Skip to contentSkip to conversation

add new recipe for ecryptfs-utils and keyutils

PATCH Superseded [email protected] 3 participants 7 messages May 17, 2017 – May 23, 2017

v1 of 3 Superseded Latest is v3 →

lore
Share & tools
lore

[email protected]

author
#0 lore raw

cover add new recipe for ecryptfs-utils and keyutils

From: Jackie Huang <[email protected]>

---
The following changes since commit 66d8abf64386f52ac8318399eb62ccd28271940d:

swtpm: update to latest tip (2017-04-13 13:56:55 -0700)

are available in the git repository at:

https://github.com/jackiehjm/meta-security.git jhuang0/r_up_ecryptfs_keyutils_170517_0
https://github.com//tree/jhuang0/r_up_ecryptfs_keyutils_170517_0

Jackie Huang (2):
keyutils: add new recipe
ecryptfs-utils: add new recipe

 .../ecryptfs-utils/ecryptfs-utils_111.bb           | 52 +++++++++++++++++
 .../files/ecryptfs-utils-CVE-2016-6224.patch       | 65 ++++++++++++++++++++++
 ...ix-error-report-by-adding-default-message.patch | 42 ++++++++++++++
 .../files/keyutils-test-fix-output-format.patch    | 41 ++++++++++++++
 .../keyutils-use-relative-path-for-link.patch      | 28 ++++++++++
 recipes-security/keyutils/files/run-ptest          |  3 +
 recipes-security/keyutils/keyutils_1.5.10.bb       | 45 +++++++++++++++
 7 files changed, 276 insertions(+)
 create mode 100644 recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
 create mode 100644 recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch
 create mode 100644 recipes-security/keyutils/files/keyutils-fix-error-report-by-adding-default-message.patch
 create mode 100644 recipes-security/keyutils/files/keyutils-test-fix-output-format.patch
 create mode 100644 recipes-security/keyutils/files/keyutils-use-relative-path-for-link.patch
 create mode 100755 recipes-security/keyutils/files/run-ptest
 create mode 100644 recipes-security/keyutils/keyutils_1.5.10.bb
Signature · 1 line
2.11.0
author
#1 lore raw

PATCH 1/2 keyutils: add new recipe

From: Jackie Huang <[email protected]>

keyutils is utilities to control the kernel key
management facility and to provide a mechanism by
which the kernel call back to userspace to get a
key instantiated.

It's required by ecryptfs-utils.

Signed-off-by Jackie Huang <[email protected]>
---
 ...ix-error-report-by-adding-default-message.patch | 42 ++++++++++++++++++++
 .../files/keyutils-test-fix-output-format.patch    | 41 ++++++++++++++++++++
 .../keyutils-use-relative-path-for-link.patch      | 28 ++++++++++++++
 recipes-security/keyutils/files/run-ptest          |  3 ++
 recipes-security/keyutils/keyutils_1.5.10.bb       | 45 ++++++++++++++++++++++
 5 files changed, 159 insertions(+)
 create mode 100644 recipes-security/keyutils/files/keyutils-fix-error-report-by-adding-default-message.patch
 create mode 100644 recipes-security/keyutils/files/keyutils-test-fix-output-format.patch
 create mode 100644 recipes-security/keyutils/files/keyutils-use-relative-path-for-link.patch
 create mode 100755 recipes-security/keyutils/files/run-ptest
 create mode 100644 recipes-security/keyutils/keyutils_1.5.10.bb
recipes-security/keyutils/files/keyutils-fix-error-report-by-adding-default-message.patch new file +42 -0
new file mode 100644
index 0000000..acd91c0
@@ -0,0 +1,42 @@
+fix keyutils test error report
+
+Upstream-Status: Pending
+
+"Permission denied" may be the reason of EKEYEXPIRED and EKEYREVOKED.
+"Required key not available" may be the reason of EKEYREVOKED.
+EXPIRED and REVOKED are 2 status of kernel security keys features.
+But the userspace keyutils lib will output the error message, which may
+have several reasons.
+
+Signed-off-by: Han Chao <[email protected]>
+
+diff --git a/tests/toolbox.inc.sh b/tests/toolbox.inc.sh
+index bbca00a..739e9d0 100644
+--- a/tests/toolbox.inc.sh
++++ b/tests/toolbox.inc.sh
+@@ -227,11 +227,12 @@ function expect_error ()
+ 	    ;;
+ 	EKEYEXPIRED)
+ 	    my_err="Key has expired"
+-	    alt_err="Unknown error 127"
++	    alt_err="Permission denied"
+ 	    ;;
+ 	EKEYREVOKED)
+ 	    my_err="Key has been revoked"
+-	    alt_err="Unknown error 128"
++	    alt_err="Permission denied"
++	    alt2_err="Required key not available"
+ 	    ;;
+ 	EKEYREJECTED)
+ 	    my_err="Key has been rejected"
+@@ -249,6 +250,9 @@ function expect_error ()
+     elif [ "x$alt_err" != "x" ] && expr "$my_errmsg" : ".*: $alt_err" >&/dev/null
+     then
+ 	:
++    elif [ "x$alt2_err" != "x" ] && expr "$my_errmsg" : ".*: $alt2_err" >&/dev/null
++    then
++	:
+     elif [ "x$old_err" != "x" ] && expr "$my_errmsg" : ".*: $old_err" >&/dev/null
+     then
+ 	:
+
recipes-security/keyutils/files/keyutils-test-fix-output-format.patch new file +41 -0

