From patchwork Wed Jun 14 12:08:19 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: akuster808 X-Patchwork-Id: 25625 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8C379EB64D9 for ; Wed, 14 Jun 2023 12:08:25 +0000 (UTC) Received: from mail-yw1-f173.google.com (mail-yw1-f173.google.com [209.85.128.173]) by mx.groups.io with SMTP id smtpd.web11.9964.1686744503619090167 for ; Wed, 14 Jun 2023 05:08:23 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="signature has expired" header.i=@gmail.com header.s=20221208 header.b=CfjUJ9GX; spf=pass (domain: gmail.com, ip: 209.85.128.173, mailfrom: akuster808@gmail.com) Received: by mail-yw1-f173.google.com with SMTP id 00721157ae682-56d1ca11031so6713617b3.2 for ; Wed, 14 Jun 2023 05:08:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1686744502; x=1689336502; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=9MHaTipuIKR8nuD1WDzZBYd1BYytWKHHV6v0ll5BYRg=; b=CfjUJ9GX5oKIW1LZbOGWD61Knl5/hO7Nlgsr0YvJyFctkkTXWePMI6aGb4+9NjVjei qXM75rF08f44zZerkSHNG0cU+SzC2n6nulzJmn4biqGXFZbAYcxlH0Og6BPNGCKZrOGj 1s5ktmHIZsW3bX4misFN2hsNFvT/wabslyjhR6doOoecKnXwAczt5Id5+PXh11FfeoUb biKzQO7EkwkmM7CeGZUkkp1+tRat3HUj6e+udJtGtPc0pa6yFIgojS75DE161tX46azG 1jqlDdEkPpaoPgD6CumAYlyTxMiQGjw3a2l6K2NIINHDT+wpoPlwWkCQjZmcguUzGMFX 7+6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1686744502; x=1689336502; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=9MHaTipuIKR8nuD1WDzZBYd1BYytWKHHV6v0ll5BYRg=; b=Mik7uxX50RLBhd52SPlzmUgpF7ZYzow/fuOttxGryQp+rS5pxSQK7KifgrnnUVl3Ea lWGtknO9xBkHH38zGAX1jJp6qjmHt+NDz4E0L0HRiwRNMp2C+n84NeSvbmSXgongw7Jm 5wICiPkJJj7mnT/oPmh1a8EBjFezDTQiX/+o8ej1jgDaVlstBea/Cjg9B6jE5Bap82BZ v6llF/TicesOpn9TfsGoTBOjD0VXFfnQUIqwIHcHWkBKcwDaavTLJTgTFe+WB4kmf68w P6nE3jEcXa3WZYw2wXr7PpE1RF3Ud6SFQKe33w/CT//msrU3gVtMSGzHYFa16qOf9y4y jYVA== X-Gm-Message-State: AC+VfDwmqr1x80MlaoEMNXBNXSE8Zs3z+tsYAkSVh6E3uR7WGLSCanZZ VNb9Ut7RkCsE7uEpiN3BxShbLVoKE0g= X-Google-Smtp-Source: ACHHUZ7lcS9Vi0wtqd5LOpZcFJ7axd+IX+Yilqp9w979fmZdnC8Qkjlnsg6ff0O/ReeB1FXOmqYmlw== X-Received: by 2002:a0d:d844:0:b0:56c:f0c7:90cf with SMTP id a65-20020a0dd844000000b0056cf0c790cfmr1612606ywe.48.1686744502258; Wed, 14 Jun 2023 05:08:22 -0700 (PDT) Received: from keaua.attlocal.net ([2600:1700:9190:ba10:5ba9:9ead:a276:1e7c]) by smtp.gmail.com with ESMTPSA id z14-20020a81a24e000000b005461671a79csm638634ywg.138.2023.06.14.05.08.21 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Jun 2023 05:08:21 -0700 (PDT) From: Armin Kuster To: yocto@lists.yoctoproject.org Subject: [meta-security][PATCH 1/2] openscap: add support for OpenEmbedded nodistro and Poky Date: Wed, 14 Jun 2023 08:08:19 -0400 Message-Id: <20230614120820.119607-1-akuster808@gmail.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 14 Jun 2023 12:08:25 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/yocto/message/60298 Signed-off-by: Armin Kuster --- .../0001-openscap-Add-openembedded.patch | 128 ++++++++++++++++++ .../0002-openembedded-add-Poky-distro.patch | 80 +++++++++++ recipes-compliance/openscap/openscap_1.3.7.bb | 9 +- 3 files changed, 215 insertions(+), 2 deletions(-) create mode 100644 recipes-compliance/openscap/files/0001-openscap-Add-openembedded.patch create mode 100644 recipes-compliance/openscap/files/0002-openembedded-add-Poky-distro.patch