jim.lai/OpenBMC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial commit

Browse Source
This commit is contained in:
Your Name
2026-04-23 17:07:55 +08:00
commit b7e39e063b
16725 changed files with 1625565 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-security/recipes-compliance/lynis/files/0001-osdetection-add-OpenEmbedded-and-Poky.patch
+51
View File
@@ -0,0 +1,51 @@
From 4b1de197ee0dd259cc05d5faf7fd38b580d841d2 Mon Sep 17 00:00:00 2001
From: Armin Kuster <akuster808@gmail.com>
Date: Tue, 2 May 2023 16:22:13 -0400
Subject: [PATCH] osdetection: add OpenEmbedded and Poky
Signed-off-by: Armin Kuster <akuster@mvista.com>
Upstream-Status: Pending
https://github.com/CISOfy/lynis/pull/1390
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
include/osdetection | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/include/osdetection b/include/osdetection
index 989b1b3..e5974e5 100644
--- a/include/osdetection
+++ b/include/osdetection
@@ -308,6 +308,12 @@
OS_REDHAT_OR_CLONE=1
OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
;;
+ "nodistro")
+ LINUX_VERSION="openembedded"
+ OS_NAME="OpenEmbedded"
+ OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+ OS_VERSION_FULL=$(grep "^VERSION=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+ ;;
"opensuse-tumbleweed")
LINUX_VERSION="openSUSE Tumbleweed"
# It's rolling release but has a snapshot version (the date of the snapshot)
@@ -330,6 +336,14 @@
OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
OS_VERSION_FULL=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
;;
+ "poky")
+ LINUX_VERSION="Poky"
+ OS_NAME="openembedded"
+ LINUX_VERSION_LIKE="openembedded"
+ OS_VERSION=$(grep "^VERSION_ID=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+ OS_VERSION_FULL=$(grep "^PRETTY_NAME=" /etc/os-release | awk -F= '{print $2}' | tr -d '"')
+
+ ;;
"pop")
LINUX_VERSION="Pop!_OS"
LINUX_VERSION_LIKE="Ubuntu"
--
2.25.1
meta-security/recipes-compliance/lynis/lynis_3.0.8.bb
+42
View File
@@ -0,0 +1,42 @@
# Copyright (C) 2017 Armin Kuster <akuster808@gmail.com>
# Released under the MIT license (see COPYING.MIT for the terms)
SUMMARY = "Lynis is a free and open source security and auditing tool."
HOMEDIR = "https://cisofy.com/"
LICENSE = "GPL-3.0-only"
LIC_FILES_CHKSUM = "file://LICENSE;md5=3edd6782854304fd11da4975ab9799c1"
SRC_URI = "https://cisofy.com/files/${BPN}-${PV}.tar.gz \
file://0001-osdetection-add-OpenEmbedded-and-Poky.patch \
"
SRC_URI[sha256sum] = "98373a4cc9d0471ab9bebb249e442fcf94b6bf6d4e9c6fc0b22bca1506646c63"
S = "${WORKDIR}/${BPN}"
inherit autotools-brokensep
do_compile[noexec] = "1"
do_configure[noexec] = "1"
do_install () {
install -d ${D}/${bindir}
install -d ${D}/${sysconfdir}/lynis
install -m 555 ${S}/lynis ${D}/${bindir}
install -d ${D}/${datadir}/lynis/db
install -d ${D}/${datadir}/lynis/plugins
install -d ${D}/${datadir}/lynis/include
install -d ${D}/${datadir}/lynis/extras
cp -r ${S}/db/* ${D}/${datadir}/lynis/db/.
cp -r ${S}/plugins/* ${D}/${datadir}/lynis/plugins/.
cp -r ${S}/include/* ${D}/${datadir}/lynis/include/.
cp -r ${S}/extras/* ${D}/${datadir}/lynis/extras/.