41 lines not on this page · raw message

recipes-security/keyutils/files/keyutils-use-relative-path-for-link.patch new file +28 -0
new file mode 100644
index 0000000..dde1af4
@@ -0,0 +1,28 @@
+Subject: [PATCH] keyutils: use relative path for link
+
+The absolute path of the symlink will be invalid
+when populated in sysroot, so use relative path instead.
+
+Upstream-Status: Pending
+
+Signed-off-by: Jackie Huang <[email protected]>
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index 824bbbf..8ce3a13 100644
+--- a/Makefile
++++ b/Makefile
+@@ -167,7 +167,7 @@ ifeq ($(NO_SOLIB),0)
+ 	$(INSTALL) -D $(LIBNAME) $(DESTDIR)$(LIBDIR)/$(LIBNAME)
+ 	$(LNS) $(LIBNAME) $(DESTDIR)$(LIBDIR)/$(SONAME)
+ 	mkdir -p $(DESTDIR)$(USRLIBDIR)
+-	$(LNS) $(LIBDIR)/$(SONAME) $(DESTDIR)$(USRLIBDIR)/$(DEVELLIB)
++	$(LNS) $(SONAME) $(DESTDIR)$(USRLIBDIR)/$(DEVELLIB)
+ endif
+ 	$(INSTALL) -D keyctl $(DESTDIR)$(BINDIR)/keyctl
+ 	$(INSTALL) -D request-key $(DESTDIR)$(SBINDIR)/request-key
+-- 
+2.11.0
+
recipes-security/keyutils/files/run-ptest new file +3 -0
new file mode 100755
index 0000000..305707f
@@ -0,0 +1,3 @@
+#!/bin/sh
+export AUTOMATED=1
+make -C tests run
recipes-security/keyutils/keyutils_1.5.10.bb new file +45 -0

45 lines not on this page · raw message

Signature · 1 line
2.11.0
author
#2 lore raw

PATCH 2/2 ecryptfs-utils: add new recipe

In reply to [email protected]

From: Jackie Huang <[email protected]>

eCryptfs is a stacked cryptographic filesystem that ships in Linux kernel versions 2.6.19 and above. This package provides the mount helper and supporting libraries to perform key management and mount functions.

Signed-off-by Jackie Huang <[email protected]>
---
 .../ecryptfs-utils/ecryptfs-utils_111.bb           | 52 +++++++++++++++++
 .../files/ecryptfs-utils-CVE-2016-6224.patch       | 65 ++++++++++++++++++++++
 2 files changed, 117 insertions(+)
 create mode 100644 recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb
 create mode 100644 recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +52 -0
new file mode 100644
index 0000000..49c2605
@@ -0,0 +1,52 @@
+SUMMARY = "The eCryptfs mount helper and support libraries"
+DESCRIPTION = "eCryptfs is a stacked cryptographic filesystem \
+    that ships in Linux kernel versions 2.6.19 and above. This \
+    package provides the mount helper and supporting libraries \
+    to perform key management and mount functions."
+HOMEPAGE = "https://launchpad.net/ecryptfs"
+SECTION = "base"
+
+LICENSE = "GPL-2.0"
+LIC_FILES_CHKSUM = "file://COPYING;md5=8ca43cbc842c2336e835926c2166c28b"
+
+DEPENDS = "keyutils libgcrypt libpam nss intltool-native glib-2.0-native"
+
+inherit autotools pkgconfig
+
+SRC_URI = "\
+    https://launchpad.net/ecryptfs/trunk/${PV}/+download/${BPN}_${PV}.orig.tar.gz \
+    file://ecryptfs-utils-CVE-2016-6224.patch \
+    "
+
+SRC_URI[md5sum] = "83513228984f671930752c3518cac6fd"
+SRC_URI[sha256sum] = "112cb3e37e81a1ecd8e39516725dec0ce55c5f3df6284e0f4cc0f118750a987f"
+
+PARALLEL_MAKEINST=""
+
+EXTRA_OECONF = "\
+    --libdir=${base_libdir} \
+    --disable-pywrap \
+    --disable-nls \
+    --enable-openssl=no \
+    "
+
+do_configure_prepend() {
+    export NSS_CFLAGS="-I${STAGING_INCDIR}/nspr4 -I${STAGING_INCDIR}/nss3"
+    export NSS_LIBS="-L${STAGING_BASELIBDIR} -lssl3 -lsmime3 -lnss3 -lsoftokn3 -lnssutil3"
+    export KEYUTILS_CFLAGS="-I${STAGING_INCDIR}"
+    export KEYUTILS_LIBS="-L${STAGING_LIBDIR} -lkeyutils"
+}
+
+do_install_append() {
+    chmod 4755 ${D}${base_sbindir}/mount.ecryptfs_private
+    mkdir -p ${D}/${libdir}
+    mv ${D}/${base_libdir}/pkgconfig ${D}/${libdir}
+    sed -i -e 's:-I${STAGING_INCDIR}::' \
+           -e 's:-L${STAGING_LIBDIR}::' ${D}/${libdir}/pkgconfig/libecryptfs.pc
+    sed -i -e "s: ${base_sbindir}/cryptsetup: ${sbindir}/cryptsetup:" ${D}${bindir}/ecryptfs-setup-swap
+}
+
+FILES_${PN} += "${base_libdir}/security/* ${base_libdir}/ecryptfs/*"
+
+RDEPENDS_${PN} += "cryptsetup"
+RRECOMMENDS_${PN} = "gettext-runtime"
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +65 -0

65 lines not on this page · raw message

Signature · 1 line
2.11.0
#3 lore raw

Re: [meta-security][PATCH 2/2] ecryptfs-utils: add new recipe

Quoted 8 lines · On 05/17/2017 12:56 AM, [email protected] wrote:

From: Jackie Huang <[email protected]>

eCryptfs is a stacked cryptographic filesystem that ships in Linux kernel versions 2.6.19 and above. This package provides the mount helper and supporting libraries to perform key management and mount functions.

Signed-off-by Jackie Huang <[email protected]>

This has the following warning:
WARNING: libpam-1.3.0-r5 do_pam_sanity: Building libpam but 'pam' isn't in DISTRO_FEATURES, PAM won't work correctly

I noticed this package has the ability to disable-pam so maybe PACKAGECONFIG with the DISTRO_FEATURES check for PAM would be applicable in this case?

please investigate.

everything else looks fine for inclusion to meta-security.