diff --git a/recipes-compliance/openscap/files/0001-openscap-Add-openembedded.patch b/recipes-compliance/openscap/files/0001-openscap-Add-openembedded.patch new file mode 100644 index 0000000..1af72bb --- /dev/null +++ b/recipes-compliance/openscap/files/0001-openscap-Add-openembedded.patch @@ -0,0 +1,128 @@ +From 8f8b580a882e9584e2b3726dab2c3f8e01cb885f Mon Sep 17 00:00:00 2001 +From: Armin Kuster +Date: Sun, 4 Jun 2023 20:16:12 -0400 +Subject: [PATCH 1/2] openscap: Add openembedded + +Signed-off-by: Armin Kuster + +Upstream-Status: Pending +Signed-off-by: Armin Kuster + +--- + cpe/openscap-cpe-dict.xml | 5 +++ + cpe/openscap-cpe-oval.xml | 45 +++++++++++++++++++++------ + src/OVAL/probes/unix/runlevel_probe.c | 8 ++++- + 3 files changed, 47 insertions(+), 11 deletions(-) + +diff --git a/cpe/openscap-cpe-dict.xml b/cpe/openscap-cpe-dict.xml +index 02d536189..3338a9e55 100644 +--- a/cpe/openscap-cpe-dict.xml ++++ b/cpe/openscap-cpe-dict.xml +@@ -53,4 +53,9 @@ + Fedora 35 + oval:org.open-scap.cpe.fedora:def:35 + ++ ++ OpenEmbedded all versions ++ oval:org.open-scap.cpe.openembedded:def:1 ++ ++ + +diff --git a/cpe/openscap-cpe-oval.xml b/cpe/openscap-cpe-oval.xml +index 64099400b..2f3e25419 100644 +--- a/cpe/openscap-cpe-oval.xml ++++ b/cpe/openscap-cpe-oval.xml +@@ -821,6 +821,20 @@ + + + ++ ++ ++ OpenEmbedded Org ++ ++ OpenEmbedded Nodistro ++ ++ ++ OpenEmbedded No Distro is installed ++ ++ ++ ++ ++ ++ + + + SOFTWARE\Microsoft\Windows NT\CurrentVersion + ProductName + +- +- /etc/os-release +- ^ID="(\w+)"$ +- 1 +- +- +- /etc/os-release +- ^VERSION_ID="(\d)"$ +- 1 +- ++ ++ /etc/os-release ++ ++ ++ /etc ++ os-release ++ ^VERSION=.(\d*.\d*) ++ 1 + + + +@@ -1455,5 +1472,13 @@ + + ^.*2016.*$ + ++ ++ 4.2 ++ + + +diff --git a/src/OVAL/probes/unix/runlevel_probe.c b/src/OVAL/probes/unix/runlevel_probe.c +index 7a94b23fc..00a5b85f6 100644 +--- a/src/OVAL/probes/unix/runlevel_probe.c ++++ b/src/OVAL/probes/unix/runlevel_probe.c +@@ -403,6 +403,11 @@ static int is_wrlinux(void) + return parse_os_release("cpe:/o:windriver:wrlinux"); + } + ++static int is_openembedded(void) ++{ ++ return parse_os_release("cpe:/o:openembedded:nodistro"); ++} ++ + static int is_common (void) + { + return (1); +@@ -424,7 +429,8 @@ const distro_tbl_t distro_tbl[] = { + { &is_suse, &get_runlevel_suse }, + { &is_solaris, &get_runlevel_redhat }, + { &is_wrlinux, &get_runlevel_wrlinux }, +- { &is_common, &get_runlevel_common } ++ { &is_common, &get_runlevel_common }, ++ { &is_openembedded, &get_runlevel_common } + }; + + #define DISTRO_TBL_SIZE ((sizeof distro_tbl)/sizeof (distro_tbl_t)) +-- +2.25.1 + diff --git a/recipes-compliance/openscap/files/0002-openembedded-add-Poky-distro.patch b/recipes-compliance/openscap/files/0002-openembedded-add-Poky-distro.patch new file mode 100644 index 0000000..182d9ec --- /dev/null +++ b/recipes-compliance/openscap/files/0002-openembedded-add-Poky-distro.patch @@ -0,0 +1,80 @@ +From eb3865f2603fff2cc5d39d2379ba9f3857affca9 Mon Sep 17 00:00:00 2001 +From: Armin Kuster +Date: Sun, 4 Jun 2023 20:51:50 -0400 +Subject: [PATCH 2/2] openembedded: add Poky distro + +Signed-off-by: Armin Kuster +--- + cpe/openscap-cpe-dict.xml | 4 ++++ + cpe/openscap-cpe-oval.xml | 14 ++++++++++++++ + src/OVAL/probes/unix/runlevel_probe.c | 8 +++++++- + 3 files changed, 25 insertions(+), 1 deletion(-) + +diff --git a/cpe/openscap-cpe-dict.xml b/cpe/openscap-cpe-dict.xml +index 3338a9e55..f86b55864 100644 +--- a/cpe/openscap-cpe-dict.xml ++++ b/cpe/openscap-cpe-dict.xml +@@ -57,5 +57,9 @@ + OpenEmbedded all versions + oval:org.open-scap.cpe.openembedded:def:1 + ++ ++ Poky all versions ++ oval:org.open-scap.cpe.poky:def:1 ++ + + +diff --git a/cpe/openscap-cpe-oval.xml b/cpe/openscap-cpe-oval.xml +index 2f3e25419..03d192333 100644 +--- a/cpe/openscap-cpe-oval.xml ++++ b/cpe/openscap-cpe-oval.xml +@@ -835,6 +835,20 @@ + + + ++ ++ ++ Yocto Project Reference Distro ++ ++ Poky Distro ++ ++ ++ Yocto Project Reference Distro is installed ++ ++ ++ ++ ++ ++ + + + X-Patchwork-Id: 25626 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97B74EB64DB for ; Wed, 14 Jun 2023 12:08:25 +0000 (UTC) Received: from mail-yw1-f173.google.com (mail-yw1-f173.google.com [209.85.128.173]) by mx.groups.io with SMTP id smtpd.web11.9965.1686744504378553144 for ; Wed, 14 Jun 2023 05:08:24 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="signature has expired" header.i=@gmail.com header.s=20221208 header.b=JexAKaAN; spf=pass (domain: gmail.com, ip: 209.85.128.173, mailfrom: akuster808@gmail.com) Received: by mail-yw1-f173.google.com with SMTP id 00721157ae682-56d3d7a5b84so6577057b3.0 for ; Wed, 14 Jun 2023 05:08:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1686744503; x=1689336503; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=KbzeEE88q3TqA4MeXO/okVsgU6EoQgnQZaI1+V2VUiw=; b=JexAKaANxiUZFLDgvIzxrTMntF/Jn4iwIfNVjbBugT5KscWBfdroyuy3HtSQ+fpqm1 tDMA2RtbZrR9kMoxnZMbRhsx/cbvY7QBN2asdyFcCpLdetl4wjffMkW5BSc4gUo6L9Zc K8iNEEm3HhBsLVxYNg9npMnit3ryUSzStVcwbPCvFmPzU+GEz04jGH3p3jSuAQuyKaTM lIdMTO2H3kd++/6+lPqdx9d/g/t4BDiZUmUm4TEpNdjL0Qusigqx6SbOibbQLbbGuBEY dZnd9TuM+KSeUHVyl9MC0LqDE3nHn+80fQQ+kuZpUPWLVyqW7mYzocFc56bAzNv6pWox pwTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1686744503; x=1689336503; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=KbzeEE88q3TqA4MeXO/okVsgU6EoQgnQZaI1+V2VUiw=; b=ITyPEQp1SHmwREpDqnIYhpM2CDWCM+trLX0cDpRmA7dDgjCLpAJJpfr7nN8gsjzKiG tV2jbTbW25tfegMw1T2LJLq/7MrU+2e/9QAl+7z26HlcIbYQ3WuT6m0DvE+tdbMFig9W oT+q9OYzSOXlsXrQN7mQ3+giAC3XPPhLfLKoM4Ce+yMK9GTeM1OGMhnALXXemckXGIFC Y0kxI5nlfgvlhBgoNGv1PxCNGi3IbUf8rP704VS01pQtw3pnptmzshk6goU7uVkyVDjH 9wIAYcZ4cslcYyHQst38UhCSU0rPXSKhTuA9AqeGel3LTDiP5UBU806BgX1flYoqtsFU AUHA== X-Gm-Message-State: AC+VfDy11XcyvxYW5fytxawteumn1/b7KiVFQNmFHbUUZ4rFIPs2Aet8 RM2M2dbIBLCaC/VISBAvHSejGRQZFi0= X-Google-Smtp-Source: ACHHUZ5m3dHDU26k7KWfW8TcYqM+QN6pzFDygABtkZxVwEU9dPtEcKxULPpU6/XQV4WF1VIOoZyhQA== X-Received: by 2002:a81:9283:0:b0:565:cef7:92e3 with SMTP id j125-20020a819283000000b00565cef792e3mr1213860ywg.51.1686744502872; Wed, 14 Jun 2023 05:08:22 -0700 (PDT) Received: from keaua.attlocal.net ([2600:1700:9190:ba10:5ba9:9ead:a276:1e7c]) by smtp.gmail.com with ESMTPSA id z14-20020a81a24e000000b005461671a79csm638634ywg.138.2023.06.14.05.08.22 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Jun 2023 05:08:22 -0700 (PDT) From: Armin Kuster To: yocto@lists.yoctoproject.org Subject: [meta-security][PATCH 2/2] scap-security-guide: add OE support Date: Wed, 14 Jun 2023 08:08:20 -0400 Message-Id: <20230614120820.119607-2-akuster808@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230614120820.119607-1-akuster808@gmail.com> References: <20230614120820.119607-1-akuster808@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 14 Jun 2023 12:08:25 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/yocto/message/60299 Signed-off-by: Armin Kuster --- ...scap-security-guide-add-openembedded.patch | 231 ++++++++++++++++++ .../scap-security-guide_0.1.67.bb | 13 +- 2 files changed, 235 insertions(+), 9 deletions(-) create mode 100644 recipes-compliance/scap-security-guide/files/0001-scap-security-guide-add-openembedded.patch diff --git a/recipes-compliance/scap-security-guide/files/0001-scap-security-guide-add-openembedded.patch b/recipes-compliance/scap-security-guide/files/0001-scap-security-guide-add-openembedded.patch new file mode 100644 index 0000000..f003f72 --- /dev/null +++ b/recipes-compliance/scap-security-guide/files/0001-scap-security-guide-add-openembedded.patch @@ -0,0 +1,231 @@ +From f6287d146762b8360bd7099f4724a58eedba7d2a Mon Sep 17 00:00:00 2001 +From: Armin Kuster +Date: Wed, 14 Jun 2023 07:46:55 -0400 +Subject: [PATCH] scap-security-guide: add openembedded + +Signed-off-by: Armin Kuster + +Upstream-Status: Pending +Signed-off-by: Armin Kuster + +--- + CMakeLists.txt | 5 +++ + build_product | 1 + + products/openembedded/CMakeLists.txt | 6 ++++ + products/openembedded/product.yml | 19 +++++++++++ + .../openembedded/profiles/standard.profile | 12 +++++++ + .../openembedded/transforms/constants.xslt | 10 ++++++ + .../oval/installed_OS_is_openembedded.xml | 33 +++++++++++++++++++ + .../oval/sysctl_kernel_ipv6_disable.xml | 1 + + ssg/constants.py | 5 ++- + 9 files changed, 91 insertions(+), 1 deletion(-) + create mode 100644 products/openembedded/CMakeLists.txt + create mode 100644 products/openembedded/product.yml + create mode 100644 products/openembedded/profiles/standard.profile + create mode 100644 products/openembedded/transforms/constants.xslt + create mode 100644 shared/checks/oval/installed_OS_is_openembedded.xml + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 85ec289644..09ac96784e 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -95,6 +95,7 @@ option(SSG_PRODUCT_UBUNTU1804 "If enabled, the Ubuntu 18.04 SCAP content will be + option(SSG_PRODUCT_UBUNTU2004 "If enabled, the Ubuntu 20.04 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) + option(SSG_PRODUCT_UBUNTU2204 "If enabled, the Ubuntu 22.04 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) + option(SSG_PRODUCT_UOS20 "If enabled, the Uos 20 SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) ++option(SSG_PRODUCT_OE "If enabled, the OpenEmbedded SCAP content will be built" ${SSG_PRODUCT_DEFAULT}) + + + option(SSG_CENTOS_DERIVATIVES_ENABLED "If enabled, CentOS derivative content will be built from the RHEL content" TRUE) +@@ -289,6 +290,7 @@ message(STATUS "Ubuntu 18.04: ${SSG_PRODUCT_UBUNTU1804}") + message(STATUS "Ubuntu 20.04: ${SSG_PRODUCT_UBUNTU2004}") + message(STATUS "Ubuntu 22.04: ${SSG_PRODUCT_UBUNTU2204}") + message(STATUS "Uos 20: ${SSG_PRODUCT_UOS20}") ++message(STATUS "OpenEmbedded nodistro: ${SSG_PRODUCT_OE}") + + + +@@ -410,6 +412,9 @@ endif() + if (SSG_PRODUCT_UOS20) + add_subdirectory("products/uos20" "uos20") + endif() ++if (SSG_PRODUCT_OE) ++ add_subdirectory("products/openembedded" "openembedded") ++endif() + + # ZIP only contains source datastreams and kickstarts, people who + # want sources to build from should get the tarball instead. +diff --git a/build_product b/build_product +index fc793cbe70..197d925b7e 100755 +--- a/build_product ++++ b/build_product +@@ -333,6 +333,7 @@ all_cmake_products=( + UBUNTU2204 + UOS20 + MACOS1015 ++ OPENEMBEDDED + ) + + DEFAULT_OVAL_MAJOR_VERSION=5 +diff --git a/products/openembedded/CMakeLists.txt b/products/openembedded/CMakeLists.txt +new file mode 100644 +index 0000000000..1981adf53e +--- /dev/null ++++ b/products/openembedded/CMakeLists.txt +@@ -0,0 +1,6 @@ ++# Sometimes our users will try to do: "cd openembedded; cmake ." That needs to error in a nice way. ++if ("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}") ++ message(FATAL_ERROR "cmake has to be used on the root CMakeLists.txt, see the Building ComplianceAsCode section in the Developer Guide!") ++endif() ++ ++ssg_build_product("openembedded") +diff --git a/products/openembedded/product.yml b/products/openembedded/product.yml +new file mode 100644 +index 0000000000..9f2f12d737 +--- /dev/null ++++ b/products/openembedded/product.yml +@@ -0,0 +1,19 @@ ++product: openembedded ++full_name: OpemEmbedded ++type: platform ++ ++benchmark_id: OPENEMBEDDED ++benchmark_root: "../../linux_os/guide" ++ ++profiles_root: "./profiles" ++ ++pkg_manager: "dnf" ++ ++init_system: "systemd" ++ ++cpes_root: "../../shared/applicability" ++cpes: ++ - openembedded: ++ name: "cpe:/o:openembedded" ++ title: "OpenEmbedded nodistro" ++ check_id: installed_OS_is_openembedded +diff --git a/products/openembedded/profiles/standard.profile b/products/openembedded/profiles/standard.profile +new file mode 100644 +index 0000000000..44339d716c +--- /dev/null ++++ b/products/openembedded/profiles/standard.profile +@@ -0,0 +1,12 @@ ++documentation_complete: true ++ ++title: 'Sample Security Profile for OpenEmbedded Distros' ++ ++description: |- ++ This profile is an sample for use in documentation and example content. ++ The selected rules are standard and should pass quickly on most systems. ++ ++selections: ++ - file_owner_etc_passwd ++ - file_groupowner_etc_passwd ++ - file_permissions_etc_passwd +diff --git a/products/openembedded/transforms/constants.xslt b/products/openembedded/transforms/constants.xslt +new file mode 100644 +index 0000000000..85e812a7c1 +--- /dev/null ++++ b/products/openembedded/transforms/constants.xslt +@@ -0,0 +1,10 @@ ++ ++ ++ ++ ++OpenEmbedded nodistro ++OE nodistro ++empty ++openembedded ++ ++ +diff --git a/shared/checks/oval/installed_OS_is_openembedded.xml b/shared/checks/oval/installed_OS_is_openembedded.xml +new file mode 100644 +index 0000000000..17c2873686 +--- /dev/null ++++ b/shared/checks/oval/installed_OS_is_openembedded.xml +@@ -0,0 +1,33 @@ ++ ++ ++ ++ OpenEmbedded ++ ++ multi_platform_all ++ ++ The operating system installed is an OpenEmbedded System ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ /etc/os-release ++ ++ ++ ++ ++ ++ ++ /etc/os-release ++ ^ID=nodistro$ ++ 1 ++ ++ ++ +diff --git a/shared/checks/oval/sysctl_kernel_ipv6_disable.xml b/shared/checks/oval/sysctl_kernel_ipv6_disable.xml +index affb9770cb..4f22df262c 100644 +--- a/shared/checks/oval/sysctl_kernel_ipv6_disable.xml ++++ b/shared/checks/oval/sysctl_kernel_ipv6_disable.xml +@@ -8,6 +8,7 @@ + multi_platform_debian + multi_platform_example + multi_platform_fedora ++ multi_platform_openembedded + multi_platform_opensuse + multi_platform_ol + multi_platform_rhcos +diff --git a/ssg/constants.py b/ssg/constants.py +index f66ba008fa..630fbdfcb9 100644 +--- a/ssg/constants.py ++++ b/ssg/constants.py +@@ -219,6 +219,7 @@ FULL_NAME_TO_PRODUCT_MAPPING = { + "Ubuntu 20.04": "ubuntu2004", + "Ubuntu 22.04": "ubuntu2204", + "UnionTech OS Server 20": "uos20", ++ "OpenEmbedded": "openembedded", + "Not Applicable" : "example" + } + +@@ -267,7 +268,7 @@ REFERENCES = dict( + + MULTI_PLATFORM_LIST = ["rhel", "fedora", "rhv", "debian", "ubuntu", + "opensuse", "sle", "ol", "ocp", "rhcos", +- "example", "eks", "alinux", "uos", "anolis"] ++ "example", "eks", "alinux", "uos", "anolis", "openembedded"] + + MULTI_PLATFORM_MAPPING = { + "multi_platform_alinux": ["alinux2", "alinux3"], +@@ -285,6 +286,7 @@ MULTI_PLATFORM_MAPPING = { + "multi_platform_sle": ["sle12", "sle15"], + "multi_platform_ubuntu": ["ubuntu1604", "ubuntu1804", "ubuntu2004", "ubuntu2204"], + "multi_platform_uos": ["uos20"], ++ "multi_platform_openembedded": ["openembedded"], + } + + RHEL_CENTOS_CPE_MAPPING = { +@@ -454,6 +456,7 @@ MAKEFILE_ID_TO_PRODUCT_MAP = { + 'ocp': 'Red Hat OpenShift Container Platform', + 'rhcos': 'Red Hat Enterprise Linux CoreOS', + 'eks': 'Amazon Elastic Kubernetes Service', ++ 'openembedded': 'OpenEmbedded', + } + + # References that can not be used with product-qualifiers +-- +2.34.1 + diff --git a/recipes-compliance/scap-security-guide/scap-security-guide_0.1.67.bb b/recipes-compliance/scap-security-guide/scap-security-guide_0.1.67.bb index 53ee03e..420a6d8 100644 --- a/recipes-compliance/scap-security-guide/scap-security-guide_0.1.67.bb +++ b/recipes-compliance/scap-security-guide/scap-security-guide_0.1.67.bb @@ -7,25 +7,20 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=9bfa86579213cb4c6adaffface6b2820" LICENSE = "BSD-3-Clause" SRCREV = "dad85502ce8da722a6afc391346c41cee61e90a9" -SRC_URI = "git://github.com/ComplianceAsCode/content.git;branch=master;protocol=https" +SRC_URI = "git://github.com/ComplianceAsCode/content.git;branch=master;protocol=https \ + file://0001-scap-security-guide-add-openembedded.patch " DEPENDS = "openscap-native python3-pyyaml-native python3-jinja2-native libxml2-native expat-native coreutils-native" S = "${WORKDIR}/git" +B = "${S}/build" inherit cmake pkgconfig python3native python3targetconfig -STAGING_OSCAP_BUILDDIR = "${TMPDIR}/work-shared/openscap/oscap-build-artifacts" -export OSCAP_CPE_PATH="${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/cpe" -export OSCAP_SCHEMA_PATH="${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/schemas" -export OSCAP_XSLT_PATH="${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/xsl" - OECMAKE_GENERATOR = "Unix Makefiles" -EXTRA_OECMAKE += "-DENABLE_PYTHON_COVERAGE=OFF -DSSG_PRODUCT_DEFAULT=OFF -DSSG_PRODUCT_EXAMPLE=ON" - -B = "${S}/build" +EXTRA_OECMAKE += "-DENABLE_PYTHON_COVERAGE=OFF -DSSG_PRODUCT_DEFAULT=OFF -DSSG_PRODUCT_OE=ON" do_configure[depends] += "openscap-native:do_install"