cp ${S}/*.prf ${D}/${sysconfdir}/lynis
}
FILES:${PN} += "${sysconfdir}/developer.prf ${sysconfdir}/default.prf"
FILES:${PN}-doc += "lynis.8 FAQ README CHANGELOG.md CONTRIBUTIONS.md CONTRIBUTORS.md"
RDEPENDS:${PN} += "procps findutils"
meta-security/recipes-compliance/openscap/openscap_1.3.8.bb
+75
View File
@@ -0,0 +1,75 @@
# Copyright (C) 2017 - 2023 Armin Kuster <akuster808@gmail.com>
# Released under the MIT license (see COPYING.MIT for the terms)
SUMARRY = "NIST Certified SCAP 1.2 toolkit"
HOME_URL = "https://www.open-scap.org/tools/openscap-base/"
LIC_FILES_CHKSUM = "file://COPYING;md5=fbc093901857fcd118f065f900982c24"
LICENSE = "LGPL-2.1-only"
DEPENDS = "dbus acl bzip2 pkgconfig gconf procps curl libxml2 libxslt libcap swig libpcre xmlsec1"
DEPENDS:class-native = "pkgconfig-native swig-native curl-native libxml2-native libxslt-native libcap-native libpcre-native xmlsec1-native"
#Jun 22th, 2023
SRCREV = "a81c66d9bc36612dd1ca83a8c959a59e172eb4b9"
SRC_URI = "git://github.com/OpenSCAP/openscap.git;branch=maint-1.3;protocol=https \
"
S = "${WORKDIR}/git"
inherit cmake pkgconfig python3native python3targetconfig perlnative systemd
PACKAGECONFIG ?= "python3 rpm perl gcrypt ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'selinux', '', d)}"
PACKAGECONFIG[python3] = "-DENABLE_PYTHON3=ON, ,python3, python3"
PACKAGECONFIG[perl] = "-DENABLE_PERL=ON, ,perl, perl"
PACKAGECONFIG[rpm] = "-DENABLE_OSCAP_UTIL_AS_RPM=ON, ,rpm, rpm"
PACKAGECONFIG[gcrypt] = "-DWITH_CRYPTO=gcrypt, ,libgcrypt"
PACKAGECONFIG[nss3] = "-DWITH_CRYPTO=nss3, ,nss"
PACKAGECONFIG[selinux] = ", ,libselinux"
PACKAGECONFIG[remdediate_service] = "-DENABLE_OSCAP_REMEDIATE_SERVICE=ON,-DENABLE_OSCAP_REMEDIATE_SERVICE=NO,"
EXTRA_OECMAKE += "-DENABLE_PROBES_LINUX=ON -DENABLE_PROBES_UNIX=ON \
-DENABLE_PROBES_SOLARIS=OFF -DENABLE_PROBES_INDEPENDENT=ON \
-DENABLE_OSCAP_UTIL=ON -DENABLE_OSCAP_UTIL_SSH=ON \
-DENABLE_OSCAP_UTIL_DOCKER=OFF -DENABLE_OSCAP_UTIL_CHROOT=OFF \
-DENABLE_OSCAP_UTIL_PODMAN=OFF -DENABLE_OSCAP_UTIL_VM=OFF \
-DENABLE_PROBES_WINDOWS=OFF -DENABLE_VALGRIND=OFF \
-DENABLE_SCE=ON -DENABLE_MITRE=OFF -DENABLE_TESTS=OFF \
-DCMAKE_SKIP_INSTALL_RPATH=ON -DCMAKE_SKIP_RPATH=ON \
"
STAGING_OSCAP_DIR = "${TMPDIR}/work-shared/${MACHINE}/oscap-source"
STAGING_OSCAP_BUILDDIR = "${TMPDIR}/work-shared/openscap/oscap-build-artifacts"
do_configure:append:class-native () {
sed -i 's:OSCAP_DEFAULT_CPE_PATH.*$:OSCAP_DEFAULT_CPE_PATH "${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/cpe":' ${B}/config.h
sed -i 's:OSCAP_DEFAULT_SCHEMA_PATH.*$:OSCAP_DEFAULT_SCHEMA_PATH "${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/schemas":' ${B}/config.h
sed -i 's:OSCAP_DEFAULT_XSLT_PATH.*$:OSCAP_DEFAULT_XSLT_PATH "${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/xsl":' ${B}/config.h
}
do_install:append () {
if ${@bb.utils.contains('DISTRO_FEATURES','systemd','true','false',d)}; then
if ${@bb.utils.contains('PACKAGECONFIG','remdediate_service','true','false',d)}; then
install -D -m 0644 ${B}/oscap-remediate.service ${D}${systemd_system_unitdir}/oscap-remediate.service
fi
fi
}
do_install:class-native[cleandirs] += " ${STAGING_OSCAP_BUILDDIR}"
do_install:append:class-native () {
oscapdir=${STAGING_OSCAP_BUILDDIR}/${datadir_native}
install -d $oscapdir
cp -a ${D}/${STAGING_DATADIR_NATIVE}/openscap $oscapdir
}
SYSTEMD_PACKAGES = "${PN}"
SYSTEMD_SERVICE:${PN} = "${@bb.utils.contains('PACKAGECONFIG','remdediate_service', 'oscap-remediate.service', '',d)}"
SYSTEMD_AUTO_ENABLE = "disable"
FILES:${PN} += "${PYTHON_SITEPACKAGES_DIR}"
RDEPENDS:${PN} = "libxml2 python3-core libgcc bash"
RDEPENDS:${PN}-class-target = "libxml2 python3-core libgcc bash os-release"
BBCLASSEXTEND = "native"
meta-security/recipes-compliance/scap-security-guide/files/0001-scap-security-guide-add-Poky-support.patch
+91
View File
@@ -0,0 +1,91 @@
From 23a224203a73688567f500380644e5cf30c8ed99 Mon Sep 17 00:00:00 2001
From: Armin Kuster <akuster808@gmail.com>
Date: Thu, 22 Jun 2023 06:19:26 -0400
