|
[meta-rockchip][PATCH v4 0/3] kmeta BSP for nanopi-m4
Yann Dirson
From: Yann Dirson <yann@...>
Changes in v4: - install our bsp files in bsp/rockchip/ rather than directly in bsp/ - also add "serial" to MACHINE_FEATURES Changes in v3: - relocate the bsp files into files/ so we don't have to add linux-yocto/ to FILESEXTRAPATHS for all other kernels - removed the "don't force KCONFIG_MODE to alldefconfig" (not needed fina= lly, and causing interferences in default setup) - add "usbhost" to MACHINE_FEATURES to enable lsusb and friends - better hardware coverage (though still no wifi/bt/audio, and buggy hdmi= ) The Wifi/BT support requires firmware, to be properly packaged; BT support itself is still buggy in mainline; audio jack requires a couple of patches; HDMI requires at the very least a DTS patch, and LibreELEC maintains a "latest and greatest" DRM patchset, but it can conflicts with some patches in default kmeta. Yann Dirson (3): NanoPi-M4: let all variants use the same KMACHINE type NanoPi-M4: declare "usbhost" and "serial" in MACHINE_FEATURES linux-yocto: add an initial NanoPi-M4 BSP conf/machine/include/nanopi-m4.inc | 3 + .../files/bsp/rockchip/nanopi-m4-standard.scc | 7 ++ .../files/bsp/rockchip/nanopi-m4-tiny.scc | 7 ++ .../linux/files/bsp/rockchip/nanopi-m4.cfg | 15 ++++ .../linux/files/bsp/rockchip/nanopi-m4.scc | 5 ++ .../linux/files/bsp/rockchip/rk3399.cfg | 71 +++++++++++++++++++ .../linux/files/bsp/rockchip/rk3399.scc | 5 ++ .../linux/files/bsp/rockchip/rockchip.cfg | 50 +++++++++++++ .../linux/files/bsp/rockchip/rockchip.scc | 6 ++ recipes-kernel/linux/linux-yocto%.bbappend | 6 ++ 10 files changed, 175 insertions(+) create mode 100644 recipes-kernel/linux/files/bsp/rockchip/nanopi-m4-sta= ndard.scc create mode 100644 recipes-kernel/linux/files/bsp/rockchip/nanopi-m4-tin= y.scc create mode 100644 recipes-kernel/linux/files/bsp/rockchip/nanopi-m4.cfg create mode 100644 recipes-kernel/linux/files/bsp/rockchip/nanopi-m4.scc create mode 100644 recipes-kernel/linux/files/bsp/rockchip/rk3399.cfg create mode 100644 recipes-kernel/linux/files/bsp/rockchip/rk3399.scc create mode 100644 recipes-kernel/linux/files/bsp/rockchip/rockchip.cfg create mode 100644 recipes-kernel/linux/files/bsp/rockchip/rockchip.scc --=20 2.30.2
|
|
|
|
Re: Switching a recipe between git head and git tag (for a release)
Quentin Schulz
Hi Martin,
On Mon, Apr 26, 2021 at 12:41:18PM +0000, Martin Hollingsworth wrote: Hello community,Look how swupdate recipes are done in meta-swupdate: https://github.com/sbabic/meta-swupdate/tree/master/recipes-support/swupdate Basically all variants include the .inc file where everything in common is specified. Then the git recipe would point to your git master HEAD (I guess you\re using AUTOREV mechanism?) and the point releases are e.g. foo_1.5.0.bb where you put a given SRCREV only (or even a tarball if you want). In the git recipe, add: DEFAULT_PREFERENCE = "-1" This means it'll never be preferred to other recipes (if there are others). For your nightly builds, you put PREFERRED_VERSION_foo = "git" in local.conf and you should be good to go (don't add it for release builds obviously :) ). Hope that helps, Cheers, Quentin
|
|
|
|
[meta-security][PATCH] libseccomp: drop recipe. In core now
Signed-off-by: Armin Kuster <akuster808@...>
--- recipes-security/libseccomp/files/run-ptest | 4 -- .../libseccomp/libseccomp_2.5.1.bb | 47 ------------------- 2 files changed, 51 deletions(-) delete mode 100644 recipes-security/libseccomp/files/run-ptest delete mode 100644 recipes-security/libseccomp/libseccomp_2.5.1.bb diff --git a/recipes-security/libseccomp/files/run-ptest b/recipes-security/libseccomp/files/run-ptest deleted file mode 100644 index 54b4a63..0000000 --- a/recipes-security/libseccomp/files/run-ptest +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh - -cd tests -./regression -a diff --git a/recipes-security/libseccomp/libseccomp_2.5.1.bb b/recipes-security/libseccomp/libseccomp_2.5.1.bb deleted file mode 100644 index 40ac1a8..0000000 --- a/recipes-security/libseccomp/libseccomp_2.5.1.bb +++ /dev/null @@ -1,47 +0,0 @@ -SUMMARY = "interface to seccomp filtering mechanism" -DESCRIPTION = "The libseccomp library provides and easy to use, platform independent,interface to the Linux Kernel's syscall filtering mechanism: seccomp." -SECTION = "security" -LICENSE = "LGPL-2.1" -LIC_FILES_CHKSUM = "file://LICENSE;beginline=0;endline=1;md5=8eac08d22113880357ceb8e7c37f989f" - -DEPENDS += "gperf-native" - -SRCREV = "4bf70431a339a2886ab8c82e9a45378f30c6e6c7" - -SRC_URI = "git://github.com/seccomp/libseccomp.git;branch=release-2.5 \ - file://run-ptest \ - " - -COMPATIBLE_HOST_riscv32 = "null" - -S = "${WORKDIR}/git" - -inherit autotools-brokensep pkgconfig ptest - -PACKAGECONFIG ??