From f31b8bdb5991e0570aeaf04a9bc50f41d55bccbe Mon Sep 17 00:00:00 2001 From: Andrew Geissler Date: Mon, 30 Nov 2020 19:54:56 -0600 Subject: meta-security: subtree update:e8c9e69c80..d2ceb5e438 Armin Kuster (2): samhain: update to 4.4.2 kas-security-base: Don't create local SSTATE mirror Yi Zhao (3): suricata: unify volatiles file name clamav: unify volatiles file name scap-security-guide: fix build with Python 3.9 Signed-off-by: Andrew Geissler Change-Id: I60c6ba8c22593542165dbd1af0606e01f6473b33 --- meta-security/kas/kas-security-base.yml | 1 - ...eprecated-instance-of-element.getchildren.patch | 43 ++++++++++++++ .../0002-fix-deprecated-getiterator-function.patch | 58 +++++++++++++++++++ ...ing-getchildren-and-getiterator-functions.patch | 57 +++++++++++++++++++ .../scap-security-guide/scap-security-guide_git.bb | 3 + ...mhain-avoid-searching-host-for-postgresql.patch | 15 ++--- .../samhain-configure-add-option-for-ps.patch | 66 ++++++++++------------ meta-security/recipes-ids/samhain/samhain.inc | 13 ++--- .../recipes-ids/suricata/suricata_4.1.9.bb | 2 +- .../recipes-scanners/clamav/clamav_0.101.5.bb | 2 +- 10 files changed, 205 insertions(+), 55 deletions(-) create mode 100644 meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-fix-deprecated-instance-of-element.getchildren.patch create mode 100644 meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-fix-deprecated-getiterator-function.patch create mode 100644 meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0003-fix-remaining-getchildren-and-getiterator-functions.patch (limited to 'meta-security') diff --git a/meta-security/kas/kas-security-base.yml b/meta-security/kas/kas-security-base.yml index ba0e0f81f..94188c8c0 100644 --- a/meta-security/kas/kas-security-base.yml +++ b/meta-security/kas/kas-security-base.yml @@ -34,7 +34,6 @@ local_conf_header: CONF_VERSION = "1" SOURCE_MIRROR_URL = "http://downloads.yoctoproject.org/mirror/sources/" SSTATE_MIRRORS = "file://.* http://sstate.yoctoproject.org/dev/PATH;downloadfilename=PATH \n" - SSTATE_DIR = "/home/srv/sstate/master" DL_DIR = "/home/srv/downloads/master" BB_HASHSERVE = "auto" BB_SIGNATURE_HANDLER = "OEEquivHash" diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-fix-deprecated-instance-of-element.getchildren.patch b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-fix-deprecated-instance-of-element.getchildren.patch new file mode 100644 index 000000000..01e3dd687 --- /dev/null +++ b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0001-fix-deprecated-instance-of-element.getchildren.patch @@ -0,0 +1,43 @@ +From e435bf2dc59d652710104a1c59332e410b12bb64 Mon Sep 17 00:00:00 2001 +From: Vojtech Polasek +Date: Mon, 8 Jun 2020 12:33:48 +0200 +Subject: [PATCH] fix deprecated instance of element.getchildren + +Upstream-Status: Backport +[https://github.com/ComplianceAsCode/content/commit/e435bf2dc59d652710104a1c59332e410b12bb64] + +Signed-off-by: Yi Zhao +--- + ssg/build_remediations.py | 2 +- + ssg/build_stig.py | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/ssg/build_remediations.py b/ssg/build_remediations.py +index fdde0f268..c18d6bd54 100644 +--- a/ssg/build_remediations.py ++++ b/ssg/build_remediations.py +@@ -735,7 +735,7 @@ def expand_xccdf_subs(fix, remediation_type, remediation_functions): + # First concat output form of modified fix text (including text appended + # to all children of the fix) + modfix = [fix.text] +- for child in fix.getchildren(): ++ for child in list(fix): + if child is not None and child.text is not None: + modfix.append(child.text) + modfixtext = "".join(modfix) +diff --git a/ssg/build_stig.py b/ssg/build_stig.py +index 528285f3d..6122981fc 100644 +--- a/ssg/build_stig.py ++++ b/ssg/build_stig.py +@@ -38,7 +38,7 @@ def add_references(reference, destination): + for ref in