Subject: [PATCH] scap-security-guide: add Poky support
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Upstream-Status: Pending
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
products/openembedded/product.yml | 7 +++-
.../openembedded/transforms/constants.xslt | 4 +--
shared/checks/oval/installed_OS_is_poky.xml | 33 +++++++++++++++++++
3 files changed, 41 insertions(+), 3 deletions(-)
create mode 100644 shared/checks/oval/installed_OS_is_poky.xml
diff --git a/products/openembedded/product.yml b/products/openembedded/product.yml
index 9f2f12d737..a495e197c0 100644
--- a/products/openembedded/product.yml
+++ b/products/openembedded/product.yml
@@ -14,6 +14,11 @@ init_system: "systemd"
cpes_root: "../../shared/applicability"
cpes:
- openembedded:
- name: "cpe:/o:openembedded"
+ name: "cpe:/o:openembedded:nodistro:"
title: "OpenEmbedded nodistro"
check_id: installed_OS_is_openembedded
+
+ - poky:
+ name: "cpe:/o:openembedded:poky:"
+ title: "OpenEmbedded Poky reference distribution"
+ check_id: installed_OS_is_poky
diff --git a/products/openembedded/transforms/constants.xslt b/products/openembedded/transforms/constants.xslt
index 85e812a7c1..8901def2f9 100644
--- a/products/openembedded/transforms/constants.xslt
+++ b/products/openembedded/transforms/constants.xslt
@@ -2,8 +2,8 @@
<xsl:include href="../../../shared/transforms/shared_constants.xslt"/>
-<xsl:variable name="product_long_name">OpenEmbedded nodistro</xsl:variable>
-<xsl:variable name="product_short_name">OE nodistro</xsl:variable>
+<xsl:variable name="product_long_name">OpenEmbedded based distribution</xsl:variable>
+<xsl:variable name="product_short_name">OE distros</xsl:variable>
<xsl:variable name="product_stig_id_name">empty</xsl:variable>
<xsl:variable name="prod_type">openembedded</xsl:variable>
diff --git a/shared/checks/oval/installed_OS_is_poky.xml b/shared/checks/oval/installed_OS_is_poky.xml
new file mode 100644
index 0000000000..9c41acd786
--- /dev/null
+++ b/shared/checks/oval/installed_OS_is_poky.xml
@@ -0,0 +1,33 @@
+<def-group>
+ <definition class="inventory" id="installed_OS_is_poky" version="1">
+ <metadata>
+ <title>Poky</title>
+ <affected family="unix">
+ <platform>multi_platform_all</platform>
+ </affected>
+ <description>The operating system installed is a Poky referenece based System</description>
+ </metadata>
+ <criteria comment="System is Poky reference distribution" operator="AND">
+ <extend_definition comment="Installed OS is part of the Unix family" definition_ref="installed_OS_is_part_of_Unix_family" />
+ <criterion comment="Poky based distro" test_ref="test_os_release_poky" />
+ <criterion comment="Poky referenece distribution is installed" test_ref="test_poky" />
+ </criteria>
+ </definition>
+
+ <unix:file_test check="all" check_existence="all_exist" comment="/etc/os-release exists" id="test_os_release_poky" version="1">
+ <unix:object object_ref="obj_os_release_poky" />
+ </unix:file_test>
+ <unix:file_object comment="check /etc/os-release file" id="obj_os_release_poky" version="1">
+ <unix:filepath>/etc/os-release</unix:filepath>
+ </unix:file_object>
+
+ <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check OpenEmbedded" id="test_poky" version="1">
+ <ind:object object_ref="obj_poky" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_poky" version="1" comment="Check Poky">
+ <ind:filepath>/etc/os-release</ind:filepath>
+ <ind:pattern operation="pattern match">^ID=poky$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+</def-group>
--
2.34.1
meta-security/recipes-compliance/scap-security-guide/files/0001-scap-security-guide-add-openembedded.patch
+231
View File
@@ -0,0 +1,231 @@
From f6287d146762b8360bd7099f4724a58eedba7d2a Mon Sep 17 00:00:00 2001
From: Armin Kuster <akuster808@gmail.com>
Date: Wed, 14 Jun 2023 07:46:55 -0400
Subject: [PATCH] scap-security-guide: add openembedded
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Upstream-Status: Pending
Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