regards,
Armin

Quoted 136 lines
---
  .../ecryptfs-utils/ecryptfs-utils_111.bb           | 52 +++++++++++++++++
  .../files/ecryptfs-utils-CVE-2016-6224.patch       | 65 ++++++++++++++++++++++
  2 files changed, 117 insertions(+)

create mode 100644 recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb create mode 100644 recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +52 -0
new file mode 100644
index 0000000..49c2605
@@ -0,0 +1,52 @@
+SUMMARY = "The eCryptfs mount helper and support libraries"
+DESCRIPTION = "eCryptfs is a stacked cryptographic filesystem \
+    that ships in Linux kernel versions 2.6.19 and above. This \
+    package provides the mount helper and supporting libraries \
+    to perform key management and mount functions."
+HOMEPAGE = "https://launchpad.net/ecryptfs"
+SECTION = "base"
+
+LICENSE = "GPL-2.0"
+LIC_FILES_CHKSUM = "file://COPYING;md5=8ca43cbc842c2336e835926c2166c28b"
+
+DEPENDS = "keyutils libgcrypt libpam nss intltool-native glib-2.0-native"
+
+inherit autotools pkgconfig
+
+SRC_URI = "\
+    https://launchpad.net/ecryptfs/trunk/${PV}/+download/${BPN}_${PV}.orig.tar.gz \
+    file://ecryptfs-utils-CVE-2016-6224.patch \
+    "
+
+SRC_URI[md5sum] = "83513228984f671930752c3518cac6fd"
+SRC_URI[sha256sum] = "112cb3e37e81a1ecd8e39516725dec0ce55c5f3df6284e0f4cc0f118750a987f"
+
+PARALLEL_MAKEINST=""
+
+EXTRA_OECONF = "\
+    --libdir=${base_libdir} \
+    --disable-pywrap \
+    --disable-nls \
+    --enable-openssl=no \
+    "
+
+do_configure_prepend() {
+    export NSS_CFLAGS="-I${STAGING_INCDIR}/nspr4 -I${STAGING_INCDIR}/nss3"
+    export NSS_LIBS="-L${STAGING_BASELIBDIR} -lssl3 -lsmime3 -lnss3 -lsoftokn3 -lnssutil3"
+    export KEYUTILS_CFLAGS="-I${STAGING_INCDIR}"
+    export KEYUTILS_LIBS="-L${STAGING_LIBDIR} -lkeyutils"
+}
+
+do_install_append() {
+    chmod 4755 ${D}${base_sbindir}/mount.ecryptfs_private
+    mkdir -p ${D}/${libdir}
+    mv ${D}/${base_libdir}/pkgconfig ${D}/${libdir}
+    sed -i -e 's:-I${STAGING_INCDIR}::' \
+           -e 's:-L${STAGING_LIBDIR}::' ${D}/${libdir}/pkgconfig/libecryptfs.pc
+    sed -i -e "s: ${base_sbindir}/cryptsetup: ${sbindir}/cryptsetup:" ${D}${bindir}/ecryptfs-setup-swap
+}
+
+FILES_${PN} += "${base_libdir}/security/* ${base_libdir}/ecryptfs/*"
+
+RDEPENDS_${PN} += "cryptsetup"
+RRECOMMENDS_${PN} = "gettext-runtime"
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +65 -0
new file mode 100644
index 0000000..4252f97
@@ -0,0 +1,65 @@
+From 558a513ba3100ea5190de1a24cf1fed663367765 Mon Sep 17 00:00:00 2001
+From: Li Zhou <[email protected]>
+Date: Mon, 5 Sep 2016 10:28:08 +0800
+Subject: [PATCH] ecryptfs-utils: CVE-2016-6224
+
+src/utils/ecryptfs-setup-swap: Prevent unencrypted swap partitions from
+being automatically enabled by systemd. This bug affected GPT partitioned
+NVMe/MMC drives and resulted in the swap partition being used without
+encryption. It also resulted in a usability issue in that users were
+erroneously prompted to enter a pass-phrase to unlock their swap partition
+at boot. (LP: #1597154)
+
+the patch comes from:
+https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6224
+https://bazaar.launchpad.net/~ecryptfs/ecryptfs/trunk/revision/882
+
+Upstream-Status: backport
+
+Signed-off-by: Li Zhou <[email protected]>
+---
+ ChangeLog                     |  9 +++++++++
+ src/utils/ecryptfs-setup-swap | 10 ++++++++--
+ 2 files changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/ChangeLog b/ChangeLog
+index d255a94..2c9c73e 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,12 @@
++ecryptfs-utils-112
++  [ Jason Gerard DeRose ]
++  * src/utils/ecryptfs-setup-swap: Prevent unencrypted swap partitions from
++    being automatically enabled by systemd. This bug affected GPT partitioned
++    NVMe/MMC drives and resulted in the swap partition being used without
++    encryption. It also resulted in a usability issue in that users were
++    erroneously prompted to enter a pass-phrase to unlock their swap partition
++    at boot. (LP: #1597154)
++
+ ecryptfs-utils-74
+   [ Michal Hlavinka ]
+   * Changes for RH/Fedora release
+diff --git a/src/utils/ecryptfs-setup-swap b/src/utils/ecryptfs-setup-swap
+index 41cf18a..e4785d7 100755
+--- a/src/utils/ecryptfs-setup-swap
++++ b/src/utils/ecryptfs-setup-swap
+@@ -166,8 +166,14 @@ for swap in $swaps; do
+ 	# If this is a GPT partition, mark it as no-auto mounting, to avoid
+ 	# auto-activating it on boot
+ 	if [ "$(blkid -p -s PART_ENTRY_SCHEME -o value "$swap")" = "gpt" ]; then
+-		drive="${swap%[0-9]*}"
+-		partno="${swap#$drive}"
++		# Correctly handle NVMe/MMC drives, as well as any similar physical
++		# block device that follow the "/dev/foo0p1" pattern (LP: #1597154)
++		if echo "$swap" | grep -qE "^/dev/.+[0-9]+p[0-9]+$"; then
++			drive=$(echo "$swap" | sed "s:\(.\+[0-9]\)p[0-9]\+:\1:")
++		else
++			drive=$(echo "$swap" | sed "s:\(.\+[^0-9]\)[0-9]\+:\1:")
++		fi
++		partno=$(echo "$swap" | sed "s:.\+[^0-9]\([0-9]\+\):\1:")
+ 		if [ -b "$drive" ]; then
+ 			if printf "x\np\n" | fdisk "$drive" | grep -q "^$swap .* GUID:.*\b63\b"; then
+ 				echo "$swap is already marked as no-auto"
+--
+1.9.1
+
author
#4 lore raw

Re: [meta-security][PATCH 2/2] ecryptfs-utils: add new recipe

Quoted 24 lines

-----Original Message-----
From: akuster808 [mailto:[email protected]]
Sent: Friday, May 19, 2017 22:50
To: Huang, Jie (Jackie); [email protected]
Subject: Re: [yocto] [meta-security][PATCH 2/2] ecryptfs-utils: add new recipe

Quoted 8 lines · On 05/17/2017 12:56 AM, [email protected] wrote:

From: Jackie Huang <[email protected]>

eCryptfs is a stacked cryptographic filesystem that ships in Linux kernel versions 2.6.19 and above. This package provides the mount helper and supporting libraries to perform key management and mount functions.