= "" -PACKAGECONFIG[python] = "--enable-python, --disable-python, python3" - -DISABLE_STATIC = "" - -do_compile_ptest() { - oe_runmake -C tests check-build -} - -do_install_ptest() { - install -d ${D}${PTEST_PATH}/tests - install -d ${D}${PTEST_PATH}/tools - for file in $(find tests/* -executable -type f); do - install -m 744 ${S}/${file} ${D}/${PTEST_PATH}/tests - done - for file in $(find tests/*.tests -type f); do - install -m 744 ${S}/${file} ${D}/${PTEST_PATH}/tests - done - for file in $(find tools/* -executable -type f); do - install -m 744 ${S}/${file} ${D}/${PTEST_PATH}/tools - done -} - -FILES_${PN} = "${bindir} ${libdir}/${BPN}.so*" -FILES_${PN}-dbg += "${libdir}/${PN}/tests/.debug/* ${libdir}/${PN}/tools/.debug" - -RDEPENDS_${PN}-ptest = "coreutils bash" -- 2.25.1
|
|
|
|
Re: AppArmor with BusyBox
Quentin Schulz
Hi Konstantin,
On Mon, Apr 26, 2021 at 01:45:30PM +0300, Konstantin Aladyshev wrote: I'm using the OpenBMC system (https://github.com/openbmc/openbmc) andBusybox implementation of xargs does not support specifying a delimiter. I suggest you to install the full-featured xargs which is provided by the findutils recipe. You probably need to disable xargs Busybox implementation otherwise there'll be a conflict (you'll know, Yocto won't create the image). Cheers, Quentin
|
|
|
|
AppArmor with BusyBox
Konstantin Aladyshev <aladyshev22@...>
I'm using the OpenBMC system (https://github.com/openbmc/openbmc) and
I've tried to enable AppArmor functionality from the 'meta-security' layer. To achieve this I've added these strings to my local.conf file: DISTRO_FEATURES_append = " apparmor" IMAGE_INSTALL += "apparmor" The AppArmor functionality was installed to my image, but unfortunately I've come to this issue: kernel: AppArmor: AppArmor initialized kernel: AppArmor: AppArmor Filesystem Enabled kernel: AppArmor: AppArmor sha1 policy hashing enabled systemd[1]: systemd 247.3+ running in system mode. (+PAM -AUDIT -SELINUX -IMA -APPARMOR -SMACK +SYSVINIT -UTMP -LIBCRYPTSETUP -GCRYPT -GNUTLS -ACL +XZ -LZ4 -ZSTD -SECCOMP +BLKID -ELFUTILS +KMOD -IDN2 -IDN -PCRE2 default-hierarchy=hybrid) systemd[1]: Starting AppArmor initialization... apparmor[113]: Starting AppArmor profiles apparmor[128]: xargs: invalid option -- 'd' apparmor[128]: BusyBox v1.33.0 (2021-04-01 10:05:19 UTC) multi-call binary. apparmor[128]: Usage: xargs [OPTIONS] [PROG ARGS] apparmor[131]: /lib/apparmor/functions: line 76: echo: write error: Broken pipe apparmor[131]: /lib/apparmor/functions: line 76: echo: write error: Broken pipe ... apparmor[131]: /lib/apparmor/functions: line 76: echo: write error: Broken pipe apparmor[131]: /lib/apparmor/functions: line 76: echo: write error: Broken pipe apparmor[138]: xargs: invalid option -- 'd' apparmor[138]: BusyBox v1.33.0 (2021-04-01 10:05:19 UTC) multi-call binary. apparmor[138]: Usage: xargs [OPTIONS] [PROG ARGS] apparmor[142]: /lib/apparmor/functions: line 92: echo: write error: Broken pipe apparmor[142]: /lib/apparmor/functions: line 92: echo: write error: Broken pipe ... apparmor[142]: /lib/apparmor/functions: line 92: echo: write error: Broken pipe apparmor[142]: /lib/apparmor/functions: line 92: echo: write error: Broken pipe apparmor[113]: failed! systemd[1]: apparmor.service: Main process exited, code=exited, status=1/FAILURE systemd[1]: apparmor.service: Failed with result 'exit-code'. systemd[1]: Failed to start AppArmor initialization. dbus-broker-launch[152]: AppArmor enabled, but not supported. Ignoring. From the way I see it the problems start from this output: xargs: invalid option -- 'd' This error comes from a fact that `xargs` from the `busybox` doesn't have the `-d` option (https://git.busybox.net/busybox/tree/findutils/xargs.c) but this functionality is used in the file: https://git.yoctoproject.org/cgit/cgit.cgi/meta-security/tree/recipes-mac/AppArmor/files/functions Once I've discovered it, I started to wonder if I'm doing everything correctly. Is my issue a simple bug, or AppArmor is not supposed to be run in an environment like mine? Best regards, Konstantin Aladyshev
|
|
|
|
AppArmor with BusyBox
aladyshev22@...
