[meta-security][PATCH 01/17] bastille: UNPACKDIR fixes

[meta-security][PATCH 01/17] bastille: UNPACKDIR fixes

[Mikko Rapeli]

New poky version uses UNPACKDIR instead of WORKDIR

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 .../recipes-security/bastille/bastille_3.2.1.bb      | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/dynamic-layers/meta-perl/recipes-security/bastille/bastille_3.2.1.bb b/dynamic-layers/meta-perl/recipes-security/bastille/bastille_3.2.1.bb
index f2ef335..7074f68 100644
--- a/dynamic-layers/meta-perl/recipes-security/bastille/bastille_3.2.1.bb
+++ b/dynamic-layers/meta-perl/recipes-security/bastille/bastille_3.2.1.bb
@@ -83,11 +83,11 @@ do_install () {
 	install -m 0644 Bastille/AccountSecurity.pm    ${D}${libdir}/Bastille
 	install -m 0644 Bastille/Apache.pm    ${D}${libdir}/Bastille
 	install -m 0644 Bastille/API.pm    ${D}${libdir}/Bastille
-	install -m 0644 ${WORKDIR}/AccountPermission.pm    ${D}${libdir}/Bastille/API
-	install -m 0644 ${WORKDIR}/FileContent.pm    ${D}${libdir}/Bastille/API
-	install -m 0644 ${WORKDIR}/HPSpecific.pm    ${D}${libdir}/Bastille/API
-	install -m 0644 ${WORKDIR}/ServiceAdmin.pm    ${D}${libdir}/Bastille/API
-	install -m 0644 ${WORKDIR}/Miscellaneous.pm    ${D}${libdir}/Bastille/API
+	install -m 0644 ${UNPACKDIR}/AccountPermission.pm    ${D}${libdir}/Bastille/API
+	install -m 0644 ${UNPACKDIR}/FileContent.pm    ${D}${libdir}/Bastille/API
+	install -m 0644 ${UNPACKDIR}/HPSpecific.pm    ${D}${libdir}/Bastille/API
+	install -m 0644 ${UNPACKDIR}/ServiceAdmin.pm    ${D}${libdir}/Bastille/API
+	install -m 0644 ${UNPACKDIR}/Miscellaneous.pm    ${D}${libdir}/Bastille/API
 	install -m 0644 Bastille/BootSecurity.pm    ${D}${libdir}/Bastille
 	install -m 0644 Bastille/ConfigureMiscPAM.pm    ${D}${libdir}/Bastille
 	install -m 0644 Bastille/DisableUserTools.pm    ${D}${libdir}/Bastille
@@ -138,7 +138,7 @@ do_install () {
 	install -m 0644 OSMap/OSX.bastille    ${D}${datadir}/Bastille/OSMap
 	install -m 0644 OSMap/OSX.system    ${D}${datadir}/Bastille/OSMap
 
-	install -m 0644 ${WORKDIR}/config ${D}${sysconfdir}/Bastille/config
+	install -m 0644 ${UNPACKDIR}/config ${D}${sysconfdir}/Bastille/config
 
 	for file in `cat Modules.txt` ; do
 		install -m 0644 Questions/$file.txt ${D}${datadir}/Bastille/Questions
-- 
2.34.1

[meta-security][PATCH 02/17] python3-fail2ban: UNPACKDIR fix

[Mikko Rapeli]

New poky uses UNPACKDIR instead of WORKDIR

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 .../recipes-security/fail2ban/python3-fail2ban_1.0.2.bb         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dynamic-layers/meta-python/recipes-security/fail2ban/python3-fail2ban_1.0.2.bb b/dynamic-layers/meta-python/recipes-security/fail2ban/python3-fail2ban_1.0.2.bb
index bf5f87d..757336a 100644
--- a/dynamic-layers/meta-python/recipes-security/fail2ban/python3-fail2ban_1.0.2.bb
+++ b/dynamic-layers/meta-python/recipes-security/fail2ban/python3-fail2ban_1.0.2.bb
@@ -40,7 +40,7 @@ do_install:append () {
     rm  -f ${D}/${bindir}/fail2ban-python
     install -d ${D}/${sysconfdir}/fail2ban
     install -d ${D}/${sysconfdir}/init.d
-    install -m 0755 ${WORKDIR}/initd ${D}${sysconfdir}/init.d/fail2ban-server
+    install -m 0755 ${UNPACKDIR}/initd ${D}${sysconfdir}/init.d/fail2ban-server
 
     if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
         install -d ${D}${systemd_system_unitdir}
-- 
2.34.1

[meta-security][PATCH 03/17] initscripts: UNPACKDIR fixes

[Mikko Rapeli]