Signed-off-by Jackie Huang <[email protected]>

This has the following warning:
WARNING: libpam-1.3.0-r5 do_pam_sanity: Building libpam but 'pam' isn't in DISTRO_FEATURES, PAM won't work correctly

Quoted 6 lines

I noticed this package has the ability to disable-pam so maybe PACKAGECONFIG with the DISTRO_FEATURES check for PAM would be applicable
in this case?

please investigate.

I will investigate and fix the warning.

Thanks,
Jackie

Quoted 161 lines

everything else looks fine for inclusion to meta-security.

regards,
Armin

Quoted 3 lines
---
  .../ecryptfs-utils/ecryptfs-utils_111.bb           | 52 +++++++++++++++++
  .../files/ecryptfs-utils-CVE-2016-6224.patch       | 65

++++++++++++++++++++++

Quoted 3 lines
  2 files changed, 117 insertions(+)

create mode 100644 recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb create mode 100644 recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-

2016-6224.patch

recipes-

Quoted 2 lines
recipes- renamed from recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb +0 -0

security/ecryptfs-utils/ecryptfs-utils_111.bb

Quoted 5 lines

new file mode 100644
index 0000000..49c2605

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb line 10

Quoted 10 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +10 -0
@@ -0,0 +1,52 @@
+SUMMARY = "The eCryptfs mount helper and support libraries"
+DESCRIPTION = "eCryptfs is a stacked cryptographic filesystem \
+    that ships in Linux kernel versions 2.6.19 and above. This \
+    package provides the mount helper and supporting libraries \
+    to perform key management and mount functions."
+HOMEPAGE = "https://launchpad.net/ecryptfs"
+SECTION = "base"
+
+LICENSE = "GPL-2.0"
+LIC_FILES_CHKSUM =

"file://COPYING;md5=8ca43cbc842c2336e835926c2166c28b"

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb line 20

Quoted 7 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +7 -0
+
+DEPENDS = "keyutils libgcrypt libpam nss intltool-native glib-2.0-native"
+
+inherit autotools pkgconfig
+
+SRC_URI = "\
+

https://launchpad.net/ecryptfs/trunk/${PV}/+download/${BPN}_${PV}.orig.tar.
gz \

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb

Quoted 5 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +5 -0
+    file://ecryptfs-utils-CVE-2016-6224.patch \
+    "
+
+SRC_URI[md5sum] = "83513228984f671930752c3518cac6fd"
+SRC_URI[sha256sum] =

"112cb3e37e81a1ecd8e39516725dec0ce55c5f3df6284e0f4cc0f118750a987f"

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb

Quoted 12 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +12 -0
+
+PARALLEL_MAKEINST=""
+
+EXTRA_OECONF = "\
+    --libdir=${base_libdir} \
+    --disable-pywrap \
+    --disable-nls \
+    --enable-openssl=no \
+    "
+
+do_configure_prepend() {
+    export NSS_CFLAGS="-I${STAGING_INCDIR}/nspr4 -

I${STAGING_INCDIR}/nss3"

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb line 35

Quoted 1 line
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +1 -0
+    export NSS_LIBS="-L${STAGING_BASELIBDIR} -lssl3 -lsmime3 -lnss3 -

lsoftokn3 -lnssutil3"

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb

Quoted 11 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +11 -0
+    export KEYUTILS_CFLAGS="-I${STAGING_INCDIR}"
+    export KEYUTILS_LIBS="-L${STAGING_LIBDIR} -lkeyutils"
+}
+
+do_install_append() {
+    chmod 4755 ${D}${base_sbindir}/mount.ecryptfs_private
+    mkdir -p ${D}/${libdir}
+    mv ${D}/${base_libdir}/pkgconfig ${D}/${libdir}
+    sed -i -e 's:-I${STAGING_INCDIR}::' \
+           -e 's:-L${STAGING_LIBDIR}::' ${D}/${libdir}/pkgconfig/libecryptfs.pc
+    sed -i -e "s: ${base_sbindir}/cryptsetup: ${sbindir}/cryptsetup:"

${D}${bindir}/ecryptfs-setup-swap

Review

Quoted 7 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +6 -0
+}
+
+FILES_${PN} += "${base_libdir}/security/* ${base_libdir}/ecryptfs/*"
+
+RDEPENDS_${PN} += "cryptsetup"
+RRECOMMENDS_${PN} = "gettext-runtime"
(quoted diff) +0 -0

6224.patch b/recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016- 6224.patch

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch line 1

Quoted 6 lines

new file mode 100644
index 0000000..4252f97

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +1 -0
@@ -0,0 +1,65 @@
+From 558a513ba3100ea5190de1a24cf1fed663367765 Mon Sep 17 00:00:00

2001

Quoted 22 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +22 -0
+From: Li Zhou <[email protected]>
+Date: Mon, 5 Sep 2016 10:28:08 +0800
+Subject: [PATCH] ecryptfs-utils: CVE-2016-6224
+
+src/utils/ecryptfs-setup-swap: Prevent unencrypted swap partitions from
+being automatically enabled by systemd. This bug affected GPT partitioned
+NVMe/MMC drives and resulted in the swap partition being used without
+encryption. It also resulted in a usability issue in that users were
+erroneously prompted to enter a pass-phrase to unlock their swap partition
+at boot. (LP: #1597154)
+
+the patch comes from:
+https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6224
+https://bazaar.launchpad.net/~ecryptfs/ecryptfs/trunk/revision/882
+
+Upstream-Status: backport
+
+Signed-off-by: Li Zhou <[email protected]>
+---
+ ChangeLog                     |  9 +++++++++
+ src/utils/ecryptfs-setup-swap | 10 ++++++++--
+ 2 files changed, 17 insertions(+), 2 deletions(-)