CMakeLists.txt | 5 +++
build_product | 1 +
products/openembedded/CMakeLists.txt | 6 ++++
products/openembedded/product.yml | 19 +++++++++++
.../openembedded/profiles/standard.profile | 12 +++++++
.../openembedded/transforms/constants.xslt | 10 ++++++
.../oval/installed_OS_is_openembedded.xml | 33 +++++++++++++++++++
.../oval/sysctl_kernel_ipv6_disable.xml | 1 +
ssg/constants.py | 5 ++-
9 files changed, 91 insertions(+), 1 deletion(-)
create mode 100644 products/openembedded/CMakeLists.txt
create mode 100644 products/openembedded/product.yml
create mode 100644 products/openembedded/profiles/standard.profile
create mode 100644 products/openembedded/transforms/constants.xslt
create mode 100644 shared/checks/oval/installed_OS_is_openembedded.xml
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 85ec289644..09ac96784e 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -95,6 +95,7 @@ option(SSG_PRODUCT_UBUNTU1804 "If enabled, the Ubuntu 18.04 SCAP content will be
option(SSG_PRODUCT_UBUNTU2004 "If enabled, the Ubuntu 20.04 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
option(SSG_PRODUCT_UBUNTU2204 "If enabled, the Ubuntu 22.04 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
option(SSG_PRODUCT_UOS20 "If enabled, the Uos 20 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
+option(SSG_PRODUCT_OE "If enabled, the OpenEmbedded SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
option(SSG_CENTOS_DERIVATIVES_ENABLED "If enabled, CentOS derivative content will be built from the RHEL content" TRUE)
@@ -289,6 +290,7 @@ message(STATUS "Ubuntu 18.04: ${SSG_PRODUCT_UBUNTU1804}")
message(STATUS "Ubuntu 20.04: ${SSG_PRODUCT_UBUNTU2004}")
message(STATUS "Ubuntu 22.04: ${SSG_PRODUCT_UBUNTU2204}")
message(STATUS "Uos 20: ${SSG_PRODUCT_UOS20}")
+message(STATUS "OpenEmbedded nodistro: ${SSG_PRODUCT_OE}")
@@ -410,6 +412,9 @@ endif()
if (SSG_PRODUCT_UOS20)
add_subdirectory("products/uos20" "uos20")
endif()
+if (SSG_PRODUCT_OE)
+ add_subdirectory("products/openembedded" "openembedded")
+endif()
# ZIP only contains source datastreams and kickstarts, people who
# want sources to build from should get the tarball instead.
diff --git a/build_product b/build_product
index fc793cbe70..197d925b7e 100755
--- a/build_product
+++ b/build_product
@@ -333,6 +333,7 @@ all_cmake_products=(
UBUNTU2204
UOS20
MACOS1015
+ OPENEMBEDDED
)
DEFAULT_OVAL_MAJOR_VERSION=5
diff --git a/products/openembedded/CMakeLists.txt b/products/openembedded/CMakeLists.txt
new file mode 100644
index 0000000000..1981adf53e
--- /dev/null
+++ b/products/openembedded/CMakeLists.txt
@@ -0,0 +1,6 @@
+# Sometimes our users will try to do: "cd openembedded; cmake ." That needs to error in a nice way.
+if ("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}")
+ message(FATAL_ERROR "cmake has to be used on the root CMakeLists.txt, see the Building ComplianceAsCode section in the Developer Guide!")
+endif()
+
+ssg_build_product("openembedded")
diff --git a/products/openembedded/product.yml b/products/openembedded/product.yml
new file mode 100644
index 0000000000..9f2f12d737
--- /dev/null
+++ b/products/openembedded/product.yml
@@ -0,0 +1,19 @@
+product: openembedded
+full_name: OpemEmbedded
+type: platform
+
+benchmark_id: OPENEMBEDDED
+benchmark_root: "../../linux_os/guide"
+
+profiles_root: "./profiles"
+
+pkg_manager: "dnf"
+
+init_system: "systemd"
+
+cpes_root: "../../shared/applicability"
+cpes:
+ - openembedded:
+ name: "cpe:/o:openembedded"
+ title: "OpenEmbedded nodistro"
+ check_id: installed_OS_is_openembedded
diff --git a/products/openembedded/profiles/standard.profile b/products/openembedded/profiles/standard.profile
new file mode 100644
index 0000000000..44339d716c
--- /dev/null
+++ b/products/openembedded/profiles/standard.profile
@@ -0,0 +1,12 @@
+documentation_complete: true
+
+title: 'Sample Security Profile for OpenEmbedded Distros'
+
+description: |-
+ This profile is an sample for use in documentation and example content.