New poky uses UNPACKDIR instead of WORKDIR

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 .../recipes-core/initscripts/initscripts_1.0.bbappend           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta-hardening/recipes-core/initscripts/initscripts_1.0.bbappend b/meta-hardening/recipes-core/initscripts/initscripts_1.0.bbappend
index 92e364c..8af6979 100644
--- a/meta-hardening/recipes-core/initscripts/initscripts_1.0.bbappend
+++ b/meta-hardening/recipes-core/initscripts/initscripts_1.0.bbappend
@@ -4,5 +4,5 @@ SRC_URI:append:harden = " file://mountall.sh"
 
 do_install:append:harden() {
     install -d ${D}${sysconfdir}/init.d
-    install -m 0755 ${WORKDIR}/mountall.sh ${D}${sysconfdir}/init.d
+    install -m 0755 ${UNPACKDIR}/mountall.sh ${D}${sysconfdir}/init.d
 }
-- 
2.34.1

[meta-security][PATCH 04/17] initramfs-framework-ima: UNPACKDIR fix

[Mikko Rapeli]

New poky uses UNPACKDIR instead of WORKDIR

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 .../recipes-core/initrdscripts/initramfs-framework-ima.bb       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima.bb b/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima.bb
index 58cbe6e..fed4609 100644
--- a/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima.bb
+++ b/meta-integrity/recipes-core/initrdscripts/initramfs-framework-ima.bb
@@ -25,7 +25,7 @@ REQUIRED_DISTRO_FEATURES = "ima"
 do_install () {
     install -d ${D}/${sysconfdir}/ima
     install -d ${D}/init.d
-    install ${WORKDIR}/ima  ${D}/init.d/20-ima
+    install ${UNPACKDIR}/ima  ${D}/init.d/20-ima
 
     sed -i "s/@@FORCE_IMA@@/${IMA_FORCE}/g" ${D}/init.d/20-ima
 }
-- 
2.34.1

[meta-security][PATCH 05/17] ima-policy-appraise-all: UNPACKDIR fix

[Mikko Rapeli]

New poky uses UNPACKDIR instead of WORKDIR

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 .../ima_policy_appraise_all/ima-policy-appraise-all_1.0.bb      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta-integrity/recipes-security/ima_policy_appraise_all/ima-policy-appraise-all_1.0.bb b/meta-integrity/recipes-security/ima_policy_appraise_all/ima-policy-appraise-all_1.0.bb
index 5f2244e..88b3698 100644
--- a/meta-integrity/recipes-security/ima_policy_appraise_all/ima-policy-appraise-all_1.0.bb
+++ b/meta-integrity/recipes-security/ima_policy_appraise_all/ima-policy-appraise-all_1.0.bb
@@ -9,7 +9,7 @@ REQUIRED_DISTRO_FEATURES = "ima"
 
 do_install () {
     install -d ${D}/${sysconfdir}/ima
-    install ${WORKDIR}/ima_policy_appraise_all ${D}/${sysconfdir}/ima/ima-policy
+    install ${UNPACKDIR}/ima_policy_appraise_all ${D}/${sysconfdir}/ima/ima-policy
 }
 
 FILES:${PN} = "${sysconfdir}/ima"
-- 
2.34.1

[meta-security][PATCH 06/17] ima-policy-simple: UNPACKDIR fix

[Mikko Rapeli]

New poky uses UNPACKDIR instead of WORKDIR

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 .../recipes-security/ima_policy_simple/ima-policy-simple_1.0.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta-integrity/recipes-security/ima_policy_simple/ima-policy-simple_1.0.bb b/meta-integrity/recipes-security/ima_policy_simple/ima-policy-simple_1.0.bb
index 8fed410..69aec47 100644
--- a/meta-integrity/recipes-security/ima_policy_simple/ima-policy-simple_1.0.bb
+++ b/meta-integrity/recipes-security/ima_policy_simple/ima-policy-simple_1.0.bb
@@ -9,7 +9,7 @@ REQUIRED_DISTRO_FEATURES = "ima"
 
 do_install () {
     install -d ${D}/${sysconfdir}/ima
-    install ${WORKDIR}/ima_policy_simple ${D}/${sysconfdir}/ima/ima-policy
+    install ${UNPACKDIR}/ima_policy_simple ${D}/${sysconfdir}/ima/ima-policy
 }
 
 FILES:${PN} = "${sysconfdir}/ima"
-- 
2.34.1

[meta-security][PATCH 07/17] parsec-service: UNPACKDIR fixes

[Mikko Rapeli]