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch

Quoted 10 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +10 -0
+
+diff --git a/ChangeLog b/ChangeLog
+index d255a94..2c9c73e 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,12 @@
++ecryptfs-utils-112
++  [ Jason Gerard DeRose ]
++  * src/utils/ecryptfs-setup-swap: Prevent unencrypted swap partitions from
++    being automatically enabled by systemd. This bug affected GPT

partitioned

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch

Quoted 3 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +3 -0
++    NVMe/MMC drives and resulted in the swap partition being used without
++    encryption. It also resulted in a usability issue in that users were
++    erroneously prompted to enter a pass-phrase to unlock their swap

partition

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch

Quoted 13 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +13 -0
++    at boot. (LP: #1597154)
++
+ ecryptfs-utils-74
+   [ Michal Hlavinka ]
+   * Changes for RH/Fedora release
+diff --git a/src/utils/ecryptfs-setup-swap b/src/utils/ecryptfs-setup-swap
+index 41cf18a..e4785d7 100755
+--- a/src/utils/ecryptfs-setup-swap
++++ b/src/utils/ecryptfs-setup-swap
+@@ -166,8 +166,14 @@ for swap in $swaps; do
+ 	# If this is a GPT partition, mark it as no-auto mounting, to avoid
+ 	# auto-activating it on boot
+ 	if [ "$(blkid -p -s PART_ENTRY_SCHEME -o value "$swap")" = "gpt" ];

then

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch

Quoted 3 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +3 -0
+-		drive="${swap%[0-9]*}"
+-		partno="${swap#$drive}"
++		# Correctly handle NVMe/MMC drives, as well as any similar

physical

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch line 53

Quoted 1 line
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +1 -0
++		# block device that follow the "/dev/foo0p1" pattern (LP:

#1597154)

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch

Quoted 8 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +8 -0
++		if echo "$swap" | grep -qE "^/dev/.+[0-9]+p[0-9]+$"; then
++			drive=$(echo "$swap" | sed "s:\(.\+[0-9]\)p[0-9]\+:\1:")
++		else
++			drive=$(echo "$swap" | sed "s:\(.\+[^0-9]\)[0-9]\+:\1:")
++		fi
++		partno=$(echo "$swap" | sed "s:.\+[^0-9]\([0-9]\+\):\1:")
+ 		if [ -b "$drive" ]; then
+ 			if printf "x\np\n" | fdisk "$drive" | grep -q "^$swap .*

GUID:.*\b63\b"; then

Quoted 4 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +4 -0
+ 				echo "$swap is already marked as no-auto"
+--
+1.9.1
+
#5 lore raw

Re: [meta-security][PATCH 2/2] ecryptfs-utils: add new recipe

How does this one relate to:
http://git.yoctoproject.org/cgit/cgit.cgi/meta-ivi/tree/meta-ivi/recipes-support-ivi/ecryptfs-utils/ecryptfs-utils_106.bb?h=master

the later has also support for systemd, not sure if it has the issue with pam or not.

Quoted 225 lines · Jie (Jackie)
Quoted 7 lines

-----Original Message-----
From: akuster808 [mailto:[email protected]]
Sent: Friday, May 19, 2017 22:50
To: Huang, Jie (Jackie); [email protected]
Subject: Re: [yocto] [meta-security][PATCH 2/2] ecryptfs-utils: add new

recipe

Quoted 17 lines · On 05/17/2017 12:56 AM, [email protected] wrote:
Quoted 8 lines

From: Jackie Huang <[email protected]>

eCryptfs is a stacked cryptographic filesystem that ships in Linux kernel versions 2.6.19 and above. This package provides the mount helper and supporting libraries to perform key management and mount functions.

Signed-off-by Jackie Huang <[email protected]>

This has the following warning:
WARNING: libpam-1.3.0-r5 do_pam_sanity: Building libpam but 'pam' isn't in DISTRO_FEATURES, PAM won't work correctly

Quoted 6 lines

I noticed this package has the ability to disable-pam so maybe PACKAGECONFIG with the DISTRO_FEATURES check for PAM would be applicable
in this case?

please investigate.

I will investigate and fix the warning.

Thanks,
Jackie

Quoted 8 lines

everything else looks fine for inclusion to meta-security.

regards,
Armin

Quoted 2 lines
---
  .../ecryptfs-utils/ecryptfs-utils_111.bb           | 52

+++++++++++++++++

Quoted 4 lines
Quoted 1 line
  .../files/ecryptfs-utils-CVE-2016-6224.patch       | 65

++++++++++++++++++++++

Quoted 2 lines
  2 files changed, 117 insertions(+)

create mode 100644 recipes-security/ecryptfs-utils/

ecryptfs-utils_111.bb

Quoted 1 line
Quoted 1 line

create mode 100644 recipes-security/ecryptfs-

utils/files/ecryptfs-utils-CVE-

Quoted 3 lines

2016-6224.patch

Review

Quoted 2 lines
(quoted diff) +0 -0

b/recipes-

Quoted 17 lines

security/ecryptfs-utils/ecryptfs-utils_111.bb

Quoted 5 lines

new file mode 100644
index 0000000..49c2605

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb line 10

Quoted 10 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +10 -0
@@ -0,0 +1,52 @@
+SUMMARY = "The eCryptfs mount helper and support libraries"
+DESCRIPTION = "eCryptfs is a stacked cryptographic filesystem \
+    that ships in Linux kernel versions 2.6.19 and above. This \
+    package provides the mount helper and supporting libraries \
+    to perform key management and mount functions."
+HOMEPAGE = "https://launchpad.net/ecryptfs"
+SECTION = "base"
+
+LICENSE = "GPL-2.0"
+LIC_FILES_CHKSUM =

"file://COPYING;md5=8ca43cbc842c2336e835926c2166c28b"

Quoted 2 lines

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb line 12

Quoted 2 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +2 -0
+
+DEPENDS = "keyutils libgcrypt libpam nss intltool-native

glib-2.0-native"

Quoted 6 lines

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb line 20

Quoted 5 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +5 -0
+
+inherit autotools pkgconfig
+
+SRC_URI = "\
+

https://launchpad.net/ecryptfs/trunk/${PV}/+

download/${BPN}_${PV}.orig.tar.