+ The selected rules are standard and should pass quickly on most systems.
+
+selections:
+ - file_owner_etc_passwd
+ - file_groupowner_etc_passwd
+ - file_permissions_etc_passwd
diff --git a/products/openembedded/transforms/constants.xslt b/products/openembedded/transforms/constants.xslt
new file mode 100644
index 0000000000..85e812a7c1
--- /dev/null
+++ b/products/openembedded/transforms/constants.xslt
@@ -0,0 +1,10 @@
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+
+<xsl:include href="../../../shared/transforms/shared_constants.xslt"/>
+
+<xsl:variable name="product_long_name">OpenEmbedded nodistro</xsl:variable>
+<xsl:variable name="product_short_name">OE nodistro</xsl:variable>
+<xsl:variable name="product_stig_id_name">empty</xsl:variable>
+<xsl:variable name="prod_type">openembedded</xsl:variable>
+
+</xsl:stylesheet>
diff --git a/shared/checks/oval/installed_OS_is_openembedded.xml b/shared/checks/oval/installed_OS_is_openembedded.xml
new file mode 100644
index 0000000000..17c2873686
--- /dev/null
+++ b/shared/checks/oval/installed_OS_is_openembedded.xml
@@ -0,0 +1,33 @@
+<def-group>
+ <definition class="inventory" id="installed_OS_is_openembedded" version="1">
+ <metadata>
+ <title>OpenEmbedded</title>
+ <affected family="unix">
+ <platform>multi_platform_all</platform>
+ </affected>
+ <description>The operating system installed is an OpenEmbedded System</description>
+ </metadata>
+ <criteria comment="System is OpenEmbedded" operator="AND">
+ <extend_definition comment="Installed OS is part of the Unix family" definition_ref="installed_OS_is_part_of_Unix_family" />
+ <criterion comment="OpenEmbedded distro" test_ref="test_os_release" />
+ <criterion comment="OpenEmbedded is installed" test_ref="test_openembedded" />
+ </criteria>
+ </definition>
+
+ <unix:file_test check="all" check_existence="all_exist" comment="/etc/os-release exists" id="test_os_release" version="1">
+ <unix:object object_ref="obj_os_release" />
+ </unix:file_test>
+ <unix:file_object comment="check /etc/os-release file" id="obj_os_release" version="1">
+ <unix:filepath>/etc/os-release</unix:filepath>
+ </unix:file_object>
+
+ <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists" comment="Check OpenEmbedded" id="test_openembedded" version="1">
+ <ind:object object_ref="obj_openembedded" />
+ </ind:textfilecontent54_test>
+ <ind:textfilecontent54_object id="obj_openembedded" version="1" comment="Check OpenEmbedded">
+ <ind:filepath>/etc/os-release</ind:filepath>
+ <ind:pattern operation="pattern match">^ID=nodistro$</ind:pattern>
+ <ind:instance datatype="int">1</ind:instance>
+ </ind:textfilecontent54_object>
+
+</def-group>
diff --git a/shared/checks/oval/sysctl_kernel_ipv6_disable.xml b/shared/checks/oval/sysctl_kernel_ipv6_disable.xml
index affb9770cb..4f22df262c 100644
--- a/shared/checks/oval/sysctl_kernel_ipv6_disable.xml
+++ b/shared/checks/oval/sysctl_kernel_ipv6_disable.xml
@@ -8,6 +8,7 @@
<platform>multi_platform_debian</platform>
<platform>multi_platform_example</platform>
<platform>multi_platform_fedora</platform>
+ <platform>multi_platform_openembedded</platform>
<platform>multi_platform_opensuse</platform>
<platform>multi_platform_ol</platform>
<platform>multi_platform_rhcos</platform>
diff --git a/ssg/constants.py b/ssg/constants.py
index f66ba008fa..630fbdfcb9 100644
--- a/ssg/constants.py
+++ b/ssg/constants.py
@@ -219,6 +219,7 @@ FULL_NAME_TO_PRODUCT_MAPPING = {
"Ubuntu 20.04": "ubuntu2004",
"Ubuntu 22.04": "ubuntu2204",
"UnionTech OS Server 20": "uos20",
+ "OpenEmbedded": "openembedded",
"Not Applicable" : "example"
}
@@ -267,7 +268,7 @@ REFERENCES = dict(
MULTI_PLATFORM_LIST = ["rhel", "fedora", "rhv", "debian", "ubuntu",