refs: + if (ref.get('href').startswith(stig_refs) and + ref.text in dictionary): +- index = rule.getchildren().index(ref) ++ index = list(rule).index(ref) + new_ref = ET.Element( + '{%s}reference' % XCCDF11_NS, {'href': stig_ns}) + new_ref.text = dictionary[ref.text] +-- +2.17.1 + diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-fix-deprecated-getiterator-function.patch b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-fix-deprecated-getiterator-function.patch new file mode 100644 index 000000000..84271c4c9 --- /dev/null +++ b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0002-fix-deprecated-getiterator-function.patch @@ -0,0 +1,58 @@ +From b0adc1d53780def4a95e310b6d26bb91ee97177e Mon Sep 17 00:00:00 2001 +From: Vojtech Polasek +Date: Mon, 8 Jun 2020 13:27:41 +0200 +Subject: [PATCH] fix deprecated getiterator function + +Upstream-Status: Backport +[https://github.com/ComplianceAsCode/content/commit/b0adc1d53780def4a95e310b6d26bb91ee97177e] + +Signed-off-by: Yi Zhao +--- + ssg/build_cpe.py | 6 +++--- + ssg/id_translate.py | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/ssg/build_cpe.py b/ssg/build_cpe.py +index 2e5d24a5d..8c046777a 100644 +--- a/ssg/build_cpe.py ++++ b/ssg/build_cpe.py +@@ -17,7 +17,7 @@ def extract_subelement(objects, sub_elem_type): + """ + + for obj in objects: +- for subelement in obj.getiterator(): ++ for subelement in obj.iter(): + if subelement.get(sub_elem_type): + sub_element = subelement.get(sub_elem_type) + return sub_element +@@ -44,12 +44,12 @@ def extract_referred_nodes(tree_with_refs, tree_with_ids, attrname): + reflist = [] + elementlist = [] + +- for element in tree_with_refs.getiterator(): ++ for element in tree_with_refs.iter(): + value = element.get(attrname) + if value is not None: + reflist.append(value) + +- for element in tree_with_ids.getiterator(): ++ for element in tree_with_ids.iter(): + if element.get("id") in reflist: + elementlist.append(element) + +diff --git a/ssg/id_translate.py b/ssg/id_translate.py +index 72b07be18..ba9225904 100644 +--- a/ssg/id_translate.py ++++ b/ssg/id_translate.py +@@ -64,7 +64,7 @@ class IDTranslator(object): + ) + + def translate(self, tree, store_defname=False): +- for element in tree.getiterator(): ++ for element in tree.iter(): + idname = element.get("id") + if idname: + # store the old name if requested (for OVAL definitions) +-- +2.17.1 + diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0003-fix-remaining-getchildren-and-getiterator-functions.patch b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0003-fix-remaining-getchildren-and-getiterator-functions.patch new file mode 100644 index 000000000..8162292cd --- /dev/null +++ b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/files/0003-fix-remaining-getchildren-and-getiterator-functions.patch @@ -0,0 +1,57 @@ +From a0da16c5eeb9a7414f7f2a37a6b270c8d04b2ddf Mon Sep 17 00:00:00 2001 +From: Vojtech Polasek +Date: Mon, 8 Jun 2020 14:01:55 +0200 +Subject: [PATCH] fix remaining getchildren and getiterator functions + +Upstream-Status: Backport +[https://github.com/ComplianceAsCode/content/commit/a0da16c5eeb9a7414f7f2a37a6b270c8d04b2ddf] + +Signed-off-by: Yi Zhao +--- + build-scripts/sds_move_ocil_to_checks.py | 2 +- + build-scripts/verify_references.py | 2 +- + shared/transforms/pcidss/transform_benchmark_to_pcidss.py | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/build-scripts/sds_move_ocil_to_checks.py b/build-scripts/sds_move_ocil_to_checks.py +index 5f5139659..64dc19084 100755 +--- a/build-scripts/sds_move_ocil_to_checks.py ++++ b/build-scripts/sds_move_ocil_to_checks.py +@@ -106,7 +106,7 @@ def move_ocil_content_from_ds_extended_component_to_ds_component(datastreamtree, + timestamp = extendedcomp.get('timestamp') + + # Get children elements of containing OCIL content +- extchildren = extendedcomp.getchildren() ++ extchildren = list(extendedcomp) + # There should be just one OCIL subcomponent in + if len(extchildren) != 1: + sys.stderr.write("ds:extended-component contains more than one element!" +diff --git a/build-scripts/verify_references.py b/build-scripts/verify_references.py +index 69b3e2d1f..95d387f46 100755 +--- a/build-scripts/verify_references.py ++++ b/build-scripts/verify_references.py +@@ -179,7 +179,7 @@ def main(): + check_content_refs = xccdftree.findall(".