Quoted 22 lines

gz \

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb

Quoted 5 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +5 -0
+    file://ecryptfs-utils-CVE-2016-6224.patch \
+    "
+
+SRC_URI[md5sum] = "83513228984f671930752c3518cac6fd"
+SRC_URI[sha256sum] =

"112cb3e37e81a1ecd8e39516725dec0ce55c5f3df6284e0f4cc0f118750a987f"

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb

Quoted 12 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +12 -0
+
+PARALLEL_MAKEINST=""
+
+EXTRA_OECONF = "\
+    --libdir=${base_libdir} \
+    --disable-pywrap \
+    --disable-nls \
+    --enable-openssl=no \
+    "
+
+do_configure_prepend() {
+    export NSS_CFLAGS="-I${STAGING_INCDIR}/nspr4 -

I${STAGING_INCDIR}/nss3"

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb line 35

Quoted 1 line
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +1 -0
+    export NSS_LIBS="-L${STAGING_BASELIBDIR} -lssl3 -lsmime3 -lnss3 -

lsoftokn3 -lnssutil3"

Quoted 10 lines

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb

Quoted 10 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +10 -0
+    export KEYUTILS_CFLAGS="-I${STAGING_INCDIR}"
+    export KEYUTILS_LIBS="-L${STAGING_LIBDIR} -lkeyutils"
+}
+
+do_install_append() {
+    chmod 4755 ${D}${base_sbindir}/mount.ecryptfs_private
+    mkdir -p ${D}/${libdir}
+    mv ${D}/${base_libdir}/pkgconfig ${D}/${libdir}
+    sed -i -e 's:-I${STAGING_INCDIR}::' \
+           -e 's:-L${STAGING_LIBDIR}::' ${D}/${libdir}/pkgconfig/

libecryptfs.pc

Quoted 9 lines

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb line 46

Quoted 1 line
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +1 -0
+    sed -i -e "s: ${base_sbindir}/cryptsetup: ${sbindir}/cryptsetup:"

${D}${bindir}/ecryptfs-setup-swap

Review

Quoted 7 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb new file +6 -0
+}
+
+FILES_${PN} += "${base_libdir}/security/* ${base_libdir}/ecryptfs/*"
+
+RDEPENDS_${PN} += "cryptsetup"
+RRECOMMENDS_${PN} = "gettext-runtime"
(quoted diff) +0 -0

CVE-2016-

Quoted 1 line

6224.patch b/recipes-security/ecryptfs-utils/files/ecryptfs-utils-

CVE-2016-

Quoted 5 lines

6224.patch

recipes-security/ecryptfs-utils/files/ecryptfs-utils-

Quoted 4 lines

new file mode 100644
index 0000000..4252f97

recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +0 -0

CVE-2016-6224.patch

Quoted 8 lines

recipes-security/ecryptfs-utils/files/ecryptfs-utils- line 1

Quoted 2 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +1 -0
@@ -0,0 +1,65 @@
+From 558a513ba3100ea5190de1a24cf1fed663367765 Mon Sep 17 00:00:00

2001

recipes-security/ecryptfs-utils/files/ecryptfs-utils- line 6

Quoted 5 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +5 -0
+From: Li Zhou <[email protected]>
+Date: Mon, 5 Sep 2016 10:28:08 +0800
+Subject: [PATCH] ecryptfs-utils: CVE-2016-6224
+
+src/utils/ecryptfs-setup-swap: Prevent unencrypted swap partitions

from

Quoted 1 line

recipes-security/ecryptfs-utils/files/ecryptfs-utils- line 7

Quoted 1 line
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +1 -0
+being automatically enabled by systemd. This bug affected GPT

partitioned

Quoted 3 lines

recipes-security/ecryptfs-utils/files/ecryptfs-utils- line 10

Quoted 3 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +3 -0
+NVMe/MMC drives and resulted in the swap partition being used without
+encryption. It also resulted in a usability issue in that users were
+erroneously prompted to enter a pass-phrase to unlock their swap

partition

Quoted 14 lines
Quoted 14 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +14 -0
+at boot. (LP: #1597154)
+
+the patch comes from:
+https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6224
+https://bazaar.launchpad.net/~ecryptfs/ecryptfs/trunk/revision/882
+
+Upstream-Status: backport
+
+Signed-off-by: Li Zhou <[email protected]>
+---
+ ChangeLog                     |  9 +++++++++
+ src/utils/ecryptfs-setup-swap | 10 ++++++++--
+ 2 files changed, 17 insertions(+), 2 deletions(-)
+
Quoted 8 lines

recipes-security/ecryptfs-utils/files/ecryptfs-utils- line 32

Quoted 8 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +8 -0
+diff --git a/ChangeLog b/ChangeLog
+index d255a94..2c9c73e 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,12 @@
++ecryptfs-utils-112
++  [ Jason Gerard DeRose ]
++  * src/utils/ecryptfs-setup-swap: Prevent unencrypted swap

partitions from

Quoted 3 lines

recipes-security/ecryptfs-utils/files/ecryptfs-utils- line 33

Quoted 1 line
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +1 -0
++    being automatically enabled by systemd. This bug affected GPT

partitioned

Quoted 1 line
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +1 -0
++    NVMe/MMC drives and resulted in the swap partition being used

without

Quoted 1 line

recipes-security/ecryptfs-utils/files/ecryptfs-utils- line 35

Quoted 1 line
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +1 -0
++    encryption. It also resulted in a usability issue in that users

were

Quoted 8 lines

recipes-security/ecryptfs-utils/files/ecryptfs-utils- line 36

Quoted 1 line
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +1 -0
++    erroneously prompted to enter a pass-phrase to unlock their swap

partition

Quoted 6 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +6 -0
++    at boot. (LP: #1597154)
++
+ ecryptfs-utils-74
+   [ Michal Hlavinka ]
+   * Changes for RH/Fedora release
+diff --git a/src/utils/ecryptfs-setup-swap

b/src/utils/ecryptfs-setup-swap

Quoted 7 lines

recipes-security/ecryptfs-utils/files/ecryptfs-utils- line 49

Quoted 7 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +7 -0
+index 41cf18a..e4785d7 100755
+--- a/src/utils/ecryptfs-setup-swap
++++ b/src/utils/ecryptfs-setup-swap
+@@ -166,8 +166,14 @@ for swap in $swaps; do
+   # If this is a GPT partition, mark it as no-auto mounting, to avoid
+   # auto-activating it on boot
+   if [ "$(blkid -p -s PART_ENTRY_SCHEME -o value "$swap")" = "gpt" ];
Quoted 9 lines

then

recipes-security/ecryptfs-utils/files/ecryptfs-utils- line 52

Quoted 3 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +3 -0
+-          drive="${swap%[0-9]*}"
+-          partno="${swap#$drive}"
++          # Correctly handle NVMe/MMC drives, as well as any similar

physical

recipes-security/ecryptfs-utils/files/ecryptfs-utils- line 53

Quoted 1 line
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +1 -0
++          # block device that follow the "/dev/foo0p1" pattern (LP:

