diff options
Diffstat (limited to 'import-layers/yocto-poky/meta/classes/cve-check.bbclass')
| -rw-r--r-- | import-layers/yocto-poky/meta/classes/cve-check.bbclass | 59 |
1 files changed, 30 insertions, 29 deletions
diff --git a/import-layers/yocto-poky/meta/classes/cve-check.bbclass b/import-layers/yocto-poky/meta/classes/cve-check.bbclass index 75b8fa9ab..13ec62ec9 100644 --- a/import-layers/yocto-poky/meta/classes/cve-check.bbclass +++ b/import-layers/yocto-poky/meta/classes/cve-check.bbclass @@ -22,7 +22,7 @@ # The product name that the CVE database uses. Defaults to BPN, but may need to # be overriden per recipe (for example tiff.bb sets CVE_PRODUCT=libtiff). -CVE_PRODUCT ?= "${BPN}" +CVE_PRODUCT ??= "${BPN}" CVE_CHECK_DB_DIR ?= "${DL_DIR}/CVE_CHECK" CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvd.db" @@ -51,7 +51,7 @@ python do_cve_check () { Check recipe for patched and unpatched CVEs """ - if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE", True)): + if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE")): patched_cves = get_patches_cves(d) patched, unpatched = check_cves(d, patched_cves) if patched or unpatched: @@ -62,7 +62,7 @@ python do_cve_check () { } addtask cve_check after do_unpack before do_build -do_cve_check[depends] = "cve-check-tool-native:do_populate_cve_db" +do_cve_check[depends] = "cve-check-tool-native:do_populate_sysroot cve-check-tool-native:do_populate_cve_db" do_cve_check[nostamp] = "1" python cve_check_cleanup () { @@ -70,7 +70,7 @@ python cve_check_cleanup () { Delete the file used to gather all the CVE information. """ - bb.utils.remove(e.data.getVar("CVE_CHECK_TMP_FILE", True)) + bb.utils.remove(e.data.getVar("CVE_CHECK_TMP_FILE")) } addhandler cve_check_cleanup @@ -83,12 +83,12 @@ python cve_check_write_rootfs_manifest () { import shutil - if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE", True)): + if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE")): bb.note("Writing rootfs CVE manifest") - deploy_dir = d.getVar("DEPLOY_DIR_IMAGE", True) - link_name = d.getVar("IMAGE_LINK_NAME", True) - manifest_name = d.getVar("CVE_CHECK_MANIFEST", True) - cve_tmp_file = d.getVar("CVE_CHECK_TMP_FILE", True) + deploy_dir = d.getVar("DEPLOY_DIR_IMAGE") + link_name = d.getVar("IMAGE_LINK_NAME") + manifest_name = d.getVar("CVE_CHECK_MANIFEST") + cve_tmp_file = d.getVar("CVE_CHECK_TMP_FILE") shutil.copyfile(cve_tmp_file, manifest_name) @@ -101,7 +101,7 @@ python cve_check_write_rootfs_manifest () { bb.plain("Image CVE report stored in: %s" % manifest_name) } -ROOTFS_POSTPROCESS_COMMAND_prepend = "${@'cve_check_write_rootfs_manifest; ' if d.getVar('CVE_CHECK_CREATE_MANIFEST', True) == '1' else ''}" +ROOTFS_POSTPROCESS_COMMAND_prepend = "${@'cve_check_write_rootfs_manifest; ' if d.getVar('CVE_CHECK_CREATE_MANIFEST') == '1' else ''}" def get_patches_cves(d): """ @@ -110,7 +110,7 @@ def get_patches_cves(d): import re - pn = d.getVar("PN", True) + pn = d.getVar("PN") cve_match = re.compile("CVE:( CVE\-\d{4}\-\d+)+") patched_cves = set() bb.debug(2, "Looking for patches that solves CVEs for %s" % pn) @@ -149,15 +149,15 @@ def check_cves(d, patched_cves): cves_patched = [] cves_unpatched = [] bpn = d.getVar("CVE_PRODUCT") - pv = d.getVar("PV", True).split("git+")[0] + pv = d.getVar("PV").split("git+")[0] cves = " ".join(patched_cves) - cve_db_dir = d.getVar("CVE_CHECK_DB_DIR", True) - cve_whitelist = ast.literal_eval(d.getVar("CVE_CHECK_CVE_WHITELIST", True)) + cve_db_dir = d.getVar("CVE_CHECK_DB_DIR") + cve_whitelist = ast.literal_eval(d.getVar("CVE_CHECK_CVE_WHITELIST")) cve_cmd = "cve-check-tool" cmd = [cve_cmd, "--no-html", "--csv", "--not-affected", "-t", "faux", "-d", cve_db_dir] # If the recipe has been whitlisted we return empty lists - if d.getVar("PN", True) in d.getVar("CVE_CHECK_PN_WHITELIST", True).split(): + if d.getVar("PN") in d.getVar("CVE_CHECK_PN_WHITELIST").split(): bb.note("Recipe has been whitelisted, skipping check") return ([], []) @@ -210,7 +210,7 @@ def get_cve_info(d, cves): from pysqlite2 import dbapi2 as sqlite3 cve_data = {} - db_file = d.getVar("CVE_CHECK_DB_FILE", True) + db_file = d.getVar("CVE_CHECK_DB_FILE") placeholder = ",".join("?" * len(cves)) query = "SELECT * FROM NVD WHERE id IN (%s)" % placeholder conn = sqlite3.connect(db_file) @@ -231,39 +231,40 @@ def cve_write_data(d, patched, unpatched, cve_data): CVE manifest if enabled. """ - cve_file = d.getVar("CVE_CHECK_LOCAL_FILE", True) + cve_file = d.getVar("CVE_CHECK_LOCAL_FILE") nvd_link = "https://web.nvd.nist.gov/view/vuln/detail?vulnId=" write_string = "" - first_alert = True - bb.utils.mkdirhier(d.getVar("CVE_CHECK_LOCAL_DIR", True)) + unpatched_cves = [] + bb.utils.mkdirhier(d.getVar("CVE_CHECK_LOCAL_DIR")) for cve in sorted(cve_data): - write_string += "PACKAGE NAME: %s\n" % d.getVar("PN", True) - write_string += "PACKAGE VERSION: %s\n" % d.getVar("PV", True) + write_string += "PACKAGE NAME: %s\n" % d.getVar("PN") + write_string += "PACKAGE VERSION: %s\n" % d.getVar("PV") write_string += "CVE: %s\n" % cve if cve in patched: write_string += "CVE STATUS: Patched\n" else: + unpatched_cves.append(cve) write_string += "CVE STATUS: Unpatched\n" - if first_alert: - bb.warn("Found unpatched CVE, for more information check %s" % cve_file) - first_alert = False write_string += "CVE SUMMARY: %s\n" % cve_data[cve]["summary"] write_string += "CVSS v2 BASE SCORE: %s\n" % cve_data[cve]["score"] write_string += "VECTOR: %s\n" % cve_data[cve]["vector"] write_string += "MORE INFORMATION: %s%s\n\n" % (nvd_link, cve) + if unpatched_cves: + bb.warn("Found unpatched CVE (%s), for more information check %s" % (" ".join(unpatched_cves),cve_file)) + with open(cve_file, "w") as f: bb.note("Writing file %s with CVE information" % cve_file) f.write(write_string) - if d.getVar("CVE_CHECK_COPY_FILES", True) == "1": - cve_dir = d.getVar("CVE_CHECK_DIR", True) + if d.getVar("CVE_CHECK_COPY_FILES") == "1": + cve_dir = d.getVar("CVE_CHECK_DIR") bb.utils.mkdirhier(cve_dir) - deploy_file = os.path.join(cve_dir, d.getVar("PN", True)) + deploy_file = os.path.join(cve_dir, d.getVar("PN")) with open(deploy_file, "w") as f: f.write(write_string) - if d.getVar("CVE_CHECK_CREATE_MANIFEST", True) == "1": - with open(d.getVar("CVE_CHECK_TMP_FILE", True), "a") as f: + if d.getVar("CVE_CHECK_CREATE_MANIFEST") == "1": + with open(d.getVar("CVE_CHECK_TMP_FILE"), "a") as f: f.write("%s" % write_string) |