Adding security audit tools

new file mode 100644
index 0000000..b29c143
@@ -0,0 +1,41 @@
+# Meta-security-compliance
+
+This layer is meant to contain programs to help in security compliance and auditing
+
+
+Dependencies
+============
+
+This layer depends on:
+
+  URI: git://git.openembedded.org/bitbake
+  branch: master
+
+  URI: git://git.openembedded.org/openembedded-core
+  layers: meta
+  branch: master
+
+or
+
+  URI: git://git.yoctoproject.org/poky
+  branch: master
+
+
+
+Maintenance
+-----------
+
+Send pull requests, patches, comments or questions to [email protected]
+
+When sending single patches, please using something like:
+'git send-email -1 --to [email protected] --subject-prefix=meta-security][PATCH'
+
+Layer Maintainer: Armin Kuster <[email protected]>
+
+
+License
+=======
+
+All metadata is MIT licensed unless otherwise stated. Source code included
+in tree for individual recipes is under the LICENSE stated in each recipe
+(.bb file) unless otherwise stated.

new file mode 100644
index 0000000..b1b9727
@@ -0,0 +1,13 @@
+# We have a conf and classes directory, add to BBPATH
+BBPATH .= ":${LAYERDIR}"
+
+# We have a recipes directory, add to BBFILES
+BBFILES += "${LAYERDIR}/recipes*/*/*.bb ${LAYERDIR}/recipes*/*/*.bbappend ${LAYERDIR}/classes/*.bbclass"
+
+BBFILE_COLLECTIONS += "scanners-layer"
+BBFILE_PATTERN_scanners-layer = "^${LAYERDIR}/"
+BBFILE_PRIORITY_scanners-layer = "6"
+
+LAYERDEPENDS_scanners-layer = " \
+    core \
+"

new file mode 100644
index 0000000..c25b804
@@ -0,0 +1,41 @@
+# Copyright (C) 2017 Armin Kuster  <[email protected]>
+# Released under the MIT license (see COPYING.MIT for the terms)
+
+SUMMARY = "Lynis is a free and open source security and auditing tool."
+HOMEDIR = "https://cisofy.com/"
+LICENSE = "GPL-3.0"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=3edd6782854304fd11da4975ab9799c1"
+
+SRC_URI = "https://cisofy.com/files/${BPN}-${PV}.tar.gz"
+
+SRC_URI[md5sum] = "5b9da89c616344bbc73cbc5688a4a0bd"
+SRC_URI[sha256sum] = "7a09c6fc71c65d572ca702df7b4394d71f9037484062ef71b76f59a2c498b029"
+
+S = "${WORKDIR}/${BPN}"
+
+inherit autotools-brokensep
+
+do_compile[noexec] = "1"
+do_configure[noexec] = "1"
+
+do_install () {
+	install -d ${D}/${bindir}
+	install -d ${D}/${sysconfdir}/lynis
+	install -m 555 ${S}/lynis ${D}/${bindir}
+
+	install -d ${D}/${datadir}/lynis/db
+	install -d ${D}/${datadir}/lynis/plugins
+	install -d ${D}/${datadir}/lynis/include
+	install -d ${D}/${datadir}/lynis/extras
+
+	cp -r ${S}/db/* ${D}/${datadir}/lynis/db/.
+	cp -r ${S}/plugins/*  ${D}/${datadir}/lynis/plugins/.
+	cp -r ${S}/include/* ${D}/${datadir}/lynis/include/.
+	cp -r ${S}/extras/*  ${D}/${datadir}/lynis/extras/.
+        cp ${S}/*.prf ${D}/${sysconfdir}/lynis
+}
+
+FILES_${PN} += "${sysconfdir}/developer.prf ${sysconfdir}/default.prf"
+FILES_${PN}-doc += "lynis.8 FAQ README CHANGELOG.md CONTRIBUTIONS.md CONTRIBUTORS.md" 
+
+RDEPENDS_${PN} += "procps"