"opensuse", "sle", "ol", "ocp", "rhcos",
- "example", "eks", "alinux", "uos", "anolis"]
+ "example", "eks", "alinux", "uos", "anolis", "openembedded"]
MULTI_PLATFORM_MAPPING = {
"multi_platform_alinux": ["alinux2", "alinux3"],
@@ -285,6 +286,7 @@ MULTI_PLATFORM_MAPPING = {
"multi_platform_sle": ["sle12", "sle15"],
"multi_platform_ubuntu": ["ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204"],
"multi_platform_uos": ["uos20"],
+ "multi_platform_openembedded": ["openembedded"],
}
RHEL_CENTOS_CPE_MAPPING = {
@@ -454,6 +456,7 @@ MAKEFILE_ID_TO_PRODUCT_MAP = {
'ocp': 'Red Hat OpenShift Container Platform',
'rhcos': 'Red Hat Enterprise Linux CoreOS',
'eks': 'Amazon Elastic Kubernetes Service',
+ 'openembedded': 'OpenEmbedded',
}
# References that can not be used with product-qualifiers
--
2.34.1
meta-security/recipes-compliance/scap-security-guide/files/0001-standard.profile-expand-checks.patch
+231
View File
@@ -0,0 +1,231 @@
From 7af2da3bbe1d5b4cba89c6dae9ea267717b865ea Mon Sep 17 00:00:00 2001
From: Armin Kuster <akuster808@gmail.com>
Date: Wed, 21 Jun 2023 07:46:38 -0400
Subject: [PATCH] standard.profile: expand checks
Upstream-Status: Pending
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Upstream-status: Pending
---
.../openembedded/profiles/standard.profile | 206 ++++++++++++++++++
1 file changed, 206 insertions(+)
diff --git a/products/openembedded/profiles/standard.profile b/products/openembedded/profiles/standard.profile
index 44339d716c..877d1a3971 100644
--- a/products/openembedded/profiles/standard.profile
+++ b/products/openembedded/profiles/standard.profile
@@ -9,4 +9,210 @@ description: |-
selections:
- file_owner_etc_passwd
- file_groupowner_etc_passwd
+ - service_crond_enabled
+ - file_groupowner_crontab
+ - file_owner_crontab
+ - file_permissions_crontab
+ - file_groupowner_cron_hourly
+ - file_owner_cron_hourly
+ - file_permissions_cron_hourly
+ - file_groupowner_cron_daily
+ - file_owner_cron_daily
+ - file_permissions_cron_daily
+ - file_groupowner_cron_weekly
+ - file_owner_cron_weekly
+ - file_permissions_cron_weekly
+ - file_groupowner_cron_monthly
+ - file_owner_cron_monthly
+ - file_permissions_cron_monthly
+ - file_groupowner_cron_d
+ - file_owner_cron_d
+ - file_permissions_cron_d
+ - file_groupowner_cron_allow
+ - file_owner_cron_allow
+ - file_cron_deny_not_exist
+ - file_groupowner_at_allow
+ - file_owner_at_allow
+ - file_at_deny_not_exist
+ - file_permissions_at_allow
+ - file_permissions_cron_allow
+ - file_groupowner_sshd_config
+ - file_owner_sshd_config
+ - file_permissions_sshd_config
+ - file_permissions_sshd_private_key
+ - file_permissions_sshd_pub_key
+ - sshd_set_loglevel_verbose
+ - sshd_set_loglevel_info
+ - sshd_max_auth_tries_value=4
+ - sshd_set_max_auth_tries
+ - sshd_disable_rhosts
+ - disable_host_auth
+ - sshd_disable_root_login
+ - sshd_disable_empty_passwords
+ - sshd_do_not_permit_user_env
+ - sshd_idle_timeout_value=15_minutes
+ - sshd_set_idle_timeout
+ - sshd_set_keepalive
+ - var_sshd_set_keepalive=0
+ - sshd_set_login_grace_time
+ - var_sshd_set_login_grace_time=60
+ - sshd_enable_warning_banner
+ - sshd_enable_pam
+ - sshd_set_maxstartups
+ - var_sshd_set_maxstartups=10:30:60
+ - sshd_set_max_sessions
+ - var_sshd_max_sessions=10
+ - accounts_password_pam_minclass
+ - accounts_password_pam_minlen
+ - accounts_password_pam_retry
+ - var_password_pam_minclass=4
+ - var_password_pam_minlen=14
+ - locking_out_password_attempts
+ - accounts_password_pam_pwhistory_remember_password_auth
+ - accounts_password_pam_pwhistory_remember_system_auth
+ - var_password_pam_remember_control_flag=required
+ - var_password_pam_remember=5
