subtree updates

meta-security: 53c5cc794f..ddf301c45c:
  Adrian Zaharia (1):
        libmhash: fix multilib header conflict - mutils/mhash_config.h

  Alexander Kanavin (1):
        maintainers.inc: rename to avoid clashes with oe-core

  Armin Kuster (15):
        meta-tpm: rename recipes-tpm to recipes-tpm1
        recipes-tpm: use this for common tpm recipes
        swtpm: update to 0.8.0
        libtpm: update to 0.9.6
        ossec-hids: update to tip of 3.7.0
        libhtp: update to 0.5.43
        suricata: update to 6.0.11
        fscryptctl: update to 1.0.1
        oeqa: fix hash test to match new changes
        integrity-image-minimal: adapt QEMU cmdline to new changes
        lynis: Add decoding OE and Poky
        os-release.bbappend: drop now CPE_NAME is in core
        openembedded-release: drop as os-release does this now
        tpm2-tss: drop vendor from PACKAGECONFIG
        packagegroup-security-tpm2: restore pkgs removed earlier

  Paul Gortmaker (4):
        dm-verity: ensure people don't ignore the DISTRO_FEATURES warning
        dm-verity: don't make read-only-rootfs sound like a requirement
        dm-verity: document the meta-intel dependency in the systemd example
        dm-verity: add x86-64 systemd based example instructions

  Peter Hoyes (1):
        meta-parsec/layer.conf: Insert addpylib declaration

  Peter Kjellerstedt (1):
        tpm2-tools: Remove unnecessary and optional dependencies

  Stefan Berger (12):
        ima: Document and replace keys and adapt scripts for EC keys
        ima: Fix the ima_policy_appraise_all to appraise executables & libraries
        ima: Fix the IMA kernel feature
        ima: Rename IMA_EVM_POLICY_SYSTEMD to IMA_EVM_POLICY
        ima: Sign all executables and the ima-policy in the root filesystem
        integrity: Update the README for IMA support
        linux: overlayfs: Add kernel patch resolving a file change notification issue
        ima-evm-utils: Update ima-evm-utils to v1.5 and add a patch
        linux: overlayfs: Drop kernel patch resolving a file change notification issue
        ima: Drop kernel config option CONFIG_SQUASHFS_XATTR=y from ima.cfg
        integrity: Fix the do_configure function
        integrity: Rename linux-%.bbappend to linux-yocto%.bbappend

meta-raspberrypi: bf948e0aa8..928bb234bb:
  Martin Jansa (3):
        rpi-libcamera-apps: fix flags used in aarch64 builds
        rpi-libcamera-apps: fix version generation on hosts with older python
        rpi-libcamera-apps: bump to latest SRCREV and set PV

meta-arm: 0b5724266a..f9d80e1a14:
  Emekcan Aras (2):
        arm-bsp/trusted-firmware-m: Align Capsule Update with GPT changes
        arm-bsp/wic: corstone1000: Fix and limit the partition size for corstone1000
Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Change-Id: I56f7d26070d879e3138618332841c30cf57eb7d9