new file mode 100644
index 0000000..2d70855
@@ -0,0 +1,36 @@
+Index: git/configure.ac
+===================================================================
+--- git.orig/configure.ac
++++ git/configure.ac
+@@ -360,25 +360,13 @@ case "${with_crypto}" in
+         AC_DEFINE([HAVE_NSS3], [1], [Define to 1 if you have 'NSS' library.])
+         ;;
+     gcrypt)
+-	SAVE_LIBS=$LIBS
+-        AC_CHECK_LIB([gcrypt], [gcry_check_version],
+-                     [crapi_CFLAGS=`libgcrypt-config --cflags`;
+-                      crapi_LIBS=`libgcrypt-config --libs`;
+-                      crapi_libname="GCrypt";],
+-                     [AC_MSG_ERROR([library 'gcrypt' is required for GCrypt.])],
+-                     [])
+-        AC_DEFINE([HAVE_GCRYPT], [1], [Define to 1 if you have 'gcrypt' library.])
+-	AC_CACHE_CHECK([for GCRYCTL_SET_ENFORCED_FIPS_FLAG],
+-                    [ac_cv_gcryctl_set_enforced_fips_flag],
+-                    [AC_COMPILE_IFELSE([AC_LANG_PROGRAM([#include<gcrypt.h>],
+-                                                        [return GCRYCTL_SET_ENFORCED_FIPS_FLAG;])],
+-                                       [ac_cv_gcryctl_set_enforced_fips_flag=yes],
+-                                       [ac_cv_gcryctl_set_enforced_fips_flag=no])])
++	PKG_CHECK_MODULES([libgcrypt], [libgcrypt >= 1.7.9],[],
++			  AC_MSG_FAILURE([libgcrypt devel support is missing]))
+ 
+-	if test "${ac_cv_gcryctl_set_enforced_fips_flag}" == "yes"; then
+-	   AC_DEFINE([HAVE_GCRYCTL_SET_ENFORCED_FIPS_FLAG], [1], [Define to 1 if you have 'gcrypt' library with GCRYCTL_SET_ENFORCED_FIPS_FLAG.])
+-	fi
+-	LIBS=$SAVE_LIBS
++	crapi_libname="libgcrypt"
++	crapi_CFLAGS=$libgcrypt_CFLAGS
++	crapi_LIBS=$libgcrypt_LIBS
++        AC_DEFINE([HAVE_GCRYPT], [1], [Define to 1 if you have 'libgcrypt' library.])
+         ;;
+          *)
+           AC_MSG_ERROR([unknown crypto backend])

new file mode 100644
index 0000000..ecbe602
@@ -0,0 +1,17 @@
+Index: git/configure.ac
+===================================================================
+--- git.orig/configure.ac
++++ git/configure.ac
+@@ -1109,11 +1109,7 @@ AC_ARG_WITH([crypto],
+      [],
+      [crypto=gcrypt])
+ 
+-if test "x${libexecdir}" = xNONE; then
+-	probe_dir="/usr/local/libexec/openscap"
+-else
+-	EXPAND_DIR(probe_dir,"${libexecdir}/openscap")
+-fi
++probe_dir="/usr/local/libexec/openscap"
+ 
+ AC_SUBST(probe_dir)
+ 

new file mode 100644
index 0000000..454a6a3
@@ -0,0 +1,3 @@
+#!/bin/sh
+cd tests
+make -k check

new file mode 100644
index 0000000..e9589b6
@@ -0,0 +1,2 @@
+STAGING_OSCAP_DIR = "${TMPDIR}/work-shared/${MACHINE}/oscap-source"
+STAGING_OSCAP_BUILDDIR = "${TMPDIR}/work-shared/openscap/oscap-build-artifacts"

