* Re: [Buildroot] [PATCH 1/1] package/chipsec: new package
2021-10-01 1:54 ` [Buildroot] [PATCH 1/1] package/chipsec: new package Tal Lubko via buildroot
@ 2021-10-01 14:35 ` Tal Lubko via buildroot
2021-10-01 14:40 ` Thomas Petazzoni
2021-10-12 20:07 ` Arnout Vandecappelle
1 sibling, 1 reply; 5+ messages in thread
From: Tal Lubko via buildroot @ 2021-10-01 14:35 UTC (permalink / raw)
To: buildroot@buildroot.org; +Cc: Thomas Petazzoni
[-- Attachment #1.1: Type: text/plain, Size: 5283 bytes --]
Hi
I've submitted a patch which adds new package - chipsec, which is a framework for analyzing the security of PC platforms.
I haven't got a reply for this patch so I've got a feeling I've done something wrong.Have I?
Thanks,Tal
On Friday, October 1, 2021, 04:54:58 AM GMT+3, Tal Lubko via buildroot <buildroot@buildroot.org> wrote:
Signed-off-by: Tal Lubko <tallubko@yahoo.com>
---
package/Config.in | 1 +
...ed-modules-instead-of-source-modules.patch | 27 +++++++++++++++++++
package/chipsec/Config.in | 19 +++++++++++++
package/chipsec/chipsec.hash | 3 +++
package/chipsec/chipsec.mk | 23 ++++++++++++++++
5 files changed, 73 insertions(+)
create mode 100644 package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch
create mode 100644 package/chipsec/Config.in
create mode 100644 package/chipsec/chipsec.hash
create mode 100644 package/chipsec/chipsec.mk
diff --git a/package/Config.in b/package/Config.in
index 2f83c87582..ce73e2db72 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -2010,6 +2010,7 @@ endif
endmenu
menu "Security"
+ source "package/chipsec/Config.in"
source "package/libapparmor/Config.in"
source "package/libselinux/Config.in"
source "package/libsemanage/Config.in"
diff --git a/package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch b/package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch
new file mode 100644
index 0000000000..08a87bf3cc
--- /dev/null
+++ b/package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch
@@ -0,0 +1,27 @@
+From fd67e6878daec7abeef649bb687464c832a04ee6 Mon Sep 17 00:00:00 2001
+From: Tal Lubko <tallubko@yahoo.com>
+Date: Wed, 22 Sep 2021 15:50:46 +0300
+Subject: [PATCH] search for compiled modules instead of source code modules
+
+change chipsec_main to search for compiled modules (PYCs) instead of
+source code modules (PYs).
+---
+ chipsec_main.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/chipsec_main.py b/chipsec_main.py
+index 1aa46ea..11cf9c6 100755
+--- a/chipsec_main.py
++++ b/chipsec_main.py
+@@ -215,7 +215,7 @@ class ChipsecMain:
+ while len(subdirs) > 0:
+ subdirs.pop()
+ for modx in mod_fnames:
+- if fnmatch.fnmatch( modx, '*.py' ) and not fnmatch.fnmatch( modx, '__init__.py' ):
++ if fnmatch.fnmatch( modx, '*.pyc' ) and not fnmatch.fnmatch( modx, '__init__.pyc' ):
+ self.load_module( os.path.join( dirname, modx ), self._module_argv )
+ self.Loaded_Modules.sort()
+
+--
+2.17.1
+
diff --git a/package/chipsec/Config.in b/package/chipsec/Config.in
new file mode 100644
index 0000000000..3da41c14a6
--- /dev/null
+++ b/package/chipsec/Config.in
@@ -0,0 +1,19 @@
+config BR2_PACKAGE_CHIPSEC
+ bool "chipsec"
+ depends on BR2_LINUX_KERNEL
+ depends on BR2_PACKAGE_PYTHON3
+ depends on BR2_i386 || BR2_x86_64
+ select BR2_PACKAGE_PYTHON_SETUPTOOLS # runtime
+
+ help
+ CHIPSEC is a framework for analyzing the security of PC
+ platforms including hardware, system firmware (BIOS/UEFI),
+ and platform components.