#1597154)

Quoted 2 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +2 -0
++          if echo "$swap" | grep -qE "^/dev/.+[0-9]+p[0-9]+$"; then
++                  drive=$(echo "$swap" | sed

"s:\(.\+[0-9]\)p[0-9]\+:\1:")

Quoted 2 lines

recipes-security/ecryptfs-utils/files/ecryptfs-utils- line 57

Quoted 2 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +2 -0
++          else
++                  drive=$(echo "$swap" | sed

"s:\(.\+[^0-9]\)[0-9]\+:\1:")

Quoted 4 lines

recipes-security/ecryptfs-utils/files/ecryptfs-utils- line 61

Quoted 4 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +4 -0
++          fi
++          partno=$(echo "$swap" | sed "s:.\+[^0-9]\([0-9]\+\):\1:")
+           if [ -b "$drive" ]; then
+                   if printf "x\np\n" | fdisk "$drive" | grep -q

"^$swap .*

Quoted 5 lines

GUID:.*\b63\b"; then

Quoted 4 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils- new file +4 -0
+                           echo "$swap is already marked as no-auto"
+--
+1.9.1
+

--
_______________________________________________
yocto mailing list
[email protected]
https://lists.yoctoproject.org/listinfo/yocto

author
#6 lore raw

Re: [meta-security][PATCH 2/2] ecryptfs-utils: add new recipe

Hi Martin,

Thanks for the reference, but the one in meta-ivi is an older version and also has the same pam issue, I will fix it with PACKAGECONFIG and DISTRO_FEATURES check for PAM, and also add the systemd support.

Thanks,
Jackie

From: Martin Jansa [mailto:[email protected]]
Sent: Friday, May 19, 2017 23:27
To: Huang, Jie (Jackie)
Cc: akuster808; [email protected]
Subject: Re: [yocto] [meta-security][PATCH 2/2] ecryptfs-utils: add new recipe

How does this one relate to:
http://git.yoctoproject.org/cgit/cgit.cgi/meta-ivi/tree/meta-ivi/recipes-support-ivi/ecryptfs-utils/ecryptfs-utils_106.bb?h=master

the later has also support for systemd, not sure if it has the issue with pam or not.

Quoted 22 lines · On Fri, May 19, 2017 at 4:56 PM, Huang, Jie (Jackie)…

-----Original Message-----
From: akuster808 [mailto:[email protected]<mailto:[email protected]>]
Sent: Friday, May 19, 2017 22:50
To: Huang, Jie (Jackie); [email protected]<mailto:[email protected]>
Subject: Re: [yocto] [meta-security][PATCH 2/2] ecryptfs-utils: add new recipe

Quoted 8 lines · On 05/17/2017 12:56 AM, [email protected]<mailto:jackie.huang@windrive…

From: Jackie Huang <[email protected]<mailto:[email protected]>>

eCryptfs is a stacked cryptographic filesystem that ships in Linux kernel versions 2.6.19 and above. This package provides the mount helper and supporting libraries to perform key management and mount functions.

Signed-off-by Jackie Huang <[email protected]<mailto:[email protected]>>

This has the following warning:
WARNING: libpam-1.3.0-r5 do_pam_sanity: Building libpam but 'pam' isn't in DISTRO_FEATURES, PAM won't work correctly

Quoted 6 lines

I noticed this package has the ability to disable-pam so maybe PACKAGECONFIG with the DISTRO_FEATURES check for PAM would be applicable
in this case?

please investigate.

I will investigate and fix the warning.

Thanks,
Jackie

Quoted 156 lines

everything else looks fine for inclusion to meta-security.

regards,
Armin

Quoted 3 lines
---
  .../ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb>           | 52 +++++++++++++++++
  .../files/ecryptfs-utils-CVE-2016-6224.patch       | 65

++++++++++++++++++++++

Quoted 3 lines
  2 files changed, 117 insertions(+)

create mode 100644 recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> create mode 100644 recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-

2016-6224.patch

recipes-

Quoted 2 lines
recipes- renamed from recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> +0 -0

security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb>

Quoted 5 lines

new file mode 100644
index 0000000..49c2605

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> line 10

Quoted 10 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> new file +10 -0
@@ -0,0 +1,52 @@
+SUMMARY = "The eCryptfs mount helper and support libraries"
+DESCRIPTION = "eCryptfs is a stacked cryptographic filesystem \
+    that ships in Linux kernel versions 2.6.19 and above. This \
+    package provides the mount helper and supporting libraries \
+    to perform key management and mount functions."
+HOMEPAGE = "https://launchpad.net/ecryptfs"
+SECTION = "base"
+
+LICENSE = "GPL-2.0"
+LIC_FILES_CHKSUM =

"file://COPYING;md5=8ca43cbc842c2336e835926c2166c28b<file:///\\COPYING;md5=8ca43cbc842c2336e835926c2166c28b>"

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> line 17

Quoted 7 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> new file +7 -0
+
+DEPENDS = "keyutils libgcrypt libpam nss intltool-native glib-2.0-native"
+
+inherit autotools pkgconfig
+
+SRC_URI = "\
+

https://launchpad.net/ecryptfs/trunk/${PV}/+download/${BPN}_${PV}.orig.tar<https://launchpad.net/ecryptfs/trunk/$%7bPV%7d/+download/$%7bBPN%7d_$%7bPV%7d.orig.tar>.
gz \

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> line 22

Quoted 5 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> new file +5 -0
+    file://ecryptfs-utils-CVE-2016-6224.patch<file:///\\ecryptfs-utils-CVE-2016-6224.patch> \
+    "
+
+SRC_URI[md5sum] = "83513228984f671930752c3518cac6fd"
+SRC_URI[sha256sum] =

"112cb3e37e81a1ecd8e39516725dec0ce55c5f3df6284e0f4cc0f118750a987f"

