meta-security: subtree update:e8c9e69c80..d2ceb5e438

Armin Kuster (2):
      samhain: update to 4.4.2
      kas-security-base: Don't create local SSTATE mirror

Yi Zhao (3):
      suricata: unify volatiles file name
      clamav: unify volatiles file name
      scap-security-guide: fix build with Python 3.9

Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Change-Id: I60c6ba8c22593542165dbd1af0606e01f6473b33

4 files changed, 43 insertions, 53 deletions

diff --git a/meta-security/recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch b/meta-security/recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch
index 6bf67e09b..a84229e58 100644
--- a/meta-security/recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch
+++ b/meta-security/recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch
@@ -10,11 +10,11 @@ Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
  configure.ac | 101 +++--------------------------------------------------------
  1 file changed, 5 insertions(+), 96 deletions(-)
 
-diff --git a/configure.ac b/configure.ac
-index a224c68..f658d53 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -1278,90 +1278,11 @@ AC_ARG_WITH(database,
+Index: samhain-4.4.2/configure.ac
+===================================================================
+--- samhain-4.4.2.orig/configure.ac
++++ samhain-4.4.2/configure.ac
+@@ -1290,90 +1290,11 @@ AC_ARG_WITH(database,
            AC_DEFINE(WITH_POSTGRES)
            AC_DEFINE(WITH_DATABASE)
  	  #
@@ -110,7 +110,7 @@ index a224c68..f658d53 100644
  	    LIBS="$LIBS -L${PGSQL_LIB_DIR} -lpq -lm"
  	    if test x"$enable_static" = xyes; then
  	      LIBS="$LIBS -L${PGSQL_LIB_DIR} -lpq -lcrypt -lm"
-@@ -1370,18 +1291,6 @@ AC_ARG_WITH(database,
+@@ -1382,18 +1303,6 @@ AC_ARG_WITH(database,
  	    fi
  	    # CFLAGS="$CFLAGS -I${PGSQL_INC_DIR}"
  	    CPPFLAGS="$CPPFLAGS -I${PGSQL_INC_DIR}"
@@ -129,6 +129,3 @@ index a224c68..f658d53 100644
  	  fi
  	elif test "x${withval}" = "xodbc"; then
  	  AC_MSG_CHECKING(for odbc in /usr /usr/local ODBC_HOME)
--- 
-2.11.0
-
diff --git a/meta-security/recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch b/meta-security/recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch
index 8de0735fc..7e7f86e17 100644
--- a/meta-security/recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch
+++ b/meta-security/recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch
@@ -14,29 +14,14 @@ to avoid host contamination.
 Upstream-Status: Inappropriate [cross compile specific]
 
 Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
----
- aclocal.m4   |  2 +-
- configure.ac | 60 ++++++++++--------------------------------------------------
- 2 files changed, 11 insertions(+), 51 deletions(-)
+[AK: refactored for 4.4.3]
+Signed-off-by: Armin Kuster <akuster808@gmail.com>
 
-diff --git a/aclocal.m4 b/aclocal.m4
-index a2e59a6..cd20a2f 100644
---- a/aclocal.m4
-+++ b/aclocal.m4
-@@ -409,7 +409,7 @@ x_includes=NONE
- x_libraries=NONE
- DESTDIR=
- SH_ENABLE_OPTS="selinux posix-acl asm ssp db-reload xml-log message-queue login-watch process-check port-check mounts-check logfile-monitor userfiles debug ptrace static network udp nocl stealth micro-stealth install-name identity khide suidcheck base largefile mail external-scripts encrypt srp dnmalloc ipv6 shellexpand suid"
--SH_WITH_OPTS="prelude libprelude-prefix database libwrap cflags libs console altconsole timeserver alttimeserver rnd egd-socket port logserver altlogserver kcheck gpg keyid checksum fp recipient sender trusted tmp-dir config-file log-file pid-file state-dir data-file html-file"
-+SH_WITH_OPTS="prelude libprelude-prefix database libwrap cflags libs console altconsole timeserver alttimeserver rnd egd-socket port logserver altlogserver kcheck gpg keyid checksum fp recipient sender trusted tmp-dir config-file log-file pid-file state-dir data-file html-file ps-path"
- 
- # Installation directory options.
- # These are left unexpanded so users can "make install exec_prefix=/foo"
-diff --git a/configure.ac b/configure.ac
-index 5910b1f..8c3e087 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -730,56 +730,16 @@ then
+Index: samhain-4.4.2/configure.ac
+===================================================================
+--- samhain-4.4.2.orig/configure.ac
++++ samhain-4.4.2/configure.ac
+@@ -743,56 +743,16 @@ then
  fi
  AC_CHECK_HEADERS(gmp.h)
  