+
+ https://github.com/chipsec/chipsec
+
+comment "chipsec needs a Linux kernel to be built"
+ depends on !BR2_LINUX_KERNEL
+
+comment "chipsec depends on python3"
+ depends on !BR2_PACKAGE_PYTHON3
diff --git a/package/chipsec/chipsec.hash b/package/chipsec/chipsec.hash
new file mode 100644
index 0000000000..344eb4fab8
--- /dev/null
+++ b/package/chipsec/chipsec.hash
@@ -0,0 +1,3 @@
+# Locally calculated
+sha256 0470326e00f66c91d751e9827d9e0050e3e4ac5b2bc7a9943a76381beda58162 chipsec-1.7.1.tar.gz
+sha256 4c2ca80f4d3675a53a216a64d67e7b411a81a6e958defd248c6f1ecf44dc6607 COPYING
diff --git a/package/chipsec/chipsec.mk b/package/chipsec/chipsec.mk
new file mode 100644
index 0000000000..96d96176cc
--- /dev/null
+++ b/package/chipsec/chipsec.mk
@@ -0,0 +1,23 @@
+################################################################################
+#
+# chipsec
+#
+################################################################################
+
+CHIPSEC_VERSION = 1.7.1
+CHIPSEC_SITE = $(call github,chipsec,chipsec,$(CHIPSEC_VERSION))
+CHIPSEC_SETUP_TYPE = setuptools
+CHIPSEC_LICENSE = GPL-2.0
+CHIPSEC_LICENSE_FILES = LICENSE
+CHIPSEC_DEPENDENCIES = linux
+CHIPSEC_ENV = KSRC=$(LINUX_DIR)
+CHIPSEC_BUILD_OPTS = build_ext -i
+
+CHIPSEC_POST_INSTALL_TARGET_HOOKS += CHIPSEC_INSTALL_LKM
+
+define CHIPSEC_INSTALL_LKM
+ $(INSTALL) -m 0644 -D $(@D)/chipsec/helper/linux/chipsec.ko \
+ $(TARGET_DIR)/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages/chipsec/helper/linux
+endef
+
+$(eval $(python-package))
--
2.17.1
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
[-- Attachment #1.2: Type: text/html, Size: 10321 bytes --]
[-- Attachment #2: Type: text/plain, Size: 150 bytes --]
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [Buildroot] [PATCH 1/1] package/chipsec: new package
2021-10-01 1:54 ` [Buildroot] [PATCH 1/1] package/chipsec: new package Tal Lubko via buildroot
2021-10-01 14:35 ` Tal Lubko via buildroot
@ 2021-10-12 20:07 ` Arnout Vandecappelle
1 sibling, 0 replies; 5+ messages in thread
From: Arnout Vandecappelle @ 2021-10-12 20:07 UTC (permalink / raw)
To: Tal Lubko, buildroot; +Cc: Thomas Petazzoni
Hi Tal,
On 01/10/2021 03:54, Tal Lubko via buildroot wrote:
> Signed-off-by: Tal Lubko <tallubko@yahoo.com>
> ---
> package/Config.in | 1 +
> ...ed-modules-instead-of-source-modules.patch | 27 +++++++++++++++++++
> package/chipsec/Config.in | 19 +++++++++++++
> package/chipsec/chipsec.hash | 3 +++
> package/chipsec/chipsec.mk | 23 ++++++++++++++++
Please add yourself to the DEVELOPERS file [1] for this package. This way,
you'll get an e-mail if the package fails in the autobuilders, or when a new
version is released if the package is registered on release-monitoring.org.
> 5 files changed, 73 insertions(+)
> create mode 100644 package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch
> create mode 100644 package/chipsec/Config.in
> create mode 100644 package/chipsec/chipsec.hash
> create mode 100644 package/chipsec/chipsec.mk
>
> diff --git a/package/Config.in b/package/Config.in
> index 2f83c87582..ce73e2db72 100644
> --- a/package/Config.in
> +++ b/package/Config.in
> @@ -2010,6 +2010,7 @@ endif
> endmenu
>
> menu "Security"
> + source "package/chipsec/Config.in"
> source "package/libapparmor/Config.in"
> source "package/libselinux/Config.in"
> source "package/libsemanage/Config.in"
> diff --git a/package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch b/package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch
> new file mode 100644
> index 0000000000..08a87bf3cc
> --- /dev/null
> +++ b/package/chipsec/0001-search-for-compiled-modules-instead-of-source-modules.patch
> @@ -0,0 +1,27 @@
> +From fd67e6878daec7abeef649bb687464c832a04ee6 Mon Sep 17 00:00:00 2001
> +From: Tal Lubko <tallubko@yahoo.com>
> +Date: Wed, 22 Sep 2021 15:50:46 +0300
> +Subject: [PATCH] search for compiled modules instead of source code modules
> +
> +change chipsec_main to search for compiled modules (PYCs) instead of
> +source code modules (PYs).
Every patch must have a signed-off-by, to validate that it takes the license
of the patched project rather then Buildroot's GPLv2.
Also, please add a line with
Upstream: <URL>
with a URL that points to your upstream submission of the patch (pull request,
most likely).