I'm using the OpenBMC system (https://github.com/openbmc/openbmc) and
I've tried to enable AppArmor functionality from the 'meta-security' layer. To achieve this I've added these strings to my local.conf file: DISTRO_FEATURES_append = " apparmor" IMAGE_INSTALL += "apparmor" The AppArmor functionality was installed to my image, but unfortunately I've come to this issue: kernel: AppArmor: AppArmor initialized kernel: AppArmor: AppArmor Filesystem Enabled kernel: AppArmor: AppArmor sha1 policy hashing enabled systemd[1]: systemd 247.3+ running in system mode. (+PAM -AUDIT -SELINUX -IMA -APPARMOR -SMACK +SYSVINIT -UTMP -LIBCRYPTSETUP -GCRYPT -GNUTLS -ACL +XZ -LZ4 -ZSTD -SECCOMP +BLKID -ELFUTILS +KMOD -IDN2 -IDN -PCRE2 default-hierarchy=hybrid) systemd[1]: Starting AppArmor initialization... apparmor[113]: Starting AppArmor profiles apparmor[128]: xargs: invalid option -- 'd' apparmor[128]: BusyBox v1.33.0 (2021-04-01 10:05:19 UTC) multi-call binary. apparmor[128]: Usage: xargs [OPTIONS] [PROG ARGS] apparmor[131]: /lib/apparmor/functions: line 76: echo: write error: Broken pipe apparmor[131]: /lib/apparmor/functions: line 76: echo: write error: Broken pipe ... apparmor[131]: /lib/apparmor/functions: line 76: echo: write error: Broken pipe apparmor[131]: /lib/apparmor/functions: line 76: echo: write error: Broken pipe apparmor[138]: xargs: invalid option -- 'd' apparmor[138]: BusyBox v1.33.0 (2021-04-01 10:05:19 UTC) multi-call binary. apparmor[138]: Usage: xargs [OPTIONS] [PROG ARGS] apparmor[142]: /lib/apparmor/functions: line 92: echo: write error: Broken pipe apparmor[142]: /lib/apparmor/functions: line 92: echo: write error: Broken pipe ... apparmor[142]: /lib/apparmor/functions: line 92: echo: write error: Broken pipe apparmor[142]: /lib/apparmor/functions: line 92: echo: write error: Broken pipe apparmor[113]: failed! systemd[1]: apparmor.service: Main process exited, code=exited, status=1/FAILURE systemd[1]: apparmor.service: Failed with result 'exit-code'. systemd[1]: Failed to start AppArmor initialization. dbus-broker-launch[152]: AppArmor enabled, but not supported. Ignoring. From the way I see it the problems start from this output: xargs: invalid option -- 'd' This error comes from a fact that `xargs` from the `busybox` doesn't have the `-d` option (https://git.busybox.net/busybox/tree/findutils/xargs.c) but this functionality is used in the file: https://git.yoctoproject.org/cgit/cgit.cgi/meta-security/tree/recipes-mac/AppArmor/files/functions Once I've discovered it, I started to wonder if I'm doing everything correctly. Is my issue a simple bug, or AppArmor is not supposed to be run in an environment like mine? Best regards, Konstantin Aladyshev
|
|
|
|
Re: [PATCH yocto-autobuilder-helper 1/4] config.json: add "collect-data" template
sakib.sajal@...
On 2021-04-15 9:52 a.m., Richard Purdie wrote:
[Please note: This e-mail is from an EXTERNAL e-mail address]The template is not used anywhere, yet, the initial patchset enables the data collection by default. I have left the template in case the data collection is removed from defaults and need to be used on a case by case basis. I am not entirely sure if nesting templates work. I have not seen any examples of it, neither did i try it myself. If nesting does work, the template should be useful. Sakib
|
|
|
|
Not all config fragments applied
Konstantin Kletschke
I added a custom layer and under recipes-kernel I try to apply kernel config fragments:
└[~]> cat poky/meta-insidem2m/recipes-kernel/linux/linux-yocto_5.10.bbappend FILESEXTRAPATHS_prepend := "${THISDIR}/${PN}:" SRC_URI += "\ file://wext.cfg \ file://at24.cfg \ file://leds.cfg \ file://usb.cfg \ file://keyspan.cfg \ file://00-leds.patch \ " poky/build/tmp/work/beaglebone_yocto-poky-linux-gnueabi/linux-yocto/5.10.12+gitAUTOINC+67e74d52f2_cdca787784-r0 └[~]> cat poky/meta-insidem2m/recipes-kernel/linux/linux-yocto/wext.cfg CONFIG_WIRELESS_EXT=y CONFIG_WEXT_CORE=y CONFIG_WEXT_PROC=y └[~]> diff -Nur a/.config b/.config --- a/.config 2021-04-26 15:16:24.425877434 +0200 +++ b/.config 2021-04-26 15:15:42.797926593 +0200 @@ -1222,7 +1222,9 @@ # CONFIG_AF_KCM is not set CONFIG_FIB_RULES=y CONFIG_WIRELESS=y -# CONFIG_WIRELESS_EXT is not set +CONFIG_WIRELESS_EXT=y +CONFIG_WEXT_CORE=y +CONFIG_WEXT_PROC=y # CONFIG_WEXT_SPY is not set # CONFIG_WEXT_PRIV is not set
CONFIG_CFG80211=y
|
|
|
|
Switching a recipe between git head and git tag (for a release)
Martin Hollingsworth
Hello community, I am looking for a best practice / a simple solution for switching the SRCREV in a bitbake recipe between git master HEAD (default, used in nightly builds) and a tagged release version (needed for a reproducible release config).
How can I minimize the amount of changes necessary to the recipe when switching to a release version?
Thanks and regards, Martin
|
|
|
|
Re: [meta-rockchip][PATCH v3 3/3] linux-yocto: add an initial NanoPi-M4 BSP
Yann Dirson
create mode 100644 recipes-kernel/linux/files/bsp/nanopi-m4-standard.sccAh, I forgot to put all of this in a bsp/rockchip/ dir, will reroll.
|
|
|
|
Re: [meta-rockchip][PATCH v3 0/7] OP-TEE support for ARM and rk3399
Yann Dirson
Le ven. 23 avr. 2021 à 19:19, Joshua Watt <jpewhacker@...> a écrit :
Generally speaking, I'd say yes, and it would be great if we are able to do that. But from what I've seen of op-tee integration, it looks like vendor platforms usually have different ways of integrating it. Eg. for tf-a, meta-ti does something completely custom, see https://git.yoctoproject.org/cgit/cgit.cgi/meta-ti/tree/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%25.bbappend I'd think it would make sense to integrate something in meta-arm, if more than one platform uses it, or possibly if this is the "right way do do things that everyone should use going forward". Also, the things that do belong in this layer need proper variable overrides to keep the layer (mostly) Yocto project compliant.After a quick review I can only see the optee patch in 3/7, do I miss anything else ? For this particular case, it did not seem crucial to restrict it, especially as the patch has been applied upstream. But sure it wouldn't hurt to make it rk3399-conditional.