@@ -55,7 +40,16 @@ index 5910b1f..8c3e087 100644
 -	AC_MSG_ERROR([Cannot find ps in any of /usr/ucb /bin /usr/bin])
 -fi
 -AC_DEFINE_UNQUOTED([PSPATH], _("$PS"), [Path to ps])
--
++AC_ARG_WITH(ps-path,
++   [  --with-ps-path=PATH         set path to ps command ],
++   [
++   if test "x${withval}" != xno; then
++       pspath="${withval}"
++       AC_DEFINE_UNQUOTED([PSPATH], _("${pspath}"), [Path to ps])
++       AC_DEFINE_UNQUOTED([PSARG], _("ax"), [Argument for ps])
++   fi
++   ])
+ 
 -AC_MSG_CHECKING([how to use ps])
 -$PS ax >/dev/null 2>&1
 -if test $? -eq 0; then
@@ -90,19 +84,19 @@ index 5910b1f..8c3e087 100644
 -	PSARG="-e"
 -fi
 -AC_DEFINE_UNQUOTED([PSARG], _("$PSARG"), [Argument for ps])
-+AC_ARG_WITH(ps-path,
-+	[  --with-ps-path=PATH         set path to ps command ],
-+	[
-+	if test "x${withval}" != xno; then
-+		pspath="${withval}"
-+		AC_DEFINE_UNQUOTED([PSPATH], _("${pspath}"), [Path to ps])
-+		AC_DEFINE_UNQUOTED([PSARG], _("ax"), [Argument for ps])
-+	fi
-+	])
-+
  AC_MSG_RESULT([$PS $PSARG])
  
  dnl *****************************************
--- 
-1.9.1
-
+Index: samhain-4.4.2/aclocal.m4
+===================================================================
+--- samhain-4.4.2.orig/aclocal.m4
++++ samhain-4.4.2/aclocal.m4
+@@ -409,7 +409,7 @@ x_includes=NONE
+ x_libraries=NONE
+ DESTDIR=
+ SH_ENABLE_OPTS="selinux posix-acl asm ssp db-reload xml-log message-queue login-watch process-check port-check mounts-check logfile-monitor userfiles debug ptrace static network udp nocl stealth micro-stealth install-name identity khide suidcheck base largefile mail external-scripts encrypt srp dnmalloc ipv6 shellexpand suid"
+-SH_WITH_OPTS="prelude libprelude-prefix database libwrap cflags libs console altconsole timeserver alttimeserver rnd egd-socket port logserver altlogserver signify pubkey-checksum gpg keyid checksum fp recipient sender trusted tmp-dir config-file log-file pid-file state-dir data-file html-file"
++SH_WITH_OPTS="prelude libprelude-prefix database libwrap cflags libs console altconsole timeserver alttimeserver rnd egd-socket port logserver altlogserver kcheck gpg keyid checksum fp recipient sender trusted tmp-dir config-file log-file pid-file state-dir data-file html-file ps-path"
+ 
+ # Installation directory options.
+ # These are left unexpanded so users can "make install exec_prefix=/foo"
diff --git a/meta-security/recipes-ids/samhain/samhain.inc b/meta-security/recipes-ids/samhain/samhain.inc
index b867bbc43..3b4aab931 100644
--- a/meta-security/recipes-ids/samhain/samhain.inc
+++ b/meta-security/recipes-ids/samhain/samhain.inc
@@ -3,9 +3,12 @@ HOMEPAGE    = "http://www.la-samhna.de/samhain/"
 LICENSE     = "GPLv2"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=8ca43cbc842c2336e835926c2166c28b"
 
-PV = "4.3.3"
+PV = "4.4.2"
 
-SRC_URI = "http://la-samhna.de/archive/samhain_signed-${PV}.tar.gz \
+SRC_URI = "https://la-samhna.de/archive/samhain_signed-${PV}.tar.gz \
+           file://${INITSCRIPT_NAME}.init \
+           file://${INITSCRIPT_NAME}.default \
+           file://samhain.service \
            file://samhain-mips64-aarch64-dnmalloc-hash-fix.patch \
            file://samhain-samhainrc.patch \
            file://samhain-samhainrc-fix-files-dirs-path.patch \
@@ -15,13 +18,9 @@ SRC_URI = "http://la-samhna.de/archive/samhain_signed-${PV}.tar.gz \
            file://samhain-avoid-searching-host-for-postgresql.patch \
            file://samhain-add-LDFLAGS-variable-for-samhain_setpwd.patch \
            file://fix-build-with-new-version-attr.patch \
-           file://${INITSCRIPT_NAME}.init \
-           file://${INITSCRIPT_NAME}.default \
-           file://samhain.service \
            "
 
-SRC_URI[md5sum] = "7be46ae7d03f53ba21afafd41cff8926"
-SRC_URI[sha256sum] = "33ad4bc3dad4699694553bd9635a6b5827939f965d1f0f05fce0b4e9cdadf21b"
+SRC_URI[sha256sum] = "2bb2750b32646be32517d0b2259402559c72b96979800f6c33774fcdea327fff"
 
 UPSTREAM_CHECK_URI = "https://www.la-samhna.de/samhain/archive.html"
 UPSTREAM_CHECK_REGEX = "samhain_signed-(?P<pver>(\d+(\.\d+)+))\.tar"
diff --git a/meta-security/recipes-ids/suricata/suricata_4.1.9.bb b/meta-security/recipes-ids/suricata/suricata_4.1.9.bb
index 135871cc7..3f7beaacf 100644
--- a/meta-security/recipes-ids/suricata/suricata_4.1.9.bb
+++ b/meta-security/recipes-ids/suricata/suricata_4.1.9.bb
@@ -55,7 +55,7 @@ do_install_append () {
     oe_runmake install-rules DESTDIR=${D}
 
     install -d ${D}${sysconfdir}/suricata ${D}${sysconfdir}/default/volatiles
-    install -m 0644 ${WORKDIR}/volatiles.03_suricata  ${D}${sysconfdir}/default/volatiles/volatiles.03_suricata
+    install -m 0644 ${WORKDIR}/volatiles.03_suricata  ${D}${sysconfdir}/default/volatiles/03_suricata
 
     install -m 0644 ${S}/threshold.config ${D}${sysconfdir}/suricata