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> line 34

Quoted 12 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> new file +12 -0
+
+PARALLEL_MAKEINST=""
+
+EXTRA_OECONF = "\
+    --libdir=${base_libdir} \
+    --disable-pywrap \
+    --disable-nls \
+    --enable-openssl=no \
+    "
+
+do_configure_prepend() {
+    export NSS_CFLAGS="-I${STAGING_INCDIR}/nspr4 -

I${STAGING_INCDIR}/nss3"

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> line 35

Quoted 1 line
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> new file +1 -0
+    export NSS_LIBS="-L${STAGING_BASELIBDIR} -lssl3 -lsmime3 -lnss3 -

lsoftokn3 -lnssutil3"

recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> line 46

Quoted 11 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> new file +11 -0
+    export KEYUTILS_CFLAGS="-I${STAGING_INCDIR}"
+    export KEYUTILS_LIBS="-L${STAGING_LIBDIR} -lkeyutils"
+}
+
+do_install_append() {
+    chmod 4755 ${D}${base_sbindir}/mount.ecryptfs_private
+    mkdir -p ${D}/${libdir}
+    mv ${D}/${base_libdir}/pkgconfig ${D}/${libdir}
+    sed -i -e 's:-I${STAGING_INCDIR}::' \
+           -e 's:-L${STAGING_LIBDIR}::' ${D}/${libdir}/pkgconfig/libecryptfs.pc
+    sed -i -e "s: ${base_sbindir}/cryptsetup: ${sbindir}/cryptsetup:"

${D}${bindir}/ecryptfs-setup-swap

Review

Quoted 7 lines
recipes-security/ecryptfs-utils/ecryptfs-utils_111.bb<http://ecryptfs-utils_111.bb> new file +6 -0
+}
+
+FILES_${PN} += "${base_libdir}/security/* ${base_libdir}/ecryptfs/*"
+
+RDEPENDS_${PN} += "cryptsetup"
+RRECOMMENDS_${PN} = "gettext-runtime"
(quoted diff) +0 -0

6224.patch b/recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016- 6224.patch

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch line 1

Quoted 6 lines

new file mode 100644
index 0000000..4252f97

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +1 -0
@@ -0,0 +1,65 @@
+From 558a513ba3100ea5190de1a24cf1fed663367765 Mon Sep 17 00:00:00

2001

Quoted 22 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +22 -0
+From: Li Zhou <[email protected]<mailto:[email protected]>>
+Date: Mon, 5 Sep 2016 10:28:08 +0800
+Subject: [PATCH] ecryptfs-utils: CVE-2016-6224
+
+src/utils/ecryptfs-setup-swap: Prevent unencrypted swap partitions from
+being automatically enabled by systemd. This bug affected GPT partitioned
+NVMe/MMC drives and resulted in the swap partition being used without
+encryption. It also resulted in a usability issue in that users were
+erroneously prompted to enter a pass-phrase to unlock their swap partition
+at boot. (LP: #1597154)
+
+the patch comes from:
+https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6224
+https://bazaar.launchpad.net/~ecryptfs/ecryptfs/trunk/revision/882
+
+Upstream-Status: backport
+
+Signed-off-by: Li Zhou <[email protected]<mailto:[email protected]>>
+---
+ ChangeLog                     |  9 +++++++++
+ src/utils/ecryptfs-setup-swap | 10 ++++++++--
+ 2 files changed, 17 insertions(+), 2 deletions(-)

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch

Quoted 10 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +10 -0
+
+diff --git a/ChangeLog b/ChangeLog
+index d255a94..2c9c73e 100644
+--- a/ChangeLog
++++ b/ChangeLog
+@@ -1,3 +1,12 @@
++ecryptfs-utils-112
++  [ Jason Gerard DeRose ]
++  * src/utils/ecryptfs-setup-swap: Prevent unencrypted swap partitions from
++    being automatically enabled by systemd. This bug affected GPT

partitioned

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch

Quoted 3 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +3 -0
++    NVMe/MMC drives and resulted in the swap partition being used without
++    encryption. It also resulted in a usability issue in that users were
++    erroneously prompted to enter a pass-phrase to unlock their swap

partition

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch

Quoted 13 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +13 -0
++    at boot. (LP: #1597154)
++
+ ecryptfs-utils-74
+   [ Michal Hlavinka ]
+   * Changes for RH/Fedora release
+diff --git a/src/utils/ecryptfs-setup-swap b/src/utils/ecryptfs-setup-swap
+index 41cf18a..e4785d7 100755
+--- a/src/utils/ecryptfs-setup-swap
++++ b/src/utils/ecryptfs-setup-swap
+@@ -166,8 +166,14 @@ for swap in $swaps; do
+   # If this is a GPT partition, mark it as no-auto mounting, to avoid
+   # auto-activating it on boot
+   if [ "$(blkid -p -s PART_ENTRY_SCHEME -o value "$swap")" = "gpt" ];

then

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch

Quoted 3 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +3 -0
+-          drive="${swap%[0-9]*}"
+-          partno="${swap#$drive}"
++          # Correctly handle NVMe/MMC drives, as well as any similar

physical

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch line 53

Quoted 1 line
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +1 -0
++          # block device that follow the "/dev/foo0p1" pattern (LP:

#1597154)

recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch

Quoted 8 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +8 -0
++          if echo "$swap" | grep -qE "^/dev/.+[0-9]+p[0-9]+$"; then
++                  drive=$(echo "$swap" | sed "s:\(.\+[0-9]\)p[0-9]\+:\1:")
++          else
++                  drive=$(echo "$swap" | sed "s:\(.\+[^0-9]\)[0-9]\+:\1:")
++          fi
++          partno=$(echo "$swap" | sed "s:.\+[^0-9]\([0-9]\+\):\1:")
+           if [ -b "$drive" ]; then
+                   if printf "x\np\n" | fdisk "$drive" | grep -q "^$swap .*
Quoted 5 lines

GUID:.*\b63\b"; then

Quoted 4 lines
recipes-security/ecryptfs-utils/files/ecryptfs-utils-CVE-2016-6224.patch new file +4 -0
+                           echo "$swap is already marked as no-auto"
+--
+1.9.1
+

--
_______________________________________________
yocto mailing list [email protected]<mailto:[email protected]>
https://lists.yoctoproject.org/listinfo/yocto