+ - set_password_hashing_algorithm_systemauth
+ - accounts_maximum_age_login_defs
+ - var_accounts_maximum_age_login_defs=365
+ - accounts_password_set_max_life_existing
+ - accounts_minimum_age_login_defs
+ - var_accounts_minimum_age_login_defs=7
+ - accounts_password_set_min_life_existing
+ - accounts_password_warn_age_login_defs
+ - var_accounts_password_warn_age_login_defs=7
+ - account_disable_post_pw_expiration
+ - var_account_disable_post_pw_expiration=30
+ - no_shelllogin_for_systemaccounts
+ - accounts_tmout
+ - var_accounts_tmout=15_min
+ - accounts_root_gid_zero
+ - accounts_umask_etc_bashrc
+ - accounts_umask_etc_login_defs
+ - use_pam_wheel_for_su
+ - sshd_allow_only_protocol2
+ - journald_forward_to_syslog
+ - journald_compress
+ - journald_storage
+ - service_auditd_enabled
+ - service_httpd_disabled
+ - service_vsftpd_disabled
+ - service_named_disabled
+ - service_nfs_disabled
+ - service_rpcbind_disabled
+ - service_slapd_disabled
+ - service_dhcpd_disabled
+ - service_cups_disabled
+ - service_ypserv_disabled
+ - service_rsyncd_disabled
+ - service_avahi-daemon_disabled
+ - service_snmpd_disabled
+ - service_squid_disabled
+ - service_smb_disabled
+ - service_dovecot_disabled
+ - banner_etc_motd
+ - login_banner_text=cis_banners
+ - banner_etc_issue
+ - login_banner_text=cis_banners
+ - file_groupowner_etc_motd
+ - file_owner_etc_motd
+ - file_permissions_etc_motd
+ - file_groupowner_etc_issue
+ - file_owner_etc_issue
+ - file_permissions_etc_issue
+ - ensure_gpgcheck_globally_activated
+ - package_aide_installed
+ - aide_periodic_cron_checking
+ - grub2_password
+ - file_groupowner_grub2_cfg
+ - file_owner_grub2_cfg
+ - file_permissions_grub2_cfg
+ - require_singleuser_auth
+ - require_emergency_target_auth
+ - disable_users_coredumps
+ - coredump_disable_backtraces
+ - coredump_disable_storage
+ - configure_crypto_policy
+ - var_system_crypto_policy=default_policy
+ - dir_perms_world_writable_sticky_bits
- file_permissions_etc_passwd
+ - file_owner_etc_shadow
+ - file_groupowner_etc_shadow
+ - file_groupowner_etc_group
+ - file_owner_etc_group
+ - file_permissions_etc_group
+ - file_groupowner_etc_gshadow
+ - file_owner_etc_gshadow
+ - file_groupowner_backup_etc_passwd
+ - file_owner_backup_etc_passwd
+ - file_permissions_backup_etc_passwd
+ - file_groupowner_backup_etc_shadow
+ - file_owner_backup_etc_shadow
+ - file_permissions_backup_etc_shadow
+ - file_groupowner_backup_etc_group
+ - file_owner_backup_etc_group
+ - file_permissions_backup_etc_group
+ - file_groupowner_backup_etc_gshadow
+ - file_owner_backup_etc_gshadow
+ - file_permissions_backup_etc_gshadow
+ - file_permissions_unauthorized_world_writable
+ - file_permissions_ungroupowned
+ - accounts_root_path_dirs_no_write
+ - root_path_no_dot
+ - accounts_no_uid_except_zero
+ - file_ownership_home_directories
+ - file_groupownership_home_directories
+ - no_netrc_files
+ - no_rsh_trust_files
+ - account_unique_id
+ - group_unique_id
+ - group_unique_name
+ - kernel_module_sctp_disabled
+ - kernel_module_dccp_disabled
+ - wireless_disable_interfaces
+ - sysctl_net_ipv4_ip_forward
+ - sysctl_net_ipv6_conf_all_forwarding
+ - sysctl_net_ipv6_conf_all_forwarding_value=disabled
+ - sysctl_net_ipv4_conf_all_send_redirects
+ - sysctl_net_ipv4_conf_default_send_redirects
+ - sysctl_net_ipv4_conf_all_accept_source_route
+ - sysctl_net_ipv4_conf_all_accept_source_route_value=disabled
+ - sysctl_net_ipv4_conf_default_accept_source_route
+ - sysctl_net_ipv4_conf_default_accept_source_route_value=disabled
+ - sysctl_net_ipv6_conf_all_accept_source_route
+ - sysctl_net_ipv6_conf_all_accept_source_route_value=disabled
+ - sysctl_net_ipv6_conf_default_accept_source_route