New poky uses UNPACKDIR instead of WORKDIR

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 .../recipes-parsec/parsec-service/parsec-service_1.4.1.bb     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta-parsec/recipes-parsec/parsec-service/parsec-service_1.4.1.bb b/meta-parsec/recipes-parsec/parsec-service/parsec-service_1.4.1.bb
index 2d55c24..3aa0b0a 100644
--- a/meta-parsec/recipes-parsec/parsec-service/parsec-service_1.4.1.bb
+++ b/meta-parsec/recipes-parsec/parsec-service/parsec-service_1.4.1.bb
@@ -61,12 +61,12 @@ do_install () {
         install -m 644 ${S}/systemd-daemon/parsec.service ${D}${systemd_unitdir}/system
 
         install -d ${D}${libdir}/tmpfiles.d
-        install -m 644 ${WORKDIR}/parsec-tmpfiles.conf ${D}${libdir}/tmpfiles.d
+        install -m 644 ${UNPACKDIR}/parsec-tmpfiles.conf ${D}${libdir}/tmpfiles.d
     fi
 
     if ${@bb.utils.contains('DISTRO_FEATURES', 'sysvinit', 'true', 'false', d)}; then
         install -d ${D}${sysconfdir}/init.d
-        install -m 755 ${WORKDIR}/parsec_init ${D}${sysconfdir}/init.d/parsec
+        install -m 755 ${UNPACKDIR}/parsec_init ${D}${sysconfdir}/init.d/parsec
         # Data dir
         install -d -m 700 -o parsec -g parsec "${D}${localstatedir}/lib/parsec"
     fi
-- 
2.34.1

[meta-security][PATCH 08/17] trousers: UNPACKDIR fixes

[Mikko Rapeli]

New poky uses UNPACKDIR instead of WORKDIR. Combine
with whitespace fixes.

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 .../recipes-tpm1/trousers/trousers_git.bb     | 22 +++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/meta-tpm/recipes-tpm1/trousers/trousers_git.bb b/meta-tpm/recipes-tpm1/trousers/trousers_git.bb
index 192c66c..0940f76 100644
--- a/meta-tpm/recipes-tpm1/trousers/trousers_git.bb
+++ b/meta-tpm/recipes-tpm1/trousers/trousers_git.bb
@@ -10,13 +10,13 @@ SRCREV = "94144b0a1dcef6e31845d6c319e9bd7357208eb9"
 PV = "0.3.15+git${SRCPV}"
 
 SRC_URI = " \
-	git://git.code.sf.net/p/trousers/trousers;branch=master \
-    	file://trousers.init.sh \
-    	file://trousers-udev.rules \
-    	file://tcsd.service \
-        file://get-user-ps-path-use-POSIX-getpwent-instead-of-getpwe.patch \
-        file://0001-build-don-t-override-localstatedir-mandir-sysconfdir.patch \
-    	"
+    git://git.code.sf.net/p/trousers/trousers;branch=master \
+    file://trousers.init.sh \
+    file://trousers-udev.rules \
+    file://tcsd.service \
+    file://get-user-ps-path-use-POSIX-getpwent-instead-of-getpwe.patch \
+    file://0001-build-don-t-override-localstatedir-mandir-sysconfdir.patch \
+"
 
 S = "${WORKDIR}/git"
 
@@ -32,15 +32,15 @@ do_install () {
 
 do_install:append() {
     install -d ${D}${sysconfdir}/init.d
-    install -m 0755 ${WORKDIR}/trousers.init.sh ${D}${sysconfdir}/init.d/trousers
+    install -m 0755 ${UNPACKDIR}/trousers.init.sh ${D}${sysconfdir}/init.d/trousers
     install -d ${D}${sysconfdir}/udev/rules.d
-    install -m 0644 ${WORKDIR}/trousers-udev.rules ${D}${sysconfdir}/udev/rules.d/45-trousers.rules
+    install -m 0644 ${UNPACKDIR}/trousers-udev.rules ${D}${sysconfdir}/udev/rules.d/45-trousers.rules
 
     if ${@bb.utils.contains('DISTRO_FEATURES','systemd','true','false',d)}; then
         install -d ${D}${systemd_unitdir}/system
-        install -m 0644 ${WORKDIR}/tcsd.service ${D}${systemd_unitdir}/system/
+        install -m 0644 ${UNPACKDIR}/tcsd.service ${D}${systemd_unitdir}/system/
         sed -i -e 's#@SBINDIR@#${sbindir}#g' ${D}${systemd_unitdir}/system/tcsd.service
-    fi        
+    fi
 }
 
 CONFFILES:${PN} += "${sysconfig}/tcsd.conf"
-- 
2.34.1

[meta-security][PATCH 09/17] aide: UNPACKDIR fixes

[Mikko Rapeli]