-- Yann Dirson <yann@...> Blade / Shadow -- http://shadow.tech
|
|
|
|
[meta-zephyr][PATCH] qemuzephyrrunner.py: add tmpfsdir support
Jon Mason
OE-Core rev: fd1c26ab426c3699ffd8082b83d65a84c8eb8bff added an
additional parameter, tmpfsdir, to the API. This caused testimage to no longer work in meta-zephyr. Add that parameter and everything is happy now. Signed-off-by: Jon Mason <jon.mason@...> --- lib/oeqa/controllers/zephyrtargetcontrol.py | 6 +++--- lib/oeqa/utils/qemuzephyrrunner.py | 8 ++++++-- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/lib/oeqa/controllers/zephyrtargetcontrol.py b/lib/oeqa/controllers/zephyrtargetcontrol.py index 8e94cb53673d..1dd7fd22543f 100644 --- a/lib/oeqa/controllers/zephyrtargetcontrol.py +++ b/lib/oeqa/controllers/zephyrtargetcontrol.py @@ -14,8 +14,8 @@ class QemuTargetZephyr(OETarget): def __init__(self, logger, ip, server_ip, machine='', rootfs='', tmpdir ='',dir_image ='',display=None, kernel='',boottime=60,bootlog='',kvm=False,slirp=False, - dump_dir='',serial_ports=0,ovmf=None,target_modules_path='',powercontrol_cmd='',powercontrol_extra_args='', - serialcontrol_cmd=None,serialcontrol_extra_args='',testimage_dump_target='' ): + dump_dir='',serial_ports=0,ovmf=None,tmpfsdir='' ,target_modules_path='',powercontrol_cmd='',powercontrol_extra_args='', + serialcontrol_cmd=None,serialcontrol_extra_args='',testimage_dump_target=''): timeout = 300 user = 'root' @@ -48,7 +48,7 @@ class QemuTargetZephyr(OETarget): logfile=self.qemulog, boottime=boottime, use_kvm=kvm, dump_dir=dump_dir, dump_host_cmds=dump_host_cmds, - logger = logger) + logger = logger, tmpfsdir=tmpfsdir) def start(self, params=None, runqemuparams=None, extra_bootparams=None): diff --git a/lib/oeqa/utils/qemuzephyrrunner.py b/lib/oeqa/utils/qemuzephyrrunner.py index 0308f1e50e29..e8a1bd4544cf 100644 --- a/lib/oeqa/utils/qemuzephyrrunner.py +++ b/lib/oeqa/utils/qemuzephyrrunner.py @@ -18,11 +18,12 @@ from oeqa.utils.qemurunner import QemuRunner class QemuZephyrRunner(QemuRunner): - def __init__(self, machine, rootfs, display, tmpdir, deploy_dir_image, logfile, boottime, dump_dir, dump_host_cmds, use_kvm, logger): + def __init__(self, machine, rootfs, display, tmpdir, deploy_dir_image, logfile, boottime, dump_dir, dump_host_cmds, use_kvm, logger, tmpfsdir): + QemuRunner.__init__(self, machine, rootfs, display, tmpdir, deploy_dir_image, logfile, boottime, None, - None, use_kvm, logger) + None, use_kvm, logger, tmpfsdir) # Popen object for runqemu self.socketfile = tempfile.NamedTemporaryFile() @@ -32,6 +33,7 @@ class QemuZephyrRunner(QemuRunner): self.kernel = rootfs self.deploy_dir_image = deploy_dir_image + self.tmpfsdir = tmpfsdir self.logfile = logfile self.use_kvm = use_kvm @@ -73,6 +75,8 @@ class QemuZephyrRunner(QemuRunner): return False else: os.environ["DEPLOY_DIR_IMAGE"] = self.deploy_dir_image + if self.tmpfsdir: + env["RUNQEMU_TMPFS_DIR"] = self.tmpfsdir if not os.path.exists(self.kernel): bb.error("Invalid kernel path: %s" % self.kernel) -- 2.20.1
|
|
|
|
[meta-security][PATCH] ossec-hids: add new pkg
Signed-off-by: Armin Kuster <akuster808@...>
--- ...Makefile-drop-running-scrips-install.patch | 37 +++ .../0002-Makefile-don-t-set-uid-gid.patch | 251 ++++++++++++++++++ recipes-ids/ossec/ossec-hids_3.6.0.bb | 161 +++++++++++ 3 files changed, 449 insertions(+) create mode 100644 recipes-ids/ossec/files/0001-Makefile-drop-running-scrips-install.patch create mode 100644 recipes-ids/ossec/files/0002-Makefile-don-t-set-uid-gid.patch create mode 100644 recipes-ids/ossec/ossec-hids_3.6.0.bb diff --git a/recipes-ids/ossec/files/0001-Makefile-drop-running-scrips-install.patch b/recipes-ids/ossec/files/0001-Makefile-drop-running-scrips-install.patch new file mode 100644 index 0000000..08e018f --- /dev/null +++ b/recipes-ids/ossec/files/0001-Makefile-drop-running-scrips-install.patch @@ -0,0 +1,37 @@ +From b948d36a8ca8e04794381f0f6eba29daf7e3fd01 Mon Sep 17 00:00:00 2001 +From: Armin Kuster <akuster808@...> +Date: Wed, 21 Apr 2021 00:56:53 +0000 +Subject: [PATCH 1/2] Makefile: drop running scrips @ install + +Upstream-Status: Inappropriate [embedded specific] + +Signed-off-by: Armin Kuster <akuster808@...