> +---
> + chipsec_main.py | 2 +-
> + 1 file changed, 1 insertion(+), 1 deletion(-)
> +
> +diff --git a/chipsec_main.py b/chipsec_main.py
> +index 1aa46ea..11cf9c6 100755
> +--- a/chipsec_main.py
> ++++ b/chipsec_main.py
> +@@ -215,7 +215,7 @@ class ChipsecMain:
> + while len(subdirs) > 0:
> + subdirs.pop()
> + for modx in mod_fnames:
> +- if fnmatch.fnmatch( modx, '*.py' ) and not fnmatch.fnmatch( modx, '__init__.py' ):
> ++ if fnmatch.fnmatch( modx, '*.pyc' ) and not fnmatch.fnmatch( modx, '__init__.pyc' ):
That's not the proper way to do this, since it may instead be a .pyo. Or it's
possible that the module wasn't compiled yet and there really is only a .py. So
you need to extend the fnmatch to match *.py, *.pyo and *.pyc.
> + self.load_module( os.path.join( dirname, modx ), self._module_argv )
> + self.Loaded_Modules.sort()
> +
> +--
> +2.17.1
> +
> diff --git a/package/chipsec/Config.in b/package/chipsec/Config.in
> new file mode 100644
> index 0000000000..3da41c14a6
> --- /dev/null
> +++ b/package/chipsec/Config.in
> @@ -0,0 +1,19 @@
> +config BR2_PACKAGE_CHIPSEC
> + bool "chipsec"
> + depends on BR2_LINUX_KERNEL
> + depends on BR2_PACKAGE_PYTHON3
We generally prefer a select instead of depends in this case (since it's not
immediately obvious that chipsec is a Python program). Of course, that means you
have to propagate the dependencies of python3. See e.g. libsigrokdecode.
> + depends on BR2_i386 || BR2_x86_64
> + select BR2_PACKAGE_PYTHON_SETUPTOOLS # runtime
I haven't checked, but does this package really require setuptools at runtime?
That's pretty unusual.
> +
> + help
> + CHIPSEC is a framework for analyzing the security of PC
> + platforms including hardware, system firmware (BIOS/UEFI),
> + and platform components.
> +
> + https://github.com/chipsec/chipsec
> +
> +comment "chipsec needs a Linux kernel to be built"
> + depends on !BR2_LINUX_KERNEL
You need to include the architecture dependencies here:
depends on BR2_i386 || BR2_x86_64
We don't want to show the comment if the package can't be selected anyway.
> +
> +comment "chipsec depends on python3"
> + depends on !BR2_PACKAGE_PYTHON3
> diff --git a/package/chipsec/chipsec.hash b/package/chipsec/chipsec.hash
> new file mode 100644
> index 0000000000..344eb4fab8
> --- /dev/null
> +++ b/package/chipsec/chipsec.hash
> @@ -0,0 +1,3 @@
> +# Locally calculated
> +sha256 0470326e00f66c91d751e9827d9e0050e3e4ac5b2bc7a9943a76381beda58162 chipsec-1.7.1.tar.gz
Please use two spaces after "sha256" (like the two spaces that come after the
hash itself).
> +sha256 4c2ca80f4d3675a53a216a64d67e7b411a81a6e958defd248c6f1ecf44dc6607 COPYING
> diff --git a/package/chipsec/chipsec.mk b/package/chipsec/chipsec.mk
> new file mode 100644
> index 0000000000..96d96176cc
> --- /dev/null
> +++ b/package/chipsec/chipsec.mk
> @@ -0,0 +1,23 @@
> +################################################################################
> +#
> +# chipsec
> +#
> +################################################################################
> +
> +CHIPSEC_VERSION = 1.7.1
> +CHIPSEC_SITE = $(call github,chipsec,chipsec,$(CHIPSEC_VERSION))
> +CHIPSEC_SETUP_TYPE = setuptools
> +CHIPSEC_LICENSE = GPL-2.0
> +CHIPSEC_LICENSE_FILES = LICENSE
> +CHIPSEC_DEPENDENCIES = linux
> +CHIPSEC_ENV = KSRC=$(LINUX_DIR)
> +CHIPSEC_BUILD_OPTS = build_ext -i
It would be good to document why these are needed.
> +
> +CHIPSEC_POST_INSTALL_TARGET_HOOKS += CHIPSEC_INSTALL_LKM
We normally put this just after the definition of the hook, not before it.
> +
> +define CHIPSEC_INSTALL_LKM
> + $(INSTALL) -m 0644 -D $(@D)/chipsec/helper/linux/chipsec.ko \
> + $(TARGET_DIR)/usr/lib/python$(PYTHON3_VERSION_MAJOR)/site-packages/chipsec/helper/linux
> +endef
We generally prefer to use Buildroot's infrastructure to build kernel modules
[2]. That takes care of the depmod, and passing the correct CFLAGS etc. to the
kernel build system.
However, in this case, it apparently needs to be installed in a nonstandard
location. If that really is the case, then this way is probably better. But
please add a comment to explain why.
Regards,
Arnout
[1] https://buildroot.org/downloads/manual/manual.html#DEVELOPERS
[2] https://buildroot.org/manual.html#kernel-module-tutorial
> +
> +$(eval $(python-package))
>
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 5+ messages in thread