New poky uses UNPACKDIR instead of WORKDIR

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 recipes-ids/aide/aide_0.17.4.bb | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/recipes-ids/aide/aide_0.17.4.bb b/recipes-ids/aide/aide_0.17.4.bb
index 52ddc43..b1b9f10 100644
--- a/recipes-ids/aide/aide_0.17.4.bb
+++ b/recipes-ids/aide/aide_0.17.4.bb
@@ -33,9 +33,9 @@ PACKAGECONFIG[posix] = "--with-posix-acl, --without-posix-acl, acl, acl"
 do_install[nostamp] = "1"
 
 do_install:append () {
-    install -d ${D}${libdir}/${PN}/logs   
-    install -d ${D}${sysconfdir}   
-    install ${WORKDIR}/aide.conf ${D}${sysconfdir}/
+    install -d ${D}${libdir}/${PN}/logs
+    install -d ${D}${sysconfdir}
+    install ${UNPACKDIR}/aide.conf ${D}${sysconfdir}/
 
     for dir in ${AIDE_INCLUDE_DIRS}; do
         echo "${dir} NORMAL" >> ${D}${sysconfdir}/aide.conf
@@ -50,7 +50,7 @@ do_install:class-native () {
     install -d ${STAGING_AIDE_DIR}/lib/logs
 
     install ${B}/aide ${STAGING_AIDE_DIR}/bin
-    install ${WORKDIR}/aide.conf ${STAGING_AIDE_DIR}/
+    install ${UNPACKDIR}/aide.conf ${STAGING_AIDE_DIR}/
 
     sed -i -s "s:\@\@define DBDIR.*:\@\@define DBDIR ${STAGING_AIDE_DIR}/lib:" ${STAGING_AIDE_DIR}/aide.conf
     sed -i -e "s:\@\@define LOGDIR.*:\@\@define LOGDIR ${STAGING_AIDE_DIR}/lib/logs:" ${STAGING_AIDE_DIR}/aide.conf
-- 
2.34.1

[meta-security][PATCH 10/17] suricata: UNPACKDIR fix

[Mikko Rapeli]

New poky uses UNPACKDIR instead of WORKDIR

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 recipes-ids/suricata/suricata_7.0.0.bb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/recipes-ids/suricata/suricata_7.0.0.bb b/recipes-ids/suricata/suricata_7.0.0.bb
index 21d4306..d87cebd 100644
--- a/recipes-ids/suricata/suricata_7.0.0.bb
+++ b/recipes-ids/suricata/suricata_7.0.0.bb
@@ -91,7 +91,7 @@ do_install () {
 
     if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
         install -d ${D}${sysconfdir}/tmpfiles.d
-        install -m 0644 ${WORKDIR}/tmpfiles.suricata ${D}${sysconfdir}/tmpfiles.d/suricata.conf
+        install -m 0644 ${UNPACKDIR}/tmpfiles.suricata ${D}${sysconfdir}/tmpfiles.d/suricata.conf
 
         install -d ${D}${systemd_unitdir}/system
         sed  -e s:/etc:${sysconfdir}:g \
@@ -100,7 +100,7 @@ do_install () {
              -e s:/usr/bin:${bindir}:g \
              -e s:/bin/kill:${base_bindir}/kill:g \
              -e s:/usr/lib:${libdir}:g \
-             ${WORKDIR}/suricata.service > ${D}${systemd_unitdir}/system/suricata.service
+             ${UNPACKDIR}/suricata.service > ${D}${systemd_unitdir}/system/suricata.service
     fi
 
     # Remove /var/run as it is created on startup
-- 
2.34.1

[meta-security][PATCH 11/17] arpwatch: UNPACKDIR fixes

[Mikko Rapeli]

New poky uses UNPACKDIR instead of WORKDIR

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 recipes-scanners/arpwatch/arpwatch_3.3.bb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/recipes-scanners/arpwatch/arpwatch_3.3.bb b/recipes-scanners/arpwatch/arpwatch_3.3.bb
index e547938..cacfea7 100644
--- a/recipes-scanners/arpwatch/arpwatch_3.3.bb
+++ b/recipes-scanners/arpwatch/arpwatch_3.3.bb
@@ -60,9 +60,9 @@ do_install () {
     install -d ${D}/var/lib/arpwatch
 
     oe_runmake install DESTDIR=${D}
-    install -m 644 ${WORKDIR}/arpwatch.conf  ${D}${sysconfdir}
-    install -m 655 ${WORKDIR}/arpwatch_init  ${D}${sysconfdir}/init.d/arpwatch
-    install -m 644 ${WORKDIR}/arpwatch.default  ${D}${sysconfdir}/default
+    install -m 644 ${UNPACKDIR}/arpwatch.conf  ${D}${sysconfdir}
+    install -m 655 ${UNPACKDIR}/arpwatch_init  ${D}${sysconfdir}/init.d/arpwatch
+    install -m 644 ${UNPACKDIR}/arpwatch.default  ${D}${sysconfdir}/default
 }
 
 INITSCRIPT_NAME = "arpwatch"
-- 
2.34.1

[meta-security][PATCH 12/17] clamav: UNPACKDIR fixes

[Mikko Rapeli]

