* [Buildroot] [PATCH v2 0/2] lynis @ 2024-09-20 18:12 Francois Perrad 2024-09-20 18:12 ` [Buildroot] [PATCH v2 1/2] package/busybox: handle LIBFOO_BUSYBOX_CONFIG_FIXUPS Francois Perrad 2024-09-20 18:12 ` [Buildroot] [PATCH v2 2/2] package/lynis: new package Francois Perrad 0 siblings, 2 replies; 7+ messages in thread From: Francois Perrad @ 2024-09-20 18:12 UTC (permalink / raw) To: buildroot v1 --> v2: - refactor with LYNIS_BUSYBOX_CONFIG_FIXUPS note: the patch "package/busybox: handle LIBFOO_BUSYBOX_CONFIG_FIXUPS" was previously submitted in another serie, see https://patchwork.ozlabs.org/project/buildroot/patch/20240313091412.20865-2-francois.perrad@gadz.org/ note2: at this time, Buildroot is unknown to lynis, see https://github.com/CISOfy/lynis/issues/1520 Francois Perrad (2): package/busybox: handle LIBFOO_BUSYBOX_CONFIG_FIXUPS package/lynis: new package DEVELOPERS | 1 + docs/manual/adding-packages-generic.adoc | 6 +++ package/Config.in | 1 + package/busybox/busybox.mk | 1 + package/lynis/Config.in | 11 ++++++ package/lynis/lynis.hash | 3 ++ package/lynis/lynis.mk | 41 +++++++++++++++++++++ package/pkg-generic.mk | 3 ++ support/testing/tests/package/test_lynis.py | 23 ++++++++++++ 9 files changed, 90 insertions(+) create mode 100644 package/lynis/Config.in create mode 100644 package/lynis/lynis.hash create mode 100644 package/lynis/lynis.mk create mode 100644 support/testing/tests/package/test_lynis.py -- 2.43.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 7+ messages in thread
* [Buildroot] [PATCH v2 1/2] package/busybox: handle LIBFOO_BUSYBOX_CONFIG_FIXUPS 2024-09-20 18:12 [Buildroot] [PATCH v2 0/2] lynis Francois Perrad @ 2024-09-20 18:12 ` Francois Perrad 2024-10-07 14:53 ` Adam Duskett 2024-09-20 18:12 ` [Buildroot] [PATCH v2 2/2] package/lynis: new package Francois Perrad 1 sibling, 1 reply; 7+ messages in thread From: Francois Perrad @ 2024-09-20 18:12 UTC (permalink / raw) To: buildroot Signed-off-by: Francois Perrad <francois.perrad@gadz.org> --- docs/manual/adding-packages-generic.adoc | 6 ++++++ package/busybox/busybox.mk | 1 + package/pkg-generic.mk | 3 +++ 3 files changed, 10 insertions(+) diff --git a/docs/manual/adding-packages-generic.adoc b/docs/manual/adding-packages-generic.adoc index 89fc70045..f0b0508f5 100644 --- a/docs/manual/adding-packages-generic.adoc +++ b/docs/manual/adding-packages-generic.adoc @@ -631,6 +631,12 @@ different steps of the build process. This is seldom used, as package usually have no strict requirements on the kernel options. +* +LIBFOO_BUSYBOX_CONFIG_FIXUPS+ lists the Busybox configuration + options that are needed to use this package especially in some scripts, + or at contrario the useless options. This shall be a set of + calls to one of the kconfig tweaking option: `KCONFIG_ENABLE_OPT`, + `KCONFIG_DISABLE_OPT`, or `KCONFIG_SET_OPT`. + The preferred way to define these variables is: ---- diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk index 204ebe010..ef5521105 100644 --- a/package/busybox/busybox.mk +++ b/package/busybox/busybox.mk @@ -411,6 +411,7 @@ define BUSYBOX_KCONFIG_FIXUP_CMDS $(BUSYBOX_SET_SELINUX) $(BUSYBOX_SET_LESS_FLAGS) $(BUSYBOX_SET_INDIVIDUAL_BINARIES) + $(PACKAGES_BUSYBOX_CONFIG_FIXUPS) endef define BUSYBOX_BUILD_CMDS diff --git a/package/pkg-generic.mk b/package/pkg-generic.mk index 171163dcb..fecb68fc6 100644 --- a/package/pkg-generic.mk +++ b/package/pkg-generic.mk @@ -1237,6 +1237,9 @@ endif ifneq ($$($(2)_USERS),) PACKAGES_USERS += $$($(2)_USERS)$$(sep) endif +ifneq ($$($(2)_BUSYBOX_CONFIG_FIXUPS),) +PACKAGES_BUSYBOX_CONFIG_FIXUPS += $$($(2)_BUSYBOX_CONFIG_FIXUPS)$$(sep) +endif ifneq ($$($(2)_LINUX_CONFIG_FIXUPS),) PACKAGES_LINUX_CONFIG_FIXUPS += $$($(2)_LINUX_CONFIG_FIXUPS)$$(sep) endif -- 2.43.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [Buildroot] [PATCH v2 1/2] package/busybox: handle LIBFOO_BUSYBOX_CONFIG_FIXUPS 2024-09-20 18:12 ` [Buildroot] [PATCH v2 1/2] package/busybox: handle LIBFOO_BUSYBOX_CONFIG_FIXUPS Francois Perrad @ 2024-10-07 14:53 ` Adam Duskett 2024-10-07 14:54 ` Adam Duskett 0 siblings, 1 reply; 7+ messages in thread From: Adam Duskett @ 2024-10-07 14:53 UTC (permalink / raw) To: Francois Perrad; +Cc: buildroot test-by: adam duskett <aduskett@gmail.com> On Fri, Sep 20, 2024 at 8:13 PM Francois Perrad <francois.perrad@gadz.org> wrote: > > Signed-off-by: Francois Perrad <francois.perrad@gadz.org> > --- > docs/manual/adding-packages-generic.adoc | 6 ++++++ > package/busybox/busybox.mk | 1 + > package/pkg-generic.mk | 3 +++ > 3 files changed, 10 insertions(+) > > diff --git a/docs/manual/adding-packages-generic.adoc b/docs/manual/adding-packages-generic.adoc > index 89fc70045..f0b0508f5 100644 > --- a/docs/manual/adding-packages-generic.adoc > +++ b/docs/manual/adding-packages-generic.adoc > @@ -631,6 +631,12 @@ different steps of the build process. > This is seldom used, as package usually have no strict requirements on > the kernel options. > > +* +LIBFOO_BUSYBOX_CONFIG_FIXUPS+ lists the Busybox configuration > + options that are needed to use this package especially in some scripts, > + or at contrario the useless options. This shall be a set of > + calls to one of the kconfig tweaking option: `KCONFIG_ENABLE_OPT`, > + `KCONFIG_DISABLE_OPT`, or `KCONFIG_SET_OPT`. > + > The preferred way to define these variables is: > > ---- > diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk > index 204ebe010..ef5521105 100644 > --- a/package/busybox/busybox.mk > +++ b/package/busybox/busybox.mk > @@ -411,6 +411,7 @@ define BUSYBOX_KCONFIG_FIXUP_CMDS > $(BUSYBOX_SET_SELINUX) > $(BUSYBOX_SET_LESS_FLAGS) > $(BUSYBOX_SET_INDIVIDUAL_BINARIES) > + $(PACKAGES_BUSYBOX_CONFIG_FIXUPS) > endef > > define BUSYBOX_BUILD_CMDS > diff --git a/package/pkg-generic.mk b/package/pkg-generic.mk > index 171163dcb..fecb68fc6 100644 > --- a/package/pkg-generic.mk > +++ b/package/pkg-generic.mk > @@ -1237,6 +1237,9 @@ endif > ifneq ($$($(2)_USERS),) > PACKAGES_USERS += $$($(2)_USERS)$$(sep) > endif > +ifneq ($$($(2)_BUSYBOX_CONFIG_FIXUPS),) > +PACKAGES_BUSYBOX_CONFIG_FIXUPS += $$($(2)_BUSYBOX_CONFIG_FIXUPS)$$(sep) > +endif > ifneq ($$($(2)_LINUX_CONFIG_FIXUPS),) > PACKAGES_LINUX_CONFIG_FIXUPS += $$($(2)_LINUX_CONFIG_FIXUPS)$$(sep) > endif > -- > 2.43.0 > > _______________________________________________ > buildroot mailing list > buildroot@buildroot.org > https://lists.buildroot.org/mailman/listinfo/buildroot _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Buildroot] [PATCH v2 1/2] package/busybox: handle LIBFOO_BUSYBOX_CONFIG_FIXUPS 2024-10-07 14:53 ` Adam Duskett @ 2024-10-07 14:54 ` Adam Duskett 0 siblings, 0 replies; 7+ messages in thread From: Adam Duskett @ 2024-10-07 14:54 UTC (permalink / raw) To: Francois Perrad; +Cc: buildroot tested-by: adam duskett <aduskett@gmail.com> On Mon, Oct 7, 2024 at 4:53 PM Adam Duskett <aduskett@gmail.com> wrote: > > test-by: adam duskett <aduskett@gmail.com> > > On Fri, Sep 20, 2024 at 8:13 PM Francois Perrad > <francois.perrad@gadz.org> wrote: > > > > Signed-off-by: Francois Perrad <francois.perrad@gadz.org> > > --- > > docs/manual/adding-packages-generic.adoc | 6 ++++++ > > package/busybox/busybox.mk | 1 + > > package/pkg-generic.mk | 3 +++ > > 3 files changed, 10 insertions(+) > > > > diff --git a/docs/manual/adding-packages-generic.adoc b/docs/manual/adding-packages-generic.adoc > > index 89fc70045..f0b0508f5 100644 > > --- a/docs/manual/adding-packages-generic.adoc > > +++ b/docs/manual/adding-packages-generic.adoc > > @@ -631,6 +631,12 @@ different steps of the build process. > > This is seldom used, as package usually have no strict requirements on > > the kernel options. > > > > +* +LIBFOO_BUSYBOX_CONFIG_FIXUPS+ lists the Busybox configuration > > + options that are needed to use this package especially in some scripts, > > + or at contrario the useless options. This shall be a set of > > + calls to one of the kconfig tweaking option: `KCONFIG_ENABLE_OPT`, > > + `KCONFIG_DISABLE_OPT`, or `KCONFIG_SET_OPT`. > > + > > The preferred way to define these variables is: > > > > ---- > > diff --git a/package/busybox/busybox.mk b/package/busybox/busybox.mk > > index 204ebe010..ef5521105 100644 > > --- a/package/busybox/busybox.mk > > +++ b/package/busybox/busybox.mk > > @@ -411,6 +411,7 @@ define BUSYBOX_KCONFIG_FIXUP_CMDS > > $(BUSYBOX_SET_SELINUX) > > $(BUSYBOX_SET_LESS_FLAGS) > > $(BUSYBOX_SET_INDIVIDUAL_BINARIES) > > + $(PACKAGES_BUSYBOX_CONFIG_FIXUPS) > > endef > > > > define BUSYBOX_BUILD_CMDS > > diff --git a/package/pkg-generic.mk b/package/pkg-generic.mk > > index 171163dcb..fecb68fc6 100644 > > --- a/package/pkg-generic.mk > > +++ b/package/pkg-generic.mk > > @@ -1237,6 +1237,9 @@ endif > > ifneq ($$($(2)_USERS),) > > PACKAGES_USERS += $$($(2)_USERS)$$(sep) > > endif > > +ifneq ($$($(2)_BUSYBOX_CONFIG_FIXUPS),) > > +PACKAGES_BUSYBOX_CONFIG_FIXUPS += $$($(2)_BUSYBOX_CONFIG_FIXUPS)$$(sep) > > +endif > > ifneq ($$($(2)_LINUX_CONFIG_FIXUPS),) > > PACKAGES_LINUX_CONFIG_FIXUPS += $$($(2)_LINUX_CONFIG_FIXUPS)$$(sep) > > endif > > -- > > 2.43.0 > > > > _______________________________________________ > > buildroot mailing list > > buildroot@buildroot.org > > https://lists.buildroot.org/mailman/listinfo/buildroot _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 7+ messages in thread
* [Buildroot] [PATCH v2 2/2] package/lynis: new package 2024-09-20 18:12 [Buildroot] [PATCH v2 0/2] lynis Francois Perrad 2024-09-20 18:12 ` [Buildroot] [PATCH v2 1/2] package/busybox: handle LIBFOO_BUSYBOX_CONFIG_FIXUPS Francois Perrad @ 2024-09-20 18:12 ` Francois Perrad 2024-10-26 21:14 ` Thomas Petazzoni via buildroot 1 sibling, 1 reply; 7+ messages in thread From: Francois Perrad @ 2024-09-20 18:12 UTC (permalink / raw) To: buildroot Signed-off-by: Francois Perrad <francois.perrad@gadz.org> --- DEVELOPERS | 1 + package/Config.in | 1 + package/lynis/Config.in | 11 ++++++ package/lynis/lynis.hash | 3 ++ package/lynis/lynis.mk | 41 +++++++++++++++++++++ support/testing/tests/package/test_lynis.py | 23 ++++++++++++ 6 files changed, 80 insertions(+) create mode 100644 package/lynis/Config.in create mode 100644 package/lynis/lynis.hash create mode 100644 package/lynis/lynis.mk create mode 100644 support/testing/tests/package/test_lynis.py diff --git a/DEVELOPERS b/DEVELOPERS index 069965680..9c6c8c30b 100644 --- a/DEVELOPERS +++ b/DEVELOPERS @@ -1167,6 +1167,7 @@ F: package/lpty/ F: package/lrandom/ F: package/lsqlite3/ F: package/lua* +F: package/lynis/ F: package/lzlib/ F: package/moarvm/ F: package/mstpd/ diff --git a/package/Config.in b/package/Config.in index 6ceb826e9..35ed324c0 100644 --- a/package/Config.in +++ b/package/Config.in @@ -2700,6 +2700,7 @@ menu "Security" source "package/apparmor/Config.in" source "package/checkpolicy/Config.in" source "package/ima-evm-utils/Config.in" + source "package/lynis/Config.in" source "package/optee-client/Config.in" source "package/optee-examples/Config.in" source "package/optee-test/Config.in" diff --git a/package/lynis/Config.in b/package/lynis/Config.in new file mode 100644 index 000000000..3f64bc2e1 --- /dev/null +++ b/package/lynis/Config.in @@ -0,0 +1,11 @@ +config BR2_PACKAGE_LYNIS + bool "lynis" + select BR2_PACKAGE_BUSYBOX_SHOW_OTHERS + select BR2_PACKAGE_COREUTILS # runtime (stat) + select BR2_PACKAGE_GZIP # runtime (zgrep /proc/config.gz) + help + Lynis is an auditing tool which tests and gathers (security) + information from Unix based systems. + Written in shell and running on system itself. + + https://cisofy.com/lynis/ diff --git a/package/lynis/lynis.hash b/package/lynis/lynis.hash new file mode 100644 index 000000000..57b8b9afc --- /dev/null +++ b/package/lynis/lynis.hash @@ -0,0 +1,3 @@ +# Locally calculated +sha256 