//{%s}check-content-ref" + % xccdf_ns) + +- xccdf_parent_map = dict((c, p) for p in xccdftree.getiterator() for c in p) ++ xccdf_parent_map = dict((c, p) for p in xccdftree.iter() for c in p) + # now we can actually do the verification work here + if options.rules_with_invalid_checks or options.all_checks: + for check_content_ref in check_content_refs: +diff --git a/shared/transforms/pcidss/transform_benchmark_to_pcidss.py b/shared/transforms/pcidss/transform_benchmark_to_pcidss.py +index 0ceaf727d..c94b12c45 100755 +--- a/shared/transforms/pcidss/transform_benchmark_to_pcidss.py ++++ b/shared/transforms/pcidss/transform_benchmark_to_pcidss.py +@@ -111,7 +111,7 @@ def main(): + benchmark.findall(".//{%s}Value" % (XCCDF_NAMESPACE)): + values.append(value) + +- parent_map = dict((c, p) for p in benchmark.getiterator() for c in p) ++ parent_map = dict((c, p) for p in benchmark.iter() for c in p) + for rule in \ + benchmark.findall(".//{%s}Rule" % (XCCDF_NAMESPACE)): + parent_map[rule].remove(rule) +-- +2.17.1 + diff --git a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb index f35d7691b..6e7180f55 100644 --- a/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb +++ b/meta-security/meta-security-compliance/recipes-openscap/scap-security-guide/scap-security-guide_git.bb @@ -4,6 +4,9 @@ SRCREV = "5fdfdcb2e95afbd86ace555beca5d20cbf1043ed" SRC_URI = "git://github.com/akuster/scap-security-guide.git;branch=oe-0.1.44; \ file://0001-Fix-XML-parsing-of-the-remediation-functions-file.patch \ file://0002-Fixed-the-broken-fix-when-greedy-regex-ate-the-whole.patch \ + file://0001-fix-deprecated-instance-of-element.getchildren.patch \ + file://0002-fix-deprecated-getiterator-function.patch \ + file://0003-fix-remaining-getchildren-and-getiterator-functions.patch \ " PV = "0.1.44+git${SRCPV}" diff --git a/meta-security/recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch b/meta-security/recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch index 6bf67e09b..a84229e58 100644 --- a/meta-security/recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch +++ b/meta-security/recipes-ids/samhain/files/samhain-avoid-searching-host-for-postgresql.patch @@ -10,11 +10,11 @@ Signed-off-by: Jackie Huang configure.ac | 101 +++-------------------------------------------------------- 1 file changed, 5 insertions(+), 96 deletions(-) -diff --git a/configure.ac b/configure.ac -index a224c68..f658d53 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -1278,90 +1278,11 @@ AC_ARG_WITH(database, +Index: samhain-4.4.2/configure.ac +=================================================================== +--- samhain-4.4.2.orig/configure.ac ++++ samhain-4.4.2/configure.ac +@@ -1290,90 +1290,11 @@ AC_ARG_WITH(database, AC_DEFINE(WITH_POSTGRES) AC_DEFINE(WITH_DATABASE) # @@ -110,7 +110,7 @@ index a224c68..f658d53 100644 LIBS="$LIBS -L${PGSQL_LIB_DIR} -lpq -lm" if test x"$enable_static" = xyes; then LIBS="$LIBS -L${PGSQL_LIB_DIR} -lpq -lcrypt -lm" -@@ -1370,18 +1291,6 @@ AC_ARG_WITH(database, +@@ -1382,18 +1303,6 @@ AC_ARG_WITH(database, fi # CFLAGS="$CFLAGS -I${PGSQL_INC_DIR}" CPPFLAGS="$CPPFLAGS -I${PGSQL_INC_DIR}" @@ -129,6 +129,3 @@ index a224c68..f658d53 100644 fi elif test "x${withval}" = "xodbc"; then AC_MSG_CHECKING(for odbc in /usr /usr/local