
classes: provide a class for generating dm-verity meta-data images
dm-verity: add a working example for BeagleBone Black
Haseeb Ashraf (1):
samhain: dnmalloc hash fix for aarch64 and mips64
Jan Luebbe (2):
apparmor: fix wrong executable permission on service file
apparmor: update to 2.13.4
Jonatan Pålsson (10):
README: Add meta-python to list of layer deps
sssd: Add PACKAGECONFIG for python2
sssd: Fix typo in PACKAGECONFIG. cyrpto -> crypto
sssd: DEPEND on nss if nothing else is chosen
sssd: Sort PACKAGECONFIG entries
sssd: Add autofs PACKAGECONFIG
sssd: Add sudo PACKAGECONFIG
sssd: Add missing files to SYSTEMD_SERVICE
sssd: Add missing DEPENDS on jansson
sssd: Add infopipe PACKAGECONFIG
Kai Kang (1):
sssd: fix for ldblibdir and systemd etc
Martin Jansa (1):
layer.conf: update LAYERSERIES_COMPAT for dunfell
Mingli Yu (1):
linux-yocto: update the bbappend to 5.x
Pierre-Jean Texier via Lists.Yoctoproject.Org (1):
google-authenticator-libpam: upgrade 1.07 -> 1.08
Yi Zhao (5):
samhain: fix build with new version attr
scap-security-guide: fix xml parsing error when build remediation files
scap-security-guide: pass the correct schema file path to openscap-native
openscap-daemon: add missing runtime dependencies
samhain-server: add volatile file for systemd
Change-Id: I3d4a4055cb9420e97d3eacf8436d9b048d34733f
Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Diffstat (limited to 'meta-security/recipes-core')
3 files changed, 85 insertions, 0 deletions
diff --git a/meta-security/recipes-core/images/dm-verity-image-initramfs.bb b/meta-security/recipes-core/images/dm-verity-image-initramfs.bb new file mode 100644 index 000000000..f9ea3762d --- /dev/null +++ b/meta-security/recipes-core/images/dm-verity-image-initramfs.bb @@ -0,0 +1,26 @@ +DESCRIPTION = "Simple initramfs image for mounting the rootfs over the verity device mapper." + +# We want a clean, minimal image. +IMAGE_FEATURES = "" + +PACKAGE_INSTALL = " \ + initramfs-dm-verity \ + base-files \ + busybox \ + util-linux-mount \ + udev \ + cryptsetup \ + lvm2-udevrules \ +" + +# Can we somehow inspect reverse dependencies to avoid these variables? +do_rootfs[depends] += "${DM_VERITY_IMAGE}:do_image_${DM_VERITY_IMAGE_TYPE}" + +IMAGE_FSTYPES = "${INITRAMFS_FSTYPES}" + +inherit core-image + +deploy_verity_hash() { + install -D -m 0644 ${DEPLOY_DIR_IMAGE}/${DM_VERITY_IMAGE}-${MACHINE}.${DM_VERITY_IMAGE_TYPE}.verity.env ${IMAGE_ROOTFS}/${datadir}/dm-verity.env +} +ROOTFS_POSTPROCESS_COMMAND += "deploy_verity_hash;" diff --git a/meta-security/recipes-core/initrdscripts/initramfs-dm-verity.bb b/meta-security/recipes-core/initrdscripts/initramfs-dm-verity.bb new file mode 100644 index 000000000..b61495655 --- /dev/null +++ b/meta-security/recipes-core/initrdscripts/initramfs-dm-verity.bb @@ -0,0 +1,13 @@ +SUMMARY = "Simple init script that uses devmapper to mount the rootfs in read-only mode protected by dm-verity" +LICENSE = "MIT" +LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420" + +SRC_URI = "file://init-dm-verity.sh" + +do_install() { + install -m 0755 ${WORKDIR}/init-dm-verity.sh ${D}/init + install -d ${D}/dev + mknod -m 622 ${D}/dev/console c 5 1 +} + +FILES_${PN} = "/init /dev/console" diff --git a/meta-security/recipes-core/initrdscripts/initramfs-dm-verity/init-dm-verity.sh b/meta-security/recipes-core/initrdscripts/initramfs-dm-verity/init-dm-verity.sh new file mode 100644 index 000000000..307d2c74b --- /dev/null +++ b/meta-security/recipes-core/initrdscripts/initramfs-dm-verity/init-dm-verity.sh @@ -0,0 +1,46 @@ +#!/bin/sh + +PATH=/sbin:/bin:/usr/sbin:/usr/bin +RDEV="" +ROOT_DIR="/new_root" + +mkdir -p /proc +mkdir -p /sys +mkdir -p /run +mkdir -p /tmp +mount -t proc proc /proc +mount -t sysfs sysfs /sys +mount -t devtmpfs none /dev + +udevd --daemon +udevadm trigger --type=subsystems --action=add +udevadm trigger --type=devices --action=add +udevadm settle --timeout=10 + +for PARAM in $(cat /proc/cmdline); do + case $PARAM in + root=*) + RDEV=${PARAM#root=} + ;; + esac +done + +if ! [ -b $RDEV ]; then + echo "Missing root command line argument!" + exit 1 +fi + +case $RDEV in + UUID=*) + RDEV=$(realpath /dev/disk/by-uuid/${RDEV#UUID=}) + ;; +esac + +. /usr/share/dm-verity.env + +echo "Mounting $RDEV over dm-verity as the root filesystem" + +veritysetup --data-block-size=1024 --hash-offset=$DATA_SIZE create rootfs $RDEV $RDEV $ROOT_HASH +mkdir -p $ROOT_DIR +mount -o ro /dev/mapper/rootfs $ROOT_DIR +exec switch_root $ROOT_DIR /sbin/init |