ca38a27c9c92e78877be4ecffce25f3345a1d24bbcd68be66a3a600e2ff748d1 lynis-3.1.1.tar.gz +sha256 57151f0fa287550534af08facb1c6693ca803ffa65b512da38b55c3130810bcf LICENSE diff --git a/package/lynis/lynis.mk b/package/lynis/lynis.mk new file mode 100644 index 000000000..b62911453 --- /dev/null +++ b/package/lynis/lynis.mk @@ -0,0 +1,41 @@ +################################################################################ +# +# lynis +# +################################################################################ + +LYNIS_VERSION = 3.1.1 +LYNIS_SITE = $(call github,CISOfy,lynis,$(LYNIS_VERSION)) +LYNIS_LICENSE = GPL-3.0 +LYNIS_LICENSE_FILES = LICENSE + +define LYNIS_INSTALL_TARGET_CMDS + $(INSTALL) -m 0755 $(@D)/lynis \ + $(TARGET_DIR)/usr/sbin/lynis + $(INSTALL) -D -m 0644 $(@D)/default.prf \ + $(TARGET_DIR)/etc/lynis/default.prf + $(INSTALL) -D -m 0644 $(@D)/developer.prf \ + $(TARGET_DIR)/etc/lynis/developer.prf + $(INSTALL) -D -m 0644 $(@D)/plugins/* \ + -t $(TARGET_DIR)/etc/lynis/plugins + $(INSTALL) -D -m 0644 $(@D)/include/* \ + -t $(TARGET_DIR)/usr/share/lynis/include + $(INSTALL) -D -m 0644 $(@D)/db/*.db \ + -t $(TARGET_DIR)/usr/share/lynis/db + $(INSTALL) -D -m 0644 $(@D)/db/languages/en \ + $(TARGET_DIR)/usr/share/lynis/db/languages/en +endef + +ifneq ($(BR2_PACKAGE_GAWK),y) +define LYNIS_AWK_BUSYBOX_CONFIG_FIXUPS + $(call KCONFIG_ENABLE_OPT,CONFIG_AWK) + $(call KCONFIG_ENABLE_OPT,CONFIG_FEATURE_AWK_LIBM) +endef +endif + +define LYNIS_BUSYBOX_CONFIG_FIXUPS + $(call KCONFIG_ENABLE_OPT,CONFIG_PGREP) + $(LYNIS_AWK_BUSYBOX_CONFIG_FIXUPS) +endef + +$(eval $(generic-package)) diff --git a/support/testing/tests/package/test_lynis.py b/support/testing/tests/package/test_lynis.py new file mode 100644 index 000000000..27e92aec0 --- /dev/null +++ b/support/testing/tests/package/test_lynis.py @@ -0,0 +1,23 @@ +import os + +import infra.basetest + + +class TestLynis(infra.basetest.BRTest): + config = infra.basetest.BASIC_TOOLCHAIN_CONFIG + \ + """ + BR2_TARGET_ROOTFS_CPIO=y + # BR2_TARGET_ROOTFS_TAR is not set + BR2_PACKAGE_LYNIS=y + """ + + def login(self): + cpio_file = os.path.join(self.builddir, "images", "rootfs.cpio") + self.emulator.boot(arch="armv5", + kernel="builtin", + options=["-initrd", cpio_file]) + self.emulator.login() + + def test_run(self): + self.login() + self.assertRunOk("lynis show version", timeout=90) -- 2.43.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [Buildroot] [PATCH v2 2/2] package/lynis: new package 2024-09-20 18:12 ` [Buildroot] [PATCH v2 2/2] package/lynis: new package Francois Perrad @ 2024-10-26 21:14 ` Thomas Petazzoni via buildroot 2024-10-27 10:28 ` François Perrad 0 siblings, 1 reply; 7+ messages in thread From: Thomas Petazzoni via buildroot @ 2024-10-26 21:14 UTC (permalink / raw) To: Francois Perrad; +Cc: buildroot Hello François, On Fri, 20 Sep 2024 20:12:12 +0200 Francois Perrad <francois.perrad@gadz.org> wrote: > diff --git a/package/lynis/Config.in