ODBC_HOME) --- -2.11.0 - diff --git a/meta-security/recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch b/meta-security/recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch index 8de0735fc..7e7f86e17 100644 --- a/meta-security/recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch +++ b/meta-security/recipes-ids/samhain/files/samhain-configure-add-option-for-ps.patch @@ -14,29 +14,14 @@ to avoid host contamination. Upstream-Status: Inappropriate [cross compile specific] Signed-off-by: Jackie Huang ---- - aclocal.m4 | 2 +- - configure.ac | 60 ++++++++++-------------------------------------------------- - 2 files changed, 11 insertions(+), 51 deletions(-) +[AK: refactored for 4.4.3] +Signed-off-by: Armin Kuster -diff --git a/aclocal.m4 b/aclocal.m4 -index a2e59a6..cd20a2f 100644 ---- a/aclocal.m4 -+++ b/aclocal.m4 -@@ -409,7 +409,7 @@ x_includes=NONE - x_libraries=NONE - DESTDIR= - SH_ENABLE_OPTS="selinux posix-acl asm ssp db-reload xml-log message-queue login-watch process-check port-check mounts-check logfile-monitor userfiles debug ptrace static network udp nocl stealth micro-stealth install-name identity khide suidcheck base largefile mail external-scripts encrypt srp dnmalloc ipv6 shellexpand suid" --SH_WITH_OPTS="prelude libprelude-prefix database libwrap cflags libs console altconsole timeserver alttimeserver rnd egd-socket port logserver altlogserver kcheck gpg keyid checksum fp recipient sender trusted tmp-dir config-file log-file pid-file state-dir data-file html-file" -+SH_WITH_OPTS="prelude libprelude-prefix database libwrap cflags libs console altconsole timeserver alttimeserver rnd egd-socket port logserver altlogserver kcheck gpg keyid checksum fp recipient sender trusted tmp-dir config-file log-file pid-file state-dir data-file html-file ps-path" - - # Installation directory options. - # These are left unexpanded so users can "make install exec_prefix=/foo" -diff --git a/configure.ac b/configure.ac -index 5910b1f..8c3e087 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -730,56 +730,16 @@ then +Index: samhain-4.4.2/configure.ac +=================================================================== +--- samhain-4.4.2.orig/configure.ac ++++ samhain-4.4.2/configure.ac +@@ -743,56 +743,16 @@ then fi AC_CHECK_HEADERS(gmp.h) @@ -55,7 +40,16 @@ index 5910b1f..8c3e087 100644 - AC_MSG_ERROR([Cannot find ps in any of /usr/ucb /bin /usr/bin]) -fi -AC_DEFINE_UNQUOTED([PSPATH], _("$PS"), [Path to ps]) -- ++AC_ARG_WITH(ps-path, ++ [ --with-ps-path=PATH set path to ps command ], ++ [ ++ if test "x${withval}" != xno; then ++ pspath="${withval}" ++ AC_DEFINE_UNQUOTED([PSPATH], _("${pspath}"), [Path to ps]) ++ AC_DEFINE_UNQUOTED([PSARG], _("ax"), [Argument for ps]) ++ fi ++ ]) + -AC_MSG_CHECKING([how to use ps]) -$PS ax >/dev/null 2>&1 -if test $? -eq 0; then @@ -90,19 +84,19 @@ index 5910b1f..8c3e087 100644 - PSARG="-e" -fi -AC_DEFINE_UNQUOTED([PSARG], _("$PSARG"), [Argument for ps]) -+AC_ARG_WITH(ps-path, -+ [ --with-ps-path=PATH set path to ps command ], -+ [ -+ if test "x${withval}" != xno; then -+ pspath="${withval}" -+ AC_DEFINE_UNQUOTED([PSPATH], _("${pspath}"), [Path to ps]) -+ AC_DEFINE_UNQUOTED([PSARG], _("ax"), [Argument for ps]) -+ fi -+ ]) -+ AC_MSG_RESULT([$PS $PSARG]) dnl ***************************************** --- -1.9.1 - +Index: samhain-4.4.2/aclocal.m4 +=================================================================== +--- samhain-4.4.2.orig/aclocal.m4 ++++ samhain-4.4.2/aclocal.m4 +@@ -409,7 +409,7 @@ x_includes=NONE + x_libraries=NONE + DESTDIR= + SH_ENABLE_OPTS="selinux posix-acl asm ssp db-reload xml-log message-queue login-watch process-check port-check mounts-check logfile-monitor userfiles debug ptrace static network udp nocl stealth micro-stealth install-name identity khide suidcheck base largefile mail