+ - sysctl_net_ipv6_conf_default_accept_source_route_value=disabled
+ - sysctl_net_ipv4_conf_all_accept_redirects
+ - sysctl_net_ipv4_conf_all_accept_redirects_value=disabled
+ - sysctl_net_ipv4_conf_default_accept_redirects
+ - sysctl_net_ipv4_conf_default_accept_redirects_value=disabled
+ - sysctl_net_ipv6_conf_all_accept_redirects
+ - sysctl_net_ipv6_conf_all_accept_redirects_value=disabled
+ - sysctl_net_ipv6_conf_default_accept_redirects
+ - sysctl_net_ipv6_conf_default_accept_redirects_value=disabled
+ - sysctl_net_ipv4_conf_all_secure_redirects
+ - sysctl_net_ipv4_conf_all_secure_redirects_value=disabled
+ - sysctl_net_ipv4_conf_default_secure_redirects
+ - sysctl_net_ipv4_conf_default_secure_redirects_value=disabled
+ - sysctl_net_ipv4_conf_all_log_martians
+ - sysctl_net_ipv4_conf_all_log_martians_value=enabled
+ - sysctl_net_ipv4_conf_default_log_martians
+ - sysctl_net_ipv4_conf_default_log_martians_value=enabled
+ - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
+ - sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value=enabled
+ - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
+ - sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value=enabled
+ - sysctl_net_ipv4_conf_all_rp_filter
+ - sysctl_net_ipv4_conf_all_rp_filter_value=enabled
+ - sysctl_net_ipv4_conf_default_rp_filter
+ - sysctl_net_ipv4_conf_default_rp_filter_value=enabled
+ - sysctl_net_ipv4_tcp_syncookies
+ - sysctl_net_ipv4_tcp_syncookies_value=enabled
+ - sysctl_net_ipv6_conf_all_accept_ra
+ - sysctl_net_ipv6_conf_all_accept_ra_value=disabled
+ - sysctl_net_ipv6_conf_default_accept_ra
+ - sysctl_net_ipv6_conf_default_accept_ra_value=disabled
+ - package_firewalld_installed
+ - service_firewalld_enabled
+ - package_iptables_installed
--
2.34.1
meta-security/recipes-compliance/scap-security-guide/files/run_eval.sh
+3
View File
@@ -0,0 +1,3 @@
#!/bin/sh
oscap xccdf eval --results results.xml --report report.html --profile xccdf_org.ssgproject.content_profile_standard /usr/share/xml/scap/ssg/content/ssg-openembedded-ds.xml
meta-security/recipes-compliance/scap-security-guide/scap-security-guide_0.1.67.bb
+45
View File
@@ -0,0 +1,45 @@
# Copyright (C) 2017 - 2023 Armin Kuster <akuster808@gmail.com>
# Released under the MIT license (see COPYING.MIT for the terms)
SUMARRY = "SCAP content for various platforms, upstream version"
HOME_URL = "https://www.open-scap.org/security-policies/scap-security-guide/"
LIC_FILES_CHKSUM = "file://LICENSE;md5=9bfa86579213cb4c6adaffface6b2820"
LICENSE = "BSD-3-Clause"
SRCREV = "dad85502ce8da722a6afc391346c41cee61e90a9"
SRC_URI = "git://github.com/ComplianceAsCode/content.git;branch=master;protocol=https \
file://0001-scap-security-guide-add-openembedded.patch \
file://0001-standard.profile-expand-checks.patch \
file://0001-scap-security-guide-add-Poky-support.patch \
file://run_eval.sh \
"
DEPENDS = "openscap-native python3-pyyaml-native python3-jinja2-native libxml2-native expat-native coreutils-native"
S = "${WORKDIR}/git"
B = "${S}/build"
inherit cmake pkgconfig python3native python3targetconfig
OECMAKE_GENERATOR = "Unix Makefiles"
EXTRA_OECMAKE += "-DENABLE_PYTHON_COVERAGE=OFF -DSSG_PRODUCT_DEFAULT=OFF -DSSG_PRODUCT_OE=ON"
do_configure[depends] += "openscap-native:do_install"
do_configure:prepend () {
sed -i -e 's:NAMES\ sed:NAMES\ ${HOSTTOOLS_DIR}/sed:g' ${S}/CMakeLists.txt
sed -i -e 's:NAMES\ grep:NAMES\ ${HOSTTOOLS_DIR}/grep:g' ${S}/CMakeLists.txt
}
do_install:append() {
install -d ${D}${datadir}/openscap
install ${WORKDIR}/run_eval.sh ${D}${datadir}/openscap/.
}
FILES:${PN} += "${datadir}/xml ${datadir}/openscap"
RDEPENDS:${PN} = "openscap"
COMPATIBLE_HOST:libc-musl = "null"