From 1fe918a07084c878d72cf8a7d1707f6598cc438f Mon Sep 17 00:00:00 2001 From: Andrew Geissler Date: Fri, 15 May 2020 14:16:47 -0500 Subject: meta-security: subtree update:b72cc7f87c..95fe86eb98 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit André Draszik (1): linux-yocto: update the bbappend to 5.x Armin Kuster (36): README: add pull request option sssd: drop py2 support python3-fail2ban: update to latest Apparmor: fix some runtime depends linux-yocto-dev: remove "+" checksecurity: fix runtime issues buck-security: fix rdebends and minor style cleanup swtpm: fix configure error ecryptfs-utils: search nspr header files in ${STAGING_INCDIR}/nspr directory bastille: convert to py3 tpm2-tools: update to 4.1.1 tpm2-tcti-uefi: fix build issue for i386 machine tpm2-tss: update to 2.3.2 ibmswtpm2: update to 1563 python3-fail2ban: add 2-3 conversion changes google-authenticator-libpam: install module in pam location apparmor: update to tip clamav: add bison-native to depend meta-security-isafw: import layer from Intel isafw: fix to work against master layer.conf: add zeus README.md: update to new maintainer clamav-native: missed bison fix secuirty*-image: remove dead var and minor cleanup libtpm: fix build issue over pod2man sssd: python2 not supported libseccomp: update to 2.4.3 lynis: add missing rdepends fail2ban: change hardcoded sysklogd to VIRTUAL-RUNTIME_base-utils-syslog chkrootkit: add rootkit recipe clamav: move to recipes-scanners checksec: move to recipe-scanners checksecurity: move to recipes-scanners buck-security: move to recipes-scanners arpwatch: add new recipe buck-security: fix runtime issue with missing per module Bartosz Golaszewski (3): linux: drop the bbappend for linux v4.x series classes: provide a class for generating dm-verity meta-data images dm-verity: add a working example for BeagleBone Black Haseeb Ashraf (1): samhain: dnmalloc hash fix for aarch64 and mips64 Jan Luebbe (2): apparmor: fix wrong executable permission on service file apparmor: update to 2.13.4 Jonatan Pålsson (10): README: Add meta-python to list of layer deps sssd: Add PACKAGECONFIG for python2 sssd: Fix typo in PACKAGECONFIG. cyrpto -> crypto sssd: DEPEND on nss if nothing else is chosen sssd: Sort PACKAGECONFIG entries sssd: Add autofs PACKAGECONFIG sssd: Add sudo PACKAGECONFIG sssd: Add missing files to SYSTEMD_SERVICE sssd: Add missing DEPENDS on jansson sssd: Add infopipe PACKAGECONFIG Kai Kang (1): sssd: fix for ldblibdir and systemd etc Martin Jansa (1): layer.conf: update LAYERSERIES_COMPAT for dunfell Mingli Yu (1): linux-yocto: update the bbappend to 5.x Pierre-Jean Texier via Lists.Yoctoproject.Org (1): google-authenticator-libpam: upgrade 1.07 -> 1.08 Yi Zhao (5): samhain: fix build with new version attr scap-security-guide: fix xml parsing error when build remediation files scap-security-guide: pass the correct schema file path to openscap-native openscap-daemon: add missing runtime dependencies samhain-server: add volatile file for systemd Change-Id: I3d4a4055cb9420e97d3eacf8436d9b048d34733f Signed-off-by: Andrew Geissler --- meta-security/classes/dm-verity-img.bbclass | 88 +++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) create mode 100644 meta-security/classes/dm-verity-img.bbclass (limited to 'meta-security/classes/dm-verity-img.bbclass') diff --git a/meta-security/classes/dm-verity-img.bbclass b/meta-security/classes/dm-verity-img.bbclass new file mode 100644 index 000000000..1c0e29b6e --- /dev/null +++ b/meta-security/classes/dm-verity-img.bbclass @@ -0,0 +1,88 @@ +# SPDX-License-Identifier: MIT +# +# Copyright (C) 2020 BayLibre SAS +# Author: Bartosz Golaszewski +# +# This bbclass allows creating of dm-verity protected partition images. It +# generates a device image file with dm-verity hash data appended at the end +# plus the corresponding .env file containing additional information needed +# to mount the image such as the root hash in the form of ell variables. To +# assure data integrity, the root hash must be stored in a trusted location +# or cryptographically signed and verified. +# +# Usage: +# DM_VERITY_IMAGE = "core-image-full-cmdline" # or other image +# DM_VERITY_IMAGE_TYPE = "ext4" # or ext2, ext3 & btrfs +# IMAGE_CLASSES += "dm-verity-img" +# +# The resulting image can then be used to implement the device mapper block +# integrity checking on the target device. + +# Process the output from veritysetup and generate the corresponding .env +# file. The output from veritysetup is not very machine-friendly so we need to +# convert it to some better format. Let's drop the first line (doesn't contain +# any useful info) and feed the rest to a script. +process_verity() { + local ENV="$OUTPUT.env" + + # Each line contains a key and a value string delimited by ':'. Read the + # two parts into separate variables and process them separately. For the + # key part: convert the names to upper case and replace spaces with + # underscores to create correct shell variable names. For the value part: + # just trim all white-spaces. + IFS=":" + while read KEY VAL; do + echo -ne "$KEY" | tr '[:lower:]' '[:upper:]' | sed 's/ /_/g' >> $ENV + echo -ne "=" >> $ENV + echo "$VAL" | tr -d " \t" >> $ENV + done + + # Add partition size + echo "DATA_SIZE=$SIZE" >> $ENV + + ln -sf $ENV ${IMAGE_BASENAME}-${MACHINE}.$TYPE.verity.env +} + +verity_setup() { + local TYPE=$1 + local INPUT=${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.$TYPE + local SIZE=$(stat --printf="%s" $INPUT) + local OUTPUT=$INPUT.verity + + cp -a $INPUT $OUTPUT + + # Let's drop the first line of output (doesn't contain any useful info) + # and feed the rest to another function. + veritysetup --data-block-size=1024 --hash-offset=$SIZE format $OUTPUT $OUTPUT | tail -n +2 | process_verity +} + +VERITY_TYPES = "ext2.verity ext3.verity ext4.verity btrfs.verity" +IMAGE_TYPES += "${VERITY_TYPES}" +CONVERSIONTYPES += "verity" +CONVERSION_CMD_verity = "verity_setup ${type}" +CONVERSION_DEPENDS_verity = "cryptsetup-native" + +python __anonymous() { + verity_image = d.getVar('DM_VERITY_IMAGE') + verity_type = d.getVar('DM_VERITY_IMAGE_TYPE') + image_fstypes = d.getVar('IMAGE_FSTYPES') + pn = d.getVar('PN') + + if verity_image != pn: + return # This doesn't concern this image + + if not verity_image or not verity_type: + bb.warn('dm-verity-img class inherited but not used') + return + + if len(verity_type.split()) is not 1: + bb.fatal('DM_VERITY_IMAGE_TYPE must contain exactly one type') + + d.appendVar('IMAGE_FSTYPES', ' %s.verity' % verity_type) + + # If we're using wic: we'll have to use partition images and not the rootfs + # source plugin so add the appropriate dependency. + if 'wic' in image_fstypes: + dep = ' %s:do_image_%s' % (pn, verity_type) + d.appendVarFlag('do_image_wic', 'depends', dep) +} -- cgit v1.2.3