Return-Path: Received: by yocto-www.yoctoproject.org (Postfix, from userid 118) id E4D17E00D8F; Thu, 28 Sep 2017 21:26:53 -0700 (PDT) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on yocto-www.yoctoproject.org X-Spam-Level: X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 X-Spam-HAM-Report: * -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no * trust * [209.85.192.169 listed in list.dnswl.org] * 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider * (akuster808[at]gmail.com) * -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% * [score: 0.0000] * -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's * domain * 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily * valid * -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature Received: from mail-pf0-f169.google.com (mail-pf0-f169.google.com [209.85.192.169]) by yocto-www.yoctoproject.org (Postfix) with ESMTP id 8E661E00D85 for ; Thu, 28 Sep 2017 21:26:52 -0700 (PDT) Received: by mail-pf0-f169.google.com with SMTP id r68so128279pfj.3 for ; Thu, 28 Sep 2017 21:26:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=U6qEeCUi7/B7wtC+mprlN7NrtARTQgwvTfPUHG4CQAs=; b=IJfcoaZRoKsJHf943R07tQVQ6/5yCEqG18uXXTHkAY9XX0tJJXFEe+dyiF3D3/M4VF vEH1umUMVr99kHuwEj9VspiwCPGBIY2v/fPwZYbtjlYBqjnBHPdAFeEaL4emV6PXF3h/ ogVMKvr/dROlpC/E5SfyvN+w8mc21hTNqJCE4d7dy8yuE2N75brgk0doo3u3JIB7TKuU V+FudG7BMfmiyf1JExtvN8PgrewscXQ2Vwj3DiWfU7gsX2GIXdZsHrY74JRtdymZfWSU ukC6j7fyAGW3q+QLDUXrnlnQlbx5kbPuZoarD24yFB+14FBB6BoWXPyMHT2uLnoZO1zC 0wOw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=U6qEeCUi7/B7wtC+mprlN7NrtARTQgwvTfPUHG4CQAs=; b=bgD8kUasEoWe7rjfpHTYsJbA+A6F0vP5Uzlssg75qyRRoJ9AoDbPXslNmpNjpk985k EPUMinU8OmNAK2SzDWienCorQfTHnpN1M9yKRSAGXD5x5YFTi8nSW5y26BckDTLrBnMz PeJInHB4PlJg2FYh0xHkVY11Qvye2AL5JzfhSTI4SsMZ5PJuT5g2UftPcUuUZeQm876y 0ZEK6emN30+XyPcYKsQD9oL0hqaWD5PK3utDdlOQOy9f/tpk4u67Bcp3He7pwLqmuRrT poDlPXrHs4mAJCmJShaKxYqMDei7m2wozlI5MdF+wVu2L/wO50LkJ7tqPc84ph8E4OXk L0jA== X-Gm-Message-State: AHPjjUjkly9ITgUmIhxh5XdYnnoBe0+m8VtGhURxgHYn4jUqtRldmpw/ pfniJqNoOqg+xkJsNZ0nB8nrKQ== X-Google-Smtp-Source: AOwi7QDEM9IpGi8W1jMMz3IOnOgxqOdM41wFtxPZ01z+R6gRRw3m8HgvpSHvrtAeKcpQMVolfR2ttw== X-Received: by 10.99.55.85 with SMTP id g21mr6122158pgn.306.1506659211863; Thu, 28 Sep 2017 21:26:51 -0700 (PDT) Received: from akuster-ThinkPad-T460s.mvista.com ([2601:202:4001:9ea0:c06:a05b:fc56:fd72]) by smtp.gmail.com with ESMTPSA id r66sm5060330pfl.15.2017.09.28.21.26.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 28 Sep 2017 21:26:51 -0700 (PDT) From: Armin Kuster To: akuster@mvista.com, yocto@yoctoproject.org Date: Thu, 28 Sep 2017 21:26:39 -0700 Message-Id: <1506659201-21501-7-git-send-email-akuster808@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1506659201-21501-1-git-send-email-akuster808@gmail.com> References: <1506659201-21501-1-git-send-email-akuster808@gmail.com> MIME-Version: 1.0 Subject: [meta-security][PATCH 6/8] openscap: Add oe specific files X-BeenThere: yocto@yoctoproject.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: Discussion of all things Yocto Project List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Sep 2017 04:26:53 -0000 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Armin Kuster --- .../files/OpenEmbedded_nodistro_0.xccdf.xml | 14 ++++ .../oe-scap/files/OpenEmbedded_nodistro_0.xml | 83 ++++++++++++++++++++++ .../oe-scap/files/oval-to-xccdf.xslt | 72 +++++++++++++++++++ .../recipes-openscap/oe-scap/files/run_cve.sh | 7 ++ .../recipes-openscap/oe-scap/files/run_test.sh | 5 ++ .../recipes-openscap/oe-scap/oe-scap_1.0.bb | 34 +++++++++ 6 files changed, 215 insertions(+) create mode 100644 meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xccdf.xml create mode 100644 meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xml create mode 100644 meta-security-compliance/recipes-openscap/oe-scap/files/oval-to-xccdf.xslt create mode 100644 meta-security-compliance/recipes-openscap/oe-scap/files/run_cve.sh create mode 100644 meta-security-compliance/recipes-openscap/oe-scap/files/run_test.sh create mode 100644 meta-security-compliance/recipes-openscap/oe-scap/oe-scap_1.0.bb diff --git a/meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xccdf.xml b/meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xccdf.xml new file mode 100644 index 0000000..d3b2c9a --- /dev/null +++ b/meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xccdf.xml @@ -0,0 +1,14 @@ + + + incomplete + Automatically