b/package/lynis/Config.in > new file mode 100644 > index 000000000..3f64bc2e1 > --- /dev/null > +++ b/package/lynis/Config.in > @@ -0,0 +1,11 @@ > +config BR2_PACKAGE_LYNIS > + bool "lynis" > + select BR2_PACKAGE_BUSYBOX_SHOW_OTHERS > + select BR2_PACKAGE_COREUTILS # runtime (stat) The "stat" from Busybox cannot be used? > + def test_run(self): > + self.login() > + self.assertRunOk("lynis show version", timeout=90) Is this a useful enough test? Does it check that runtime dependencies are present and working? Thanks! Thomas -- Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Buildroot] [PATCH v2 2/2] package/lynis: new package 2024-10-26 21:14 ` Thomas Petazzoni via buildroot @ 2024-10-27 10:28 ` François Perrad 0 siblings, 0 replies; 7+ messages in thread From: François Perrad @ 2024-10-27 10:28 UTC (permalink / raw) To: buildroot; +Cc: Thomas Petazzoni [-- Attachment #1.1: Type: text/plain, Size: 1396 bytes --] Le sam. 26 oct. 2024 à 23:14, Thomas Petazzoni <thomas.petazzoni@bootlin.com> a écrit : > Hello François, > > On Fri, 20 Sep 2024 20:12:12 +0200 > Francois Perrad <francois.perrad@gadz.org> wrote: > > > diff --git a/package/lynis/Config.in b/package/lynis/Config.in > > new file mode 100644 > > index 000000000..3f64bc2e1 > > --- /dev/null > > +++ b/package/lynis/Config.in > > @@ -0,0 +1,11 @@ > > +config BR2_PACKAGE_LYNIS > > + bool "lynis" > > + select BR2_PACKAGE_BUSYBOX_SHOW_OTHERS > > + select BR2_PACKAGE_COREUTILS # runtime (stat) > > The "stat" from Busybox cannot be used? > > You are right. I could write something like: ifneq ($(BR2_PACKAGE_COREUTILS),y) define LYNIS_STAT_BUSYBOX_CONFIG_FIXUPS $(call KCONFIG_ENABLE_OPT,CONFIG_STAT) endef endif > > + def test_run(self): > > + self.login() > > + self.assertRunOk("lynis show version", timeout=90) > > Is this a useful enough test? Does it check that runtime dependencies > are present and working? > > Lynis has no installation process. So, the current goal of the test is to check what the installation of various components is correct (see LYNIS_INSTALL_TARGET_CMDS). François > Thanks! > > Thomas > -- > Thomas Petazzoni, co-owner and CEO, Bootlin > Embedded Linux and Kernel engineering and training > https://bootlin.com > [-- Attachment #1.2: Type: text/html, Size: 2420 bytes --] [-- Attachment #2: Type: text/plain, Size: 150 bytes --] _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2024-10-27 10:28 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2024-09-20 18:12 [Buildroot] [PATCH v2 0/2] lynis Francois Perrad 2024-09-20 18:12 ` [Buildroot] [PATCH v2 1/2] package/busybox: handle LIBFOO_BUSYBOX_CONFIG_FIXUPS Francois Perrad 2024-10-07 14:53 ` Adam Duskett 2024-10-07 14:54 ` Adam Duskett 2024-09-20 18:12 ` [Buildroot] [PATCH v2 2/2] package/lynis: new package Francois Perrad 2024-10-26 21:14 ` Thomas Petazzoni via buildroot 2024-10-27 10:28 ` François Perrad
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.