2 files changed, 88 insertions, 2 deletions

diff --git a/meta-security/docs/dm-verity-systemd-x86-64.txt b/meta-security/docs/dm-verity-systemd-x86-64.txt
new file mode 100644
index 0000000000..a47b02c853
--- /dev/null
+++ b/meta-security/docs/dm-verity-systemd-x86-64.txt
@@ -0,0 +1,77 @@
+dm-verity and x86-64 and systemd
+--------------------------------
+In this example, we'll target combining qemux86-64 with dm-verity and
+also systemd - systemd has dm-verity bindings and is more likely to be
+used on x86.
+
+While dm-verity in a qemu environment doesn't make practial sense as a
+deployment - it can be a useful stepping stone for testing and getting to
+a final physical deployment.
+
+Set/uncomment the MACHINE line for "qemux86-64" if you haven't yet.  It
+should be the default if unspecified, but check to be sure.  As of this
+writing (kernel v6.1) the resulting qemux86-64 build can also be booted
+successfully on physical hardware, but if you don't intend to use qemu,
+you might instead want to choose "genericx86-64"
+
+This will make use of wic/systemd-bootdisk-dmverity.wks.in -- note that it
+contains a dependency on the meta-intel layer for microcode, so you'll need
+to fetch and add that layer in addition to the meta-security related layers.
+
+In addition to the basic dm-verity settings, choose systemd in local.conf:
+
+DISTRO_FEATURES:append = " security systemd"
+VIRTUAL-RUNTIME_init_manager = "systemd"
+EFI_PROVIDER = "systemd-boot"
+PACKAGECONFIG:append:pn-systemd = " cryptsetup"
+
+Note the last line - you won't typically see that in on-line instructions
+for enabling systemd.  It is important for dm-verity, since it triggers
+the build and installation of components like this onto the rootfs:
+
+   /lib/systemd/system-generators/systemd-veritysetup-generator
+   /lib/systemd/systemd-veritysetup
+
+Now build the components for the wic image:
+
+   bitbake intel-microcode
+   bitbake core-image-minimal
+
+Assemble the image:
+
+           ------------------------------
+build-qemu-x86_64$wic create systemd-bootdisk-dmverity -e core-image-minimal
+INFO: Building wic-tools...
+
+[...]
+
+INFO: Creating image(s)...
+
+INFO: The new image(s) can be found here:
+  ./systemd-bootdisk-dmverity.wks-202304181413-sda.direct
+
+The following build artifacts were used to create the image(s):
+  BOOTIMG_DIR:                  /home/paul/poky/build-qemu-x86_64/tmp/work/qemux86_64-poky-linux/core-image-minimal/1.0-r0/recipe-sysroot/usr/share
+  KERNEL_DIR:                   /home/paul/poky/build-qemu-x86_64/tmp/deploy/images/qemux86-64
+  NATIVE_SYSROOT:               /home/paul/poky/build-qemu-x86_64/tmp/work/core2-64-poky-linux/wic-tools/1.0-r0/recipe-sysroot-native
+
+INFO: The image(s) were created using OE kickstart file:
+  /home/paul/poky/meta-security/wic/systemd-bootdisk-dmverity.wks.in
+build-qemu-x86_64$
+           ------------------------------
+
+The "runqemu" script defaults were acceptable for testing with only the
+verity image needing to be specified, i.e.
+
+    runqemu \
+    nographic \
+    qemux86-64 \
+    tmp/deploy/images/qemux86-64/core-image-minimal-qemux86-64-*.rootfs.ext4.verity
+
+You will see the above "direct" image file and also similarly named
+individual partition images.  To boot on UEFI enabled physical hardware,
+you need to simply write the "direct" image file to a USB stick with dd
+and the partition images can largely be ignored.
+
+Further information on interacting with the systemd UEFI loader is here:
+https://www.freedesktop.org/wiki/Software/systemd/systemd-boot/
diff --git a/meta-security/docs/dm-verity.txt b/meta-security/docs/dm-verity.txt
index 602a826939..c2dce73979 100644
--- a/meta-security/docs/dm-verity.txt
+++ b/meta-security/docs/dm-verity.txt
@@ -31,6 +31,8 @@ Kernel Configuration
 Kernel configuration for dm-verity happens automatically via IMAGE_CLASSES
 which will source features/device-mapper/dm-verity.scc when dm-verity-img
 is used. [See commit d9feafe991c]
+IMPORTANT: As per the top level README, you *must* put security in the
+DISTRO_FEATURES, or else you won't get the dm-verity kernel settings.
 
 Supported Platforms
 -------------------
@@ -51,11 +53,18 @@ conf/local.conf and conf/bblayers.conf from the oe-init-build-env
 Firstly, you need the meta-security layer to conf/bblayers.conf along with
 the dependencies it has -- see the top level meta-security README for that.
 
-Next, assuming you'll be using dm-verity for validation of your rootfs,
-you'll need to enable read-only rootfs support in your local.conf with:
+Note that if you are using dm-verity for your rootfs, then it enforces a
+read-only mount right at the kernel level, so be prepared for issues such
+as failed creation of temporary files and similar.
+
+Yocto does support additional checks and changes via setting:
 
 EXTRA_IMAGE_FEATURES = "read-only-rootfs"
 
+...but since read-only is enforced at the kernel level already, using
+this feature isn't a hard requirement.  It may be best to delay/defer
+making use of this until after you've established basic booting.
+
 For more details, see the associated documentation:
 
 https://docs.yoctoproject.org/dev/dev-manual/read-only-rootfs.html