> +--- + src/Makefile | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/src/Makefile b/src/Makefile +index 06a7094c..dfb8cb58 100644 +--- a/src/Makefile ++++ b/src/Makefile +@@ -409,7 +409,6 @@ install-hybrid: install-server-generic + install-server: install-server-generic + + install-common: build +- ./init/adduser.sh ${OSSEC_USER} ${OSSEC_USER_MAIL} ${OSSEC_USER_REM} ${OSSEC_GROUP} ${PREFIX} + $(call INSTALL_CMD,0550,root,${OSSEC_GROUP}) -d ${PREFIX}/ + $(call INSTALL_CMD,0750,${OSSEC_USER},${OSSEC_GROUP}) -d ${PREFIX}/logs + $(call INSTALL_CMD,0660,${OSSEC_USER},${OSSEC_GROUP}) /dev/null ${PREFIX}/logs/ossec.log +@@ -485,9 +484,6 @@ endif + $(call INSTALL_CMD,0550,root,${OSSEC_GROUP}) -d ${PREFIX}/var + $(call INSTALL_CMD,0770,root,${OSSEC_GROUP}) -d ${PREFIX}/var/run + +- ./init/fw-check.sh execute +- +- + + install-server-generic: install-common + $(call INSTALL_CMD,0660,${OSSEC_USER},${OSSEC_GROUP}) /dev/null ${PREFIX}/logs/active-responses.log +-- +2.25.1 + diff --git a/recipes-ids/ossec/files/0002-Makefile-don-t-set-uid-gid.patch b/recipes-ids/ossec/files/0002-Makefile-don-t-set-uid-gid.patch new file mode 100644 index 0000000..d5e3403 --- /dev/null +++ b/recipes-ids/ossec/files/0002-Makefile-don-t-set-uid-gid.patch @@ -0,0 +1,251 @@ +From d9ec907881b72d42b4918f7cfb46516ce8e77772 Mon Sep 17 00:00:00 2001 +From: Armin Kuster <akuster808@...> +Date: Sat, 24 Apr 2021 23:07:29 +0000 +Subject: [PATCH 2/2] Makefile: don't set uid/gid + +Upstream-Status: Inappropriate [embedded specific] + +Signed-off-by: Armin Kuster <akuster808@...> +--- + src/Makefile | 166 +++++++++++++++++++++++++-------------------------- + 1 file changed, 83 insertions(+), 83 deletions(-) + +diff --git a/src/Makefile b/src/Makefile +index dfb8cb58..a4d69ef6 100644 +--- a/src/Makefile ++++ b/src/Makefile +@@ -21,7 +21,7 @@ OSSEC_USER?=ossec + OSSEC_USER_MAIL?=ossecm + OSSEC_USER_REM?=ossecr + +-INSTALL_CMD?=install -m $(1) -o $(2) -g $(3) ++INSTALL_CMD?=install -m $(1) + INSTALL_LOCALTIME?=yes + INSTALL_RESOLVCONF?=yes + +@@ -397,10 +397,10 @@ endif + install: install-${TARGET} + + install-agent: install-common +- $(call INSTALL_CMD,0550,root,0) ossec-agentd ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) agent-auth ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) ossec-agentd ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) agent-auth ${PREFIX}/bin + +- $(call INSTALL_CMD,0750,${OSSEC_USER},${OSSEC_GROUP}) -d ${PREFIX}/queue/rids ++ $(call INSTALL_CMD,0750) -d ${PREFIX}/queue/rids + + install-local: install-server-generic + +@@ -409,129 +409,129 @@ install-hybrid: install-server-generic + install-server: install-server-generic + + install-common: build +- $(call INSTALL_CMD,0550,root,${OSSEC_GROUP}) -d ${PREFIX}/ +- $(call INSTALL_CMD,0750,${OSSEC_USER},${OSSEC_GROUP}) -d ${PREFIX}/logs +- $(call INSTALL_CMD,0660,${OSSEC_USER},${OSSEC_GROUP}) /dev/null ${PREFIX}/logs/ossec.log +- +- $(call INSTALL_CMD,0550,root,0) -d ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) ossec-logcollector ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) ossec-syscheckd ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) ossec-execd ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) manage_agents ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) ../contrib/util.sh ${PREFIX}/bin/ +- $(call INSTALL_CMD,0550,root,0) ${OSSEC_CONTROL_SRC} ${PREFIX}/bin/ossec-control ++ $(call INSTALL_CMD,0550) -d ${PREFIX}/ ++ $(call INSTALL_CMD,0750) -d ${PREFIX}/logs ++ $(call INSTALL_CMD,0660) /dev/null ${PREFIX}/logs/ossec.log ++ ++ $(call INSTALL_CMD,0550) -d ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) ossec-logcollector ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) ossec-syscheckd ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) ossec-execd ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) manage_agents ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) ../contrib/util.sh ${PREFIX}/bin/ ++ $(call INSTALL_CMD,0550) ${OSSEC_CONTROL_SRC} ${PREFIX}/bin/ossec-control + + ifeq (${LUA_ENABLE},yes) +- $(call INSTALL_CMD,0550,root,0) -d ${PREFIX}/lua +- $(call INSTALL_CMD,0550,root,0) -d ${PREFIX}/lua/native +- $(call INSTALL_CMD,0550,root,0) -d ${PREFIX}/lua/compiled +- $(call