New poky uses UNPACKDIR instead of WORKDIR

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 recipes-scanners/clamav/clamav_0.104.4.bb | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/recipes-scanners/clamav/clamav_0.104.4.bb b/recipes-scanners/clamav/clamav_0.104.4.bb
index 102f267..ad9e124 100644
--- a/recipes-scanners/clamav/clamav_0.104.4.bb
+++ b/recipes-scanners/clamav/clamav_0.104.4.bb
@@ -58,9 +58,9 @@ do_install:append () {
     install -d -o ${PN} -g ${CLAMAV_GID} ${D}/${localstatedir}/lib/clamav
     install -d ${D}${sysconfdir}/clamav ${D}${sysconfdir}/default/volatiles
 
-    install -m 644 ${WORKDIR}/clamd.conf ${D}/${prefix}/${sysconfdir}
-    install -m 644 ${WORKDIR}/freshclam.conf ${D}/${prefix}/${sysconfdir}
-    install -m 0644 ${WORKDIR}/volatiles.03_clamav  ${D}${sysconfdir}/default/volatiles/03_clamav
+    install -m 644 ${UNPACKDIR}/clamd.conf ${D}/${prefix}/${sysconfdir}
+    install -m 644 ${UNPACKDIR}/freshclam.conf ${D}/${prefix}/${sysconfdir}
+    install -m 0644 ${UNPACKDIR}/volatiles.03_clamav  ${D}${sysconfdir}/default/volatiles/03_clamav
     sed -i -e 's#${STAGING_DIR_HOST}##g' ${D}${libdir}/pkgconfig/libclamav.pc
     rm ${D}/${libdir}/libclamav.so
     if [ "${INSTALL_CLAMAV_CVD}" = "1" ]; then
@@ -71,7 +71,7 @@ do_install:append () {
 
     if ${@bb.utils.contains('DISTRO_FEATURES','systemd','true','false',d)};then
         install -d ${D}${sysconfdir}/tmpfiles.d
-        install -m 0644 ${WORKDIR}/tmpfiles.clamav ${D}${sysconfdir}/tmpfiles.d/clamav.conf
+        install -m 0644 ${UNPACKDIR}/tmpfiles.clamav ${D}${sysconfdir}/tmpfiles.d/clamav.conf
     fi
     oe_multilib_header clamav-types.h
 }
-- 
2.34.1

[meta-security][PATCH 13/17] arpwatch: disable compiler errors

[Mikko Rapeli]

Old code throws new warnings and fails to compile.
Work around the issues.

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 recipes-scanners/arpwatch/arpwatch_3.3.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/recipes-scanners/arpwatch/arpwatch_3.3.bb b/recipes-scanners/arpwatch/arpwatch_3.3.bb
index cacfea7..a3f42f8 100644
--- a/recipes-scanners/arpwatch/arpwatch_3.3.bb
+++ b/recipes-scanners/arpwatch/arpwatch_3.3.bb
@@ -45,6 +45,8 @@ CONFIGUREOPTS = " --build=${BUILD_SYS} \
           --with-sendmail=${sbindir}/sendmail \
           "
 
+CFLAGS += "-Wno-error=implicit-int -Wno-error=implicit-function-declaration -Wno-error=unused-result"
+
 do_configure () {
     ${S}/configure ${CONFIGUREOPTS}
 }
-- 
2.34.1

[meta-security][PATCH 14/17] ima-policy-hashed: set S

[Mikko Rapeli]

Build with latest poky fails without

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 .../recipes-security/ima_policy_hashed/ima-policy-hashed_1.0.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta-integrity/recipes-security/ima_policy_hashed/ima-policy-hashed_1.0.bb b/meta-integrity/recipes-security/ima_policy_hashed/ima-policy-hashed_1.0.bb
index 8c670e8..3de7497 100644
--- a/meta-integrity/recipes-security/ima_policy_hashed/ima-policy-hashed_1.0.bb
+++ b/meta-integrity/recipes-security/ima_policy_hashed/ima-policy-hashed_1.0.bb
@@ -6,6 +6,8 @@ SRC_URI = " \
     file://ima_policy_hashed \
 "
 
+S = "${WORKDIR}/${BP}"
+
 inherit features_check
 REQUIRED_DISTRO_FEATURES = "ima"
 
-- 
2.34.1

[meta-security][PATCH 15/17] ima-policy-appraise-all: set S

[Mikko Rapeli]

Build with latest poky requires it

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 .../ima_policy_appraise_all/ima-policy-appraise-all_1.0.bb      | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta-integrity/recipes-security/ima_policy_appraise_all/ima-policy-appraise-all_1.0.bb b/meta-integrity/recipes-security/ima_policy_appraise_all/ima-policy-appraise-all_1.0.bb
index 88b3698..121e9ff 100644
--- a/meta-integrity/recipes-security/ima_policy_appraise_all/ima-policy-appraise-all_1.0.bb
+++ b/meta-integrity/recipes-security/ima_policy_appraise_all/ima-policy-appraise-all_1.0.bb
@@ -4,6 +4,8 @@ LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384
 