82 lines not on this page · raw message

new file mode 100644
index 0000000..7fa417d
@@ -0,0 +1,57 @@
+# Copyright (C) 2017 Armin Kuster  <[email protected]>
+# Released under the MIT license (see COPYING.MIT for the terms)
+
+SUMARRY = "SCAP content for various platforms"
+HOME_URL = "https://www.open-scap.org/security-policies/scap-security-guide/"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=236e81befc8154d18c93c848185d7e52"
+LICENSE = "LGPL-2.1"
+
+DEPENDS = "openscap-native"
+
+SRCREV = "423d9f40021a03abd018bef7818a3a9fe91a083c"
+SRC_URI = "git://github.com/akuster/scap-security-guide.git;branch=oe;"
+
+inherit cmake
+
+PARALLEL_MAKE = ""
+
+S = "${WORKDIR}/git"
+
+STAGING_OSCAP_BUILDDIR = "${TMPDIR}/work-shared/openscap/oscap-build-artifacts"
+
+EXTRA_OECMAKE += "-DSSG_PRODUCT_CHROMIUM:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_DEBIAN8:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_FEDORA:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_FIREFOX:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_JBOSS_EAP5:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_JBOSS_FUSE6:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_JRE:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_OPENSUSE:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_OSP7:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_RHEL5:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_RHEL6:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_RHEL7:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_RHEV3:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_SUSE11:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_SUSE12:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_UBUNTU1404:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_UBUNTU1604:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_WRLINUX:BOOL=OFF"
+EXTRA_OECMAKE += "-DSSG_PRODUCT_WEBMIN:BOOL=OFF"
+
+do_configure_prepend () {
+	sed -i -e 's:NAMES\ sed:NAMES\ ${HOSTTOOLS_DIR}/sed:g'   ${S}/CMakeLists.txt
+        sed -i 's:/usr/share/openscap/:${STAGING_OSCAP_BUILDDIR}${datadir_native}/openscap/:g' ${S}/cmake/SSGCommon.cmake
+}
+
+do_compile () {
+	cd ${B}
+	make openembedded 
+}
+
+do_install () {
+	cd ${B}
+	make DESTDIR=${D} install
+}
+FILES_${PN} += "${datadir}/xml"
+RDEPNEDS_${PN} = "openscap"

new file mode 100644
index 0000000..1467da2
@@ -0,0 +1,18 @@
+# Copyright (C) 2017 Armin Kuster  <[email protected]>
+# Released under the MIT license (see COPYING.MIT for the terms)
+
+SUMARRY = "The OpenSCAP Daemon is a service that runs in the background."
+HOME_URL = "https://www.open-scap.org/tools/openscap-daemon/"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=40d2542b8c43a3ec2b7f5da31a697b88"
+LICENSE = "LGPL-2.1"
+
+DEPENDS = "python3-dbus"
+
+SRCREV = "3fd5c75a08223de35a865d026d2a6980ec9c1d74"
+SRC_URI = "git://github.com/OpenSCAP/openscap-daemon.git"
+
+PV = "0.1.6+git${SRCPV}"
+
+inherit setuptools3
+
+S = "${WORKDIR}/git"

new file mode 100644
index 0000000..d3b2c9a
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<xccdf:Benchmark xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" id="generated-xccdf" resolved="1">
+  <xccdf:status>incomplete</xccdf:status>
+  <xccdf:title>Automatically generated XCCDF from OVAL file: OpenEmbedded_nodistro_0.xml</xccdf:title>
+  <xccdf:description>This file has been generated automatically from oval definitions file.</xccdf:description>
+  <xccdf:version time="2017-06-07T04:05:05">None, generated from OVAL file.</xccdf:version>
+  <xccdf:Rule selected="true" id="oval-com.redhat.rhsa-def-20171365">
+    <xccdf:title>CPE-2017:1365: nss security and bug fix update (Important)</xccdf:title>
+    <xccdf:ident system="http://cve.mitre.org">CVE-2017-7502</xccdf:ident>
+    <xccdf:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
+      <xccdf:check-content-ref href="OpenEmbedded_nodistro_0.xml" name="oval:com.redhat.rhsa:def:20171365"/>
+    </xccdf:check>
+  </xccdf:Rule>
+</xccdf:Benchmark>