external-scripts encrypt srp dnmalloc ipv6 shellexpand suid" +-SH_WITH_OPTS="prelude libprelude-prefix database libwrap cflags libs console altconsole timeserver alttimeserver rnd egd-socket port logserver altlogserver signify pubkey-checksum gpg keyid checksum fp recipient sender trusted tmp-dir config-file log-file pid-file state-dir data-file html-file" ++SH_WITH_OPTS="prelude libprelude-prefix database libwrap cflags libs console altconsole timeserver alttimeserver rnd egd-socket port logserver altlogserver kcheck gpg keyid checksum fp recipient sender trusted tmp-dir config-file log-file pid-file state-dir data-file html-file ps-path" + + # Installation directory options. + # These are left unexpanded so users can "make install exec_prefix=/foo" diff --git a/meta-security/recipes-ids/samhain/samhain.inc b/meta-security/recipes-ids/samhain/samhain.inc index b867bbc43..3b4aab931 100644 --- a/meta-security/recipes-ids/samhain/samhain.inc +++ b/meta-security/recipes-ids/samhain/samhain.inc @@ -3,9 +3,12 @@ HOMEPAGE = "http://www.la-samhna.de/samhain/" LICENSE = "GPLv2" LIC_FILES_CHKSUM = "file://LICENSE;md5=8ca43cbc842c2336e835926c2166c28b" -PV = "4.3.3" +PV = "4.4.2" -SRC_URI = "http://la-samhna.de/archive/samhain_signed-${PV}.tar.gz \ +SRC_URI = "https://la-samhna.de/archive/samhain_signed-${PV}.tar.gz \ + file://${INITSCRIPT_NAME}.init \ + file://${INITSCRIPT_NAME}.default \ + file://samhain.service \ file://samhain-mips64-aarch64-dnmalloc-hash-fix.patch \ file://samhain-samhainrc.patch \ file://samhain-samhainrc-fix-files-dirs-path.patch \ @@ -15,13 +18,9 @@ SRC_URI = "http://la-samhna.de/archive/samhain_signed-${PV}.tar.gz \ file://samhain-avoid-searching-host-for-postgresql.patch \ file://samhain-add-LDFLAGS-variable-for-samhain_setpwd.patch \ file://fix-build-with-new-version-attr.patch \ - file://${INITSCRIPT_NAME}.init \ - file://${INITSCRIPT_NAME}.default \ - file://samhain.service \ " -SRC_URI[md5sum] = "7be46ae7d03f53ba21afafd41cff8926" -SRC_URI[sha256sum] = "33ad4bc3dad4699694553bd9635a6b5827939f965d1f0f05fce0b4e9cdadf21b" +SRC_URI[sha256sum] = "2bb2750b32646be32517d0b2259402559c72b96979800f6c33774fcdea327fff" UPSTREAM_CHECK_URI = "https://www.la-samhna.de/samhain/archive.html" UPSTREAM_CHECK_REGEX = "samhain_signed-(?P(\d+(\.\d+)+))\.tar" diff --git a/meta-security/recipes-ids/suricata/suricata_4.1.9.bb b/meta-security/recipes-ids/suricata/suricata_4.1.9.bb index 135871cc7..3f7beaacf 100644 --- a/meta-security/recipes-ids/suricata/suricata_4.1.9.bb +++ b/meta-security/recipes-ids/suricata/suricata_4.1.9.bb @@ -55,7 +55,7 @@ do_install_append () { oe_runmake install-rules DESTDIR=${D} install -d ${D}${sysconfdir}/suricata ${D}${sysconfdir}/default/volatiles - install -m 0644 ${WORKDIR}/volatiles.03_suricata ${D}${sysconfdir}/default/volatiles/volatiles.03_suricata + install -m 0644 ${WORKDIR}/volatiles.03_suricata ${D}${sysconfdir}/default/volatiles/03_suricata install -m 0644 ${S}/threshold.config ${D}${sysconfdir}/suricata diff --git a/meta-security/recipes-scanners/clamav/clamav_0.101.5.bb b/meta-security/recipes-scanners/clamav/clamav_0.101.5.bb index 47fbae49f..7dad26315 100644 --- a/meta-security/recipes-scanners/clamav/clamav_0.101.5.bb +++ b/meta-security/recipes-scanners/clamav/clamav_0.101.5.bb @@ -86,7 +86,7 @@ do_install_append_class-target () { install -m 644 ${WORKDIR}/clamd.conf ${D}/${sysconfdir} install -m 644 ${WORKDIR}/freshclam.conf ${D}/${sysconfdir} - install -m 0644 ${WORKDIR}/volatiles.03_clamav ${D}${sysconfdir}/default/volatiles/volatiles.03_clamav + install -m 0644 ${WORKDIR}/volatiles.03_clamav ${D}${sysconfdir}/default/volatiles/03_clamav sed -i -e 's#${STAGING_DIR_HOST}##g' ${D}${libdir}/pkgconfig/libclamav.pc rm ${D}/${libdir}/libclamav.so if [ "${INSTALL_CLAMAV_CVD}" = "1" ]; then -- cgit v1.2.3