generated XCCDF from OVAL file: OpenEmbedded_nodistro_0.xml + This file has been generated automatically from oval definitions file. + None, generated from OVAL file. + + CPE-2017:1365: nss security and bug fix update (Important) + CVE-2017-7502 + + + + + diff --git a/meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xml b/meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xml new file mode 100644 index 0000000..a9bf2a0 --- /dev/null +++ b/meta-security-compliance/recipes-openscap/oe-scap/files/OpenEmbedded_nodistro_0.xml @@ -0,0 +1,83 @@ + + + + OpenEmbedded Errata Test System + 5.10.1 + 2017-06-07T04:05:05 + + + + + + CPE-2017:1365: nss security and bug fix update (Important) + + OpenEmbedded Nodistro + + + + Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. + +Security Fix(es): + +* A null pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library. (CVE-2017-7502) + +Bug Fix(es): + +* The Network Security Services (NSS) code and Certificate Authority (CA) list have been updated to meet the recommendations as published with the latest Mozilla Firefox Extended Support Release (ESR). The updated CA list improves compatibility with the certificates that are used in the Internet Public Key Infrastructure (PKI). To avoid certificate validation refusals, Red Hat recommends installing the updated CA list on June 12, 2017. (BZ#1451421) + + + + + Important + NA + + + CVE-2017-7502 + CVE-2017-7502 nss: Null pointer dereference when handling empty SSLv2 messages + + cpe:/o:openembedded:nodistro:0 + + + + + + + + + + + + + + + + + + + + + + + + + + + + nss + + + openembedded-release + + + + + + + ^1[^\d] + + + 0:3.31.4-r0 + + + + diff --git a/meta-security-compliance/recipes-openscap/oe-scap/files/oval-to-xccdf.xslt b/meta-security-compliance/recipes-openscap/oe-scap/files/oval-to-xccdf.xslt new file mode 100644 index 0000000..2243ac4 --- /dev/null +++ b/meta-security-compliance/recipes-openscap/oe-scap/files/oval-to-xccdf.xslt @@ -0,0 +1,72 @@ + + + + + + + + incomplete + + Automatically generated XCCDF from OVAL file: + + + This file has been generated automatically from oval definitions file. + + + + + None, generated from OVAL file. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/meta-security-compliance/recipes-openscap/oe-scap/files/run_cve.sh b/meta-security-compliance/recipes-openscap/oe-scap/files/run_cve.sh new file mode 100644 index 0000000..48a7485 --- /dev/null +++ b/meta-security-compliance/recipes-openscap/oe-scap/files/run_cve.sh @@ -0,0 +1,7 @@ +#!/bin/sh + +oscap oval eval \ +--report oval.html \ +--verbose-log-file filedevel.log \ +--verbose DEVEL \ +/usr/share/xml/scap/ssg/content/ssg-openembedded-ds.xml diff --git a/meta-security-compliance/recipes-openscap/oe-scap/files/run_test.sh b/meta-security-compliance/recipes-openscap/oe-scap/files/run_test.sh new file mode 100644 index 0000000..70cd82c --- /dev/null +++ b/meta-security-compliance/recipes-openscap/oe-scap/files/run_test.sh @@ -0,0 +1,5 @@ +#!/bin/sh + +#oscap oval eval --result-file ./myresults.xml ./OpenEmbedded_nodistro_0.xml + +oscap xccdf eval --results results.xml --report report.html OpenEmbedded_nodistro_0.xccdf.xml diff --git a/meta-security-compliance/recipes-openscap/oe-scap/oe-scap_1.0.bb b/meta-security-compliance/recipes-openscap/oe-scap/oe-scap_1.0.bb new file mode 100644 index 0000000..5b61375 --- /dev/null +++ b/meta-security-compliance/recipes-openscap/oe-scap/oe-scap_1.0.bb @@ -0,0 +1,34 @@ +# Copyright (C) 2017 Armin Kuster +# Released under the MIT license (see COPYING.MIT for the terms) + +SUMARRY = "OE SCAP files" +LIC_FILES_CHKSUM = "file://README.md;md5=46dec9f167b6e05986cb4023df6d92f4" +LICENSE = "MIT" + +SRCREV = "7147871d7f37d408c0dd7720ef0fd3ec1b54ad98" +SRC_URI = "git://github.com/akuster/oe-scap.git" +SRC_URI += " \ + file://run_cve.sh \ + file://run_test.sh \ + file://OpenEmbedded_nodistro_0.xml \ + file://OpenEmbedded_nodistro_0.xccdf.xml \ +" + + +S = "${WORKDIR}/git" + +do_configure[noexec] = "1" +do_compile[noexec] = "1" + +do_install () { + install -d ${D}/${datadir}/oe-scap + install ${WORKDIR}/run_cve.sh ${D}/${datadir}/oe-scap/. + install ${WORKDIR}/run_test.sh ${D}/${datadir}/oe-scap/. + install ${WORKDIR}/OpenEmbedded_nodistro_0.xml ${D}/${datadir}/oe-scap/. + install ${WORKDIR}/OpenEmbedded_nodistro_0.xccdf.xml ${D}/${datadir}/oe-scap/. + cp ${S}/* ${D}/${datadir}/oe-scap/. +} + +FILES_${PN} += "${datadir}/oe-scap" + +RDEPENDS_${PN} = "openscap" -- 2.7.4