 SRC_URI = " file://ima_policy_appraise_all"
 
+S = "${WORKDIR}/${BP}"
+
 inherit features_check
 REQUIRED_DISTRO_FEATURES = "ima"
 
-- 
2.34.1

[meta-security][PATCH 16/17] ima-policy-simple: set S

[Mikko Rapeli]

Build with latest poky fails without it

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 .../recipes-security/ima_policy_simple/ima-policy-simple_1.0.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta-integrity/recipes-security/ima_policy_simple/ima-policy-simple_1.0.bb b/meta-integrity/recipes-security/ima_policy_simple/ima-policy-simple_1.0.bb
index 69aec47..8b30858 100644
--- a/meta-integrity/recipes-security/ima_policy_simple/ima-policy-simple_1.0.bb
+++ b/meta-integrity/recipes-security/ima_policy_simple/ima-policy-simple_1.0.bb
@@ -4,6 +4,8 @@ LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384
 
 SRC_URI = " file://ima_policy_simple"
 
+S = "${WORKDIR}/${BP}"
+
 inherit features_check
 REQUIRED_DISTRO_FEATURES = "ima"
 
-- 
2.34.1

[meta-security][PATCH 17/17] suricata: remove build paths

[Mikko Rapeli]

Remove build time tool paths from build info
which gets embedded into binaries.

Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
---
 ...uricata-remove-paths-from-build-info.patch | 56 +++++++++++++++++++
 recipes-ids/suricata/suricata_7.0.0.bb        |  1 +
 2 files changed, 57 insertions(+)
 create mode 100644 recipes-ids/suricata/files/0001-suricata-remove-paths-from-build-info.patch

diff --git a/recipes-ids/suricata/files/0001-suricata-remove-paths-from-build-info.patch b/recipes-ids/suricata/files/0001-suricata-remove-paths-from-build-info.patch
new file mode 100644
index 0000000..ebd1433
--- /dev/null
+++ b/recipes-ids/suricata/files/0001-suricata-remove-paths-from-build-info.patch
@@ -0,0 +1,56 @@
+From 3d11a6a8c764e4af2f24cc4cf56b4943a3aa212a Mon Sep 17 00:00:00 2001
+From: Mikko Rapeli <mikko.rapeli@linaro.org>
+Date: Thu, 25 Jul 2024 08:31:21 +0000
+Subject: [PATCH] suricata: remove paths from build info
+
+Remove paths etc from build info to fix build reproduction
+issues.
+
+Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
+---
+ configure.ac | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+Upstream-Status: Inappropriate [configuration]
+
+diff --git a/configure.ac b/configure.ac
+index 5258f3d..9712c9b 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -2632,13 +2632,13 @@ SURICATA_BUILD_CONF="Suricata Configuration:
+ 
+   Rust support:                            ${enable_rust}
+   Rust strict mode:                        ${enable_rust_strict}
+-  Rust compiler path:                      ${RUSTC}
++  Rust compiler path:                      
+   Rust compiler version:                   ${rust_compiler_version}
+-  Cargo path:                              ${CARGO}
++  Cargo path:                              
+   Cargo version:                           ${cargo_version_output}
+ 
+   Python support:                          ${enable_python}
+-  Python path:                             ${python_path}
++  Python path:                             
+   Install suricatactl:                     ${install_suricatactl}
+   Install suricatasc:                      ${install_suricatactl}
+   Install suricata-update:                 ${install_suricata_update}${install_suricata_update_reason}
+@@ -2667,13 +2667,13 @@ Generic build parameters:
+   --localstatedir                          ${CONFIGURE_LOCALSTATEDIR}
+   --datarootdir                            ${CONFIGURE_DATAROOTDIR}
+ 
+-  Host:                                    ${host}
+-  Compiler:                                ${CC} (exec name) / ${compiler} (real)
++  Host:                                    
++  Compiler:                                
+   GCC Protect enabled:                     ${enable_gccprotect}
+   GCC march native enabled:                ${enable_gccmarch_native}
+   GCC Profile enabled:                     ${enable_gccprofile}
+   Position Independent Executable enabled: ${enable_pie}
+-  CFLAGS                                   ${CFLAGS}
++  CFLAGS                                   
+   PCAP_CFLAGS                              ${PCAP_CFLAGS}
+   SECCFLAGS                                ${SECCFLAGS}"
+ 
+-- 
+2.34.1
+
diff --git a/recipes-ids/suricata/suricata_7.0.0.bb b/recipes-ids/suricata/suricata_7.0.0.bb
index d87cebd..35ac8c0 100644
--- a/recipes-ids/suricata/suricata_7.0.0.bb
+++ b/recipes-ids/suricata/suricata_7.0.0.bb
@@ -10,6 +10,7 @@ SRC_URI[sha256sum] = "7bcd1313118366451465dc3f8385a3f6aadd084ffe44dd257dda810586
 DEPENDS = "lz4 libhtp"
 
 SRC_URI += " \
+    file://0001-suricata-remove-paths-from-build-info.patch \
     file://volatiles.03_suricata \
     file://tmpfiles.suricata \
     file://suricata.yaml \
-- 
2.34.1

Re: [yocto-patches] [meta-security][PATCH 01/17] bastille: UNPACKDIR fixes

[Martin Jansa]

new poky?

poky is just reference distribution and name of a repo. The change was
implemented in and is required by new oe-core.