INSTALL_CMD,0550,root,0) ${EXTERNAL_LUA}src/ossec-lua ${PREFIX}/bin/ +- $(call INSTALL_CMD,0550,root,0) ${EXTERNAL_LUA}src/ossec-luac ${PREFIX}/bin/ ++ $(call INSTALL_CMD,0550) -d ${PREFIX}/lua ++ $(call INSTALL_CMD,0550) -d ${PREFIX}/lua/native ++ $(call INSTALL_CMD,0550) -d ${PREFIX}/lua/compiled ++ $(call INSTALL_CMD,0550) ${EXTERNAL_LUA}src/ossec-lua ${PREFIX}/bin/ ++ $(call INSTALL_CMD,0550) ${EXTERNAL_LUA}src/ossec-luac ${PREFIX}/bin/ + endif + +- $(call INSTALL_CMD,0550,root,${OSSEC_GROUP}) -d ${PREFIX}/queue +- $(call INSTALL_CMD,0770,${OSSEC_USER},${OSSEC_GROUP}) -d ${PREFIX}/queue/alerts +- $(call INSTALL_CMD,0750,${OSSEC_USER},${OSSEC_GROUP}) -d ${PREFIX}/queue/ossec +- $(call INSTALL_CMD,0750,${OSSEC_USER},${OSSEC_GROUP}) -d ${PREFIX}/queue/syscheck +- $(call INSTALL_CMD,0750,${OSSEC_USER},${OSSEC_GROUP}) -d ${PREFIX}/queue/diff ++ $(call INSTALL_CMD,0550) -d ${PREFIX}/queue ++ $(call INSTALL_CMD,0770) -d ${PREFIX}/queue/alerts ++ $(call INSTALL_CMD,0750) -d ${PREFIX}/queue/ossec ++ $(call INSTALL_CMD,0750) -d ${PREFIX}/queue/syscheck ++ $(call INSTALL_CMD,0750) -d ${PREFIX}/queue/diff + +- $(call INSTALL_CMD,0550,root,${OSSEC_GROUP}) -d ${PREFIX}/etc ++ $(call INSTALL_CMD,0550) -d ${PREFIX}/etc + ifeq (${INSTALL_LOCALTIME},yes) +- $(call INSTALL_CMD,0440,root,${OSSEC_GROUP}) /etc/localtime ${PREFIX}/etc ++ $(call INSTALL_CMD,0440) /etc/localtime ${PREFIX}/etc + endif + ifeq (${INSTALL_RESOLVCONF},yes) +- $(call INSTALL_CMD,0440,root,${OSSEC_GROUP}) /etc/resolv.conf ${PREFIX}/etc ++ $(call INSTALL_CMD,0440) /etc/resolv.conf ${PREFIX}/etc + endif + +- $(call INSTALL_CMD,1550,root,${OSSEC_GROUP}) -d ${PREFIX}/tmp ++ $(call INSTALL_CMD,1550) -d ${PREFIX}/tmp + + ifneq (,$(wildcard /etc/TIMEZONE)) +- $(call INSTALL_CMD,440,root,${OSSEC_GROUP}) /etc/TIMEZONE ${PREFIX}/etc/ ++ $(call INSTALL_CMD,440) /etc/TIMEZONE ${PREFIX}/etc/ + endif + # Solaris Needs some extra files + ifeq (${uname_S},SunOS) +- $(call INSTALL_CMD,0550,root,${OSSEC_GROUP}) -d ${PREFIX}/usr/share/lib/zoneinfo/ ++ $(call INSTALL_CMD,0550) -d ${PREFIX}/usr/share/lib/zoneinfo/ + cp -r /usr/share/lib/zoneinfo/* ${PREFIX}/usr/share/lib/zoneinfo/ + endif +- $(call INSTALL_CMD,0640,root,${OSSEC_GROUP}) -b ../etc/internal_options.conf ${PREFIX}/etc/ ++ $(call INSTALL_CMD,0640) -b ../etc/internal_options.conf ${PREFIX}/etc/ + ifeq (,$(wildcard ${PREFIX}/etc/local_internal_options.conf)) +- $(call INSTALL_CMD,0640,root,${OSSEC_GROUP}) ../etc/local_internal_options.conf ${PREFIX}/etc/local_internal_options.conf ++ $(call INSTALL_CMD,0640) ../etc/local_internal_options.conf ${PREFIX}/etc/local_internal_options.conf + endif + ifeq (,$(wildcard ${PREFIX}/etc/client.keys)) +- $(call INSTALL_CMD,0640,root,${OSSEC_GROUP}) /dev/null ${PREFIX}/etc/client.keys ++ $(call INSTALL_CMD,0640) /dev/null ${PREFIX}/etc/client.keys + endif + ifeq (,$(wildcard ${PREFIX}/etc/ossec.conf)) + ifneq (,$(wildcard ../etc/ossec.mc)) +- $(call INSTALL_CMD,0640,root,${OSSEC_GROUP}) ../etc/ossec.mc ${PREFIX}/etc/ossec.conf ++ $(call INSTALL_CMD,0640) ../etc/ossec.mc ${PREFIX}/etc/ossec.conf + else +- $(call INSTALL_CMD,0640,root,${OSSEC_GROUP}) ${OSSEC_CONF_SRC} ${PREFIX}/etc/ossec.conf ++ $(call INSTALL_CMD,0640) ${OSSEC_CONF_SRC} ${PREFIX}/etc/ossec.conf + endif + endif + +- $(call INSTALL_CMD,0770,root,${OSSEC_GROUP}) -d ${PREFIX}/etc/shared +- $(call INSTALL_CMD,0640,${OSSEC_USER},${OSSEC_GROUP}) rootcheck/db/*.txt ${PREFIX}/etc/shared/ ++ $(call INSTALL_CMD,0770) -d ${PREFIX}/etc/shared ++ $(call INSTALL_CMD,0640) rootcheck/db/*.txt ${PREFIX}/etc/shared/ + +- $(call INSTALL_CMD,0550,root,${OSSEC_GROUP}) -d ${PREFIX}/active-response +- $(call INSTALL_CMD,0550,root,${OSSEC_GROUP}) -d ${PREFIX}/active-response/bin +- $(call INSTALL_CMD,0550,root,${OSSEC_GROUP}) -d ${PREFIX}/agentless +- $(call INSTALL_CMD,0550,root,${OSSEC_GROUP}) agentlessd/scripts/* ${PREFIX}/agentless/ ++ $(call INSTALL_CMD,0550) -d ${PREFIX}/active-response ++ $(call INSTALL_CMD,0550) -d ${PREFIX}/active-response/bin ++ $(call INSTALL_CMD,0550) -d ${PREFIX}/agentless ++ $(call INSTALL_CMD,0550) agentlessd/scripts/* ${PREFIX}/agentless/ + +- $(call INSTALL_CMD,0700,root,${OSSEC_GROUP}) -d ${PREFIX}/.ssh ++ $(call INSTALL_CMD,0700) -d ${PREFIX}/.ssh + +- $(call INSTALL_CMD,0550,root,${OSSEC_GROUP}) ../active-response/*.sh ${PREFIX}/active-response/bin/ +- $(call INSTALL_CMD,0550,root,${OSSEC_GROUP}) ../active-response/firewalls/*.sh ${PREFIX}/active-response/bin/ ++ $(call INSTALL_CMD,0550) ../active-response/*.sh ${PREFIX}/active-response/bin/ ++ $(call INSTALL_CMD,0550) ../active-response/firewalls/*.sh ${PREFIX}/active-response/bin/ + +- $(call INSTALL_CMD,0550,root,${OSSEC_GROUP}) -d ${PREFIX}/var +- $(call INSTALL_CMD,0770,root,${OSSEC_GROUP}) -d ${PREFIX}/var/run ++ $(call INSTALL_CMD,0550) -d ${PREFIX}/var ++ $(call INSTALL_CMD,0770) -d ${PREFIX}/var/run + + + install-server-generic: install-common +- $(call INSTALL_CMD,0660,${OSSEC_USER},${OSSEC_GROUP}) /dev/null ${PREFIX}/logs/active-responses.log +- $(call INSTALL_CMD,0750,${OSSEC_USER},${OSSEC_GROUP}) -d ${PREFIX}/logs/archives +- $(call INSTALL_CMD,0750,${OSSEC_USER},${OSSEC_GROUP}) -d ${PREFIX}/logs/alerts +- $(call INSTALL_CMD,0750,${OSSEC_USER},${OSSEC_GROUP}) -d ${PREFIX}/logs/firewall +- +- $(call INSTALL_CMD,0550,root,0) ossec-agentlessd ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) ossec-analysisd ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) ossec-monitord ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) ossec-reportd ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) ossec-maild ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) ossec-remoted ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) ossec-logtest ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) ossec-csyslogd ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) ossec-authd ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) ossec-dbd ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) ossec-makelists ${PREFIX}/bin +- $(call INSTALL_CMD,0550,root,0) verify-agent-conf ${PREFIX}/bin/ +- $(call INSTALL_CMD,0550,root,0) clear_stats ${PREFIX}/bin/ +- $(call INSTALL_CMD,0550,root,0) list_agents ${PREFIX}/bin/ +- $(call INSTALL_CMD,0550,root,0) ossec-regex ${PREFIX}/bin/ +- $(call INSTALL_CMD,0550,root,0) syscheck_update ${PREFIX}/bin/ +- $(call INSTALL_CMD,0550,root,0) agent_control ${PREFIX}/bin/ +- $(call INSTALL_CMD,0550,root,0) syscheck_control ${PREFIX}/bin/ +- $(call INSTALL_CMD,0550,root,0) rootcheck_control ${PREFIX}/bin/ +- +- $(call INSTALL_CMD,0750,${OSSEC_USER},${OSSEC_GROUP}) -d ${PREFIX}/stats +- $(call INSTALL_CMD,0550,root,${OSSEC_GROUP}) -d ${PREFIX}/rules ++ $(call INSTALL_CMD,0660) /dev/null ${PREFIX}/logs/active-responses.log ++ $(call INSTALL_CMD,0750) -d ${PREFIX}/logs/archives ++ $(call INSTALL_CMD,0750) -d ${PREFIX}/logs/alerts ++ $(call INSTALL_CMD,0750) -d ${PREFIX}/logs/firewall ++ ++ $(call INSTALL_CMD,0550) ossec-agentlessd ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) ossec-analysisd ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) ossec-monitord ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) ossec-reportd ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) ossec-maild ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) ossec-remoted ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) ossec-logtest ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) ossec-csyslogd ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) ossec-authd ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) ossec-dbd ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) ossec-makelists ${PREFIX}/bin ++ $(call INSTALL_CMD,0550) verify-agent-conf ${PREFIX}/bin/ ++ $(call INSTALL_CMD,0550) clear_stats ${PREFIX}/bin/ ++ $(call INSTALL_CMD,0550) list_agents ${PREFIX}/bin/ ++ $(call INSTALL_CMD,0550) ossec-regex ${PREFIX}/bin/ ++ $(call INSTALL_CMD,0550) syscheck_update ${PREFIX}/bin/ ++ $(call INSTALL_CMD,0550) agent_control ${PREFIX}/bin/ ++ $(call INSTALL_CMD,0550) syscheck_control ${PREFIX}/bin/ ++ $(call INSTALL_CMD,0550) rootcheck_control ${PREFIX}/bin/ ++ ++ $(call INSTALL_CMD,0750) -d ${PREFIX}/stats ++ $(call INSTALL_CMD,0550) -d ${PREFIX}/rules + ifneq (,$(wildcard ${PREFIX}/rules/local_rules.xml)) + cp ${PREFIX}/rules/local_rules.xml ${PREFIX}/rules/local_rules.xml.installbackup +- $(call INSTALL_CMD,0640,root,${OSSEC_GROUP}) -b ../etc/rules/*.xml ${PREFIX}/rules +- $(call INSTALL_CMD,0640,root,${OSSEC_GROUP}) ${PREFIX}/rules/local_rules.xml.installbackup ${PREFIX}/rules/local_rules.xml ++ $(call INSTALL_CMD,0640) -b ../etc/rules/*.xml ${PREFIX}/rules ++ $(call INSTALL_CMD,0640) ${PREFIX}/rules/local_rules.xml.installbackup ${PREFIX}/rules/local_rules.xml + rm ${PREFIX}/rules/local_rules.xml.installbackup + else +- $(call INSTALL_CMD,0640,root,${OSSEC_GROUP}) -b ../etc/rules/*.xml ${PREFIX}/rules ++ $(call INSTALL_CMD,0640) -b ../etc/rules/*.xml ${PREFIX}/rules + endif + +- $(call INSTALL_CMD,0750,${OSSEC_USER},${OSSEC_GROUP}) -d ${PREFIX}/queue/fts ++ $(call INSTALL_CMD,0750) -d ${PREFIX}/queue/fts + +- $(call INSTALL_CMD,0750,${OSSEC_USER},${OSSEC_GROUP}) -d ${PREFIX}/queue/rootcheck ++ $(call INSTALL_CMD,0750) -d ${PREFIX}/queue/rootcheck + +- $(call INSTALL_CMD,0750,${OSSEC_USER_REM},${OSSEC_GROUP}) -d ${PREFIX}/queue/agent-info +- $(call INSTALL_CMD,0750,${OSSEC_USER},${OSSEC_GROUP}) -d ${PREFIX}/queue/agentless ++ $(call INSTALL_CMD,0750) -d ${PREFIX}/queue/agent-info ++ $(call INSTALL_CMD,0750) -d ${PREFIX}/queue/agentless + +- $(call INSTALL_CMD,0750,${OSSEC_USER_REM},${OSSEC_GROUP}) -d ${PREFIX}/queue/rids ++ $(call INSTALL_CMD,0750) -d ${PREFIX}/queue/rids + +- $(call INSTALL_CMD,0640,root,${OSSEC_GROUP}) ../etc/decoder.xml ${PREFIX}/etc/ ++ $(call INSTALL_CMD,0640) ../etc/decoder.xml ${PREFIX}/etc/ + + rm -f ${PREFIX}/etc/shared/merged.mg + +-- +2.25.1 + diff --git a/recipes-ids/ossec/ossec-hids_3.6.0.bb b/recipes-ids/ossec/ossec-hids_3.6.0.bb new file mode 100644 index 0000000..10354a7 --- /dev/null +++ b/recipes-ids/ossec/ossec-hids_3.6.0.bb @@ -0,0 +1,161 @@ +SUMMARY = "A full platform to monitor and control your systems" +LICENSE = "GPL-2.0" +LIC_FILES_CHKSUM = "file://LICENSE;md5=d625d1520b5e38faefb81cf9772badc9" + + +DEPENDS = "openssl libpcre2 zlib libevent" +SRC_URI = "git://github.com/ossec/ossec-hids;branch=master \ + file://0001-Makefile-drop-running-scrips-install.patch \ + file://0002-Makefile-don-t-set-uid-gid.patch \ + " + +SRCREV = "1303c78e2c67d7acee0508cb00c3bc63baaa27c2" + +inherit autotools-brokensep useradd + +S = "${WORKDIR}/git" + +OSSEC_UID ?= "ossec" +OSSEC_RUID ?= "ossecr" +OSSEC_GID ?= "ossec" +OSSEC_EMAIL ?= "ossecm" + +do_configure[noexec] = "1" + +do_compile() { + cd ${S}/src + make PREFIX=${prefix} TARGET=local USE_SYSTEMD=No build +} + +do_install(){ + install -d ${D}${sysconfdir} + install -d ${D}/var/ossec/${sysconfdir} + + cd ${S}/src + make TARGET=local PREFIX=${D}/var/ossec install + + echo "DIRECTORY=\"/var/ossec\"" > ${D}/${sysconfdir}/ossec-init.conf + echo "VERSION=\"${PV}\"" >> ${D}/${sysconfdir}/ossec-init.conf + echo "DATE=\"`date`\"" >> ${D}/${sysconfdir}/ossec-init.conf + echo "TYPE=\"local\"" >> ${D}/${sysconfdir}/ossec-init.conf + chmod 600 ${D}/${sysconfdir}/ossec-init.conf + install -m 640 ${D}/${sysconfdir}/ossec-init.conf ${D}/var/ossec/${sysconfdir}/ossec-init.conf +} + +pkg_postinst_ontarget_${PN} () { + DIR="/var/ossec" + + usermod -g ossec -G ossec -a root + + # Default for all directories + chmod -R 550 ${DIR} + chown -R root:${OSSEC_GID} ${DIR} + + # To the ossec queue (default for agentd to read) + chown -R ${OSSEC_UUID}:${OSSEC_GID} ${DIR}/queue/ossec + chmod -R 770 ${DIR}/queue/ossec + + # For the logging user + chown -R ${OSSEC_UUID}:${OSSEC_GID} ${DIR}/logs + chmod -R 750 ${DIR}/logs + chmod -R 775 ${DIR}/queue/rids + touch ${DIR}/logs/ossec.log + chown ${OSSEC_UUID}:${OSSEC_GID} ${DIR}/logs/ossec.log + chmod 664 ${DIR}/logs/ossec.log + + chown -R ${OSSEC_UUID}:${OSSEC_GID} ${DIR}/queue/diff + chmod -R 750 ${DIR}/queue/diff + chmod 740 ${DIR}/queue/diff/* > /dev/null 2>&1 || true + + # For the etc dir + chmod 550 ${DIR}/etc + chown -R root:${OSSEC_GID} ${DIR}/etc + if [ -f /etc/localtime ]; then + cp -pL /etc/localtime ${DIR}/etc/; + chmod 555 ${DIR}/etc/localtime + chown root:${OSSEC_GID} ${DIR}/etc/localtime + fi + + if [ -f /etc/TIMEZONE ]; then + cp -p /etc/TIMEZONE ${DIR}/etc/; + chmod 555 ${DIR}/etc/TIMEZONE + fi + + # More files + chown root:${OSSEC_GID} ${DIR}/etc/internal_options.conf + chown root:${OSSEC_GID} ${DIR}/etc/local_internal_options.conf >/dev/null 2>&1 || true + chown root:${OSSEC_GID} ${DIR}/etc/client.keys