83 lines not on this page · raw message

72 lines not on this page · raw message

new file mode 100644
index 0000000..48a7485
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+oscap oval eval \
+--report oval.html \
+--verbose-log-file filedevel.log \
+--verbose DEVEL \
+/usr/share/xml/scap/ssg/content/ssg-openembedded-ds.xml

new file mode 100644
index 0000000..70cd82c
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+#oscap oval eval --result-file ./myresults.xml ./OpenEmbedded_nodistro_0.xml
+
+oscap xccdf eval --results results.xml --report report.html OpenEmbedded_nodistro_0.xccdf.xml

new file mode 100644
index 0000000..5b61375
@@ -0,0 +1,34 @@
+# Copyright (C) 2017 Armin Kuster  <[email protected]>
+# Released under the MIT license (see COPYING.MIT for the terms)
+
+SUMARRY = "OE SCAP files"
+LIC_FILES_CHKSUM = "file://README.md;md5=46dec9f167b6e05986cb4023df6d92f4"
+LICENSE = "MIT"
+
+SRCREV = "7147871d7f37d408c0dd7720ef0fd3ec1b54ad98"
+SRC_URI = "git://github.com/akuster/oe-scap.git"
+SRC_URI += " \
+	file://run_cve.sh \
+	file://run_test.sh \
+	file://OpenEmbedded_nodistro_0.xml \
+        file://OpenEmbedded_nodistro_0.xccdf.xml \
+"
+	
+
+S = "${WORKDIR}/git"
+
+do_configure[noexec] = "1"
+do_compile[noexec] = "1"
+
+do_install () {
+	install -d ${D}/${datadir}/oe-scap
+	install ${WORKDIR}/run_cve.sh ${D}/${datadir}/oe-scap/.
+	install ${WORKDIR}/run_test.sh ${D}/${datadir}/oe-scap/.
+	install ${WORKDIR}/OpenEmbedded_nodistro_0.xml ${D}/${datadir}/oe-scap/.
+	install ${WORKDIR}/OpenEmbedded_nodistro_0.xccdf.xml ${D}/${datadir}/oe-scap/.
+	cp ${S}/* ${D}/${datadir}/oe-scap/.
+}
+
+FILES_${PN} += "${datadir}/oe-scap"
+
+RDEPENDS_${PN} = "openscap"

new file mode 100644
index 0000000..e9fd44a
@@ -0,0 +1,4 @@
+OS_RELEASE_FIELDS += "CPE_NAME"
+
+CPE_NAME="cpe:/o:openembedded:nodistro:0"
+

new file mode 100644
index 0000000..0ad427d
@@ -0,0 +1,32 @@
+inherit allarch
+
+SUMMARY = "Operating release identification"
+DESCRIPTION = "The /etc/openembedded-release file contains operating system identification data."
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
+INHIBIT_DEFAULT_DEPS = "1"
+
+do_fetch[noexec] = "1"
+do_unpack[noexec] = "1"
+do_patch[noexec] = "1"
+do_configure[noexec] = "1"
+
+VERSION = "0"
+RELEASE_NAME = "${DISTRO_NAME} ${DISTRO} ${VERSION}"
+
+def sanitise_version(ver):
+    ret = ver.replace('+', '-').replace(' ','_')
+    return ret.lower()
+
+python do_compile () {
+    import shutil
+    release_name = d.getVar('RELEASE_NAME')		 
+    with open(d.expand('${B}/openemebedded-release'), 'w') as f:
+        f.write('%s\n' % release_name)
+}
+do_compile[vardeps] += "${RELEASE_NAME}"
+
+do_install () {
+    install -d ${D}${sysconfdir}
+    install -m 0644 openemebedded-release ${D}${sysconfdir}/
+}