On Thu, Jul 25, 2024 at 11:02 AM Mikko Rapeli via
lists.yoctoproject.org
<mikko.rapeli=linaro.org@lists.yoctoproject.org> wrote:
>
> New poky version uses UNPACKDIR instead of WORKDIR
>
> Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
> ---
>  .../recipes-security/bastille/bastille_3.2.1.bb      | 12 ++++++------
>  1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/dynamic-layers/meta-perl/recipes-security/bastille/bastille_3.2.1.bb b/dynamic-layers/meta-perl/recipes-security/bastille/bastille_3.2.1.bb
> index f2ef335..7074f68 100644
> --- a/dynamic-layers/meta-perl/recipes-security/bastille/bastille_3.2.1.bb
> +++ b/dynamic-layers/meta-perl/recipes-security/bastille/bastille_3.2.1.bb
> @@ -83,11 +83,11 @@ do_install () {
>         install -m 0644 Bastille/AccountSecurity.pm    ${D}${libdir}/Bastille
>         install -m 0644 Bastille/Apache.pm    ${D}${libdir}/Bastille
>         install -m 0644 Bastille/API.pm    ${D}${libdir}/Bastille
> -       install -m 0644 ${WORKDIR}/AccountPermission.pm    ${D}${libdir}/Bastille/API
> -       install -m 0644 ${WORKDIR}/FileContent.pm    ${D}${libdir}/Bastille/API
> -       install -m 0644 ${WORKDIR}/HPSpecific.pm    ${D}${libdir}/Bastille/API
> -       install -m 0644 ${WORKDIR}/ServiceAdmin.pm    ${D}${libdir}/Bastille/API
> -       install -m 0644 ${WORKDIR}/Miscellaneous.pm    ${D}${libdir}/Bastille/API
> +       install -m 0644 ${UNPACKDIR}/AccountPermission.pm    ${D}${libdir}/Bastille/API
> +       install -m 0644 ${UNPACKDIR}/FileContent.pm    ${D}${libdir}/Bastille/API
> +       install -m 0644 ${UNPACKDIR}/HPSpecific.pm    ${D}${libdir}/Bastille/API
> +       install -m 0644 ${UNPACKDIR}/ServiceAdmin.pm    ${D}${libdir}/Bastille/API
> +       install -m 0644 ${UNPACKDIR}/Miscellaneous.pm    ${D}${libdir}/Bastille/API
>         install -m 0644 Bastille/BootSecurity.pm    ${D}${libdir}/Bastille
>         install -m 0644 Bastille/ConfigureMiscPAM.pm    ${D}${libdir}/Bastille
>         install -m 0644 Bastille/DisableUserTools.pm    ${D}${libdir}/Bastille
> @@ -138,7 +138,7 @@ do_install () {
>         install -m 0644 OSMap/OSX.bastille    ${D}${datadir}/Bastille/OSMap
>         install -m 0644 OSMap/OSX.system    ${D}${datadir}/Bastille/OSMap
>
> -       install -m 0644 ${WORKDIR}/config ${D}${sysconfdir}/Bastille/config
> +       install -m 0644 ${UNPACKDIR}/config ${D}${sysconfdir}/Bastille/config
>
>         for file in `cat Modules.txt` ; do
>                 install -m 0644 Questions/$file.txt ${D}${datadir}/Bastille/Questions
> --
> 2.34.1
>
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#458): https://lists.yoctoproject.org/g/yocto-patches/message/458
> Mute This Topic: https://lists.yoctoproject.org/mt/107539467/3617156
> Group Owner: yocto-patches+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/yocto-patches/leave/13388836/3617156/66960823/xyzzy [martin.jansa@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

Re: [yocto-patches] [meta-security][PATCH 01/17] bastille: UNPACKDIR fixes

[Mikko Rapeli]

Hi,

On Thu, Jul 25, 2024 at 12:35:58PM +0200, Martin Jansa wrote:
> new poky?
> 
> poky is just reference distribution and name of a repo. The change was
> implemented in and is required by new oe-core.

If I use poky together with other layers and update to poky
requires this change then I don't it's wrong to say that new poky
version needs this.

Should I change this commit message to something else in a v2?

Cheers,

-Mikko

Re: [yocto-patches] [meta-security][PATCH 01/17] bastille: UNPACKDIR fixes

[akuster808]

Mikko,

Is this series different then the one I posted a few days earlier?

- armin

On 7/25/24 5:01 AM, Mikko Rapeli via lists.yoctoproject.org wrote:
> New poky version uses UNPACKDIR instead of WORKDIR
>
> Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
> ---
>   .../recipes-security/bastille/bastille_3.2.1.bb      | 12 ++++++------
>   1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/dynamic-layers/meta-perl/recipes-security/bastille/bastille_3.2.1.bb b/dynamic-layers/meta-perl/recipes-security/bastille/bastille_3.2.1.bb
> index f2ef335..7074f68 100644
> --- a/dynamic-layers/meta-perl/recipes-security/bastille/bastille_3.2.1.bb
> +++ b/dynamic-layers/meta-perl/recipes-security/bastille/bastille_3.2.1.bb
> @@ -83,11 +83,11 @@ do_install () {
>   	install -m 0644 Bastille/AccountSecurity.pm    ${D}${libdir}/Bastille
>   	install -m 0644 Bastille/Apache.pm    ${D}${libdir}/Bastille
>   	install -m 0644 Bastille/API.pm    ${D}${libdir}/Bastille
> -	install -m 0644 ${WORKDIR}/AccountPermission.pm    ${D}${libdir}/Bastille/API
> -	install -m 0644 ${WORKDIR}/FileContent.pm    ${D}${libdir}/Bastille/API
> -	install -m 0644 ${WORKDIR}/HPSpecific.pm    ${D}${libdir}/Bastille/API
> -	install -m 0644 ${WORKDIR}/ServiceAdmin.pm    ${D}${libdir}/Bastille/API
> -	install -m 0644 ${WORKDIR}/Miscellaneous.pm    ${D}${libdir}/Bastille/API
> +	install -m 0644 ${UNPACKDIR}/AccountPermission.pm    ${D}${libdir}/Bastille/API
> +	install -m 0644 ${UNPACKDIR}/FileContent.pm    ${D}${libdir}/Bastille/API
> +	install -m 0644 ${UNPACKDIR}/HPSpecific.pm    ${D}${libdir}/Bastille/API
> +	install -m 0644 ${UNPACKDIR}/ServiceAdmin.pm    ${D}${libdir}/Bastille/API
> +	install -m 0644 ${UNPACKDIR}/Miscellaneous.pm    ${D}${libdir}/Bastille/API
>   	install -m 0644 Bastille/BootSecurity.pm    ${D}${libdir}/Bastille
>   	install -m 0644 Bastille/ConfigureMiscPAM.pm    ${D}${libdir}/Bastille
>   	install -m 0644 Bastille/DisableUserTools.pm    ${D}${libdir}/Bastille
> @@ -138,7 +138,7 @@ do_install () {
>   	install -m 0644 OSMap/OSX.bastille    ${D}${datadir}/Bastille/OSMap
>   	install -m 0644 OSMap/OSX.system    ${D}${datadir}/Bastille/OSMap
>   
> -	install -m 0644 ${WORKDIR}/config ${D}${sysconfdir}/Bastille/config
> +	install -m 0644 ${UNPACKDIR}/config ${D}${sysconfdir}/Bastille/config
>   
>   	for file in `cat Modules.txt` ; do
>   		install -m 0644 Questions/$file.txt ${D}${datadir}/Bastille/Questions

Re: [yocto-patches] [meta-security][PATCH 01/17] bastille: UNPACKDIR fixes

[Mikko Rapeli]

Hi,

On Sun, Jul 28, 2024 at 01:01:10PM -0400, akuster808 wrote:
> Mikko,
> 
> Is this series different then the one I posted a few days earlier?

Yes, it's different. I missed your series, sorry about that. I guess you
mean https://lists.yoctoproject.org/g/yocto-patches/message/446

I submitted fixes for the issues I see in my environment and when
trying to compile some of the recipes in meta-security
after making changing. I don't mind which patch goes in.

Cheers,

-Mikko

Re: [yocto-patches] [meta-security][PATCH 01/17] bastille: UNPACKDIR fixes

[Mikko Rapeli]

Hi,

On Mon, Jul 29, 2024 at 10:54:52AM +0300, Mikko Rapeli via lists.yoctoproject.org wrote:
> Hi,
> 
> On Sun, Jul 28, 2024 at 01:01:10PM -0400, akuster808 wrote:
> > Mikko,
> > 
> > Is this series different then the one I posted a few days earlier?
> 
> Yes, it's different. I missed your series, sorry about that. I guess you
> mean https://lists.yoctoproject.org/g/yocto-patches/message/446
> 
> I submitted fixes for the issues I see in my environment and when
> trying to compile some of the recipes in meta-security
> after making changing. I don't mind which patch goes in.

master-next branch is ok for me with the just submitted meta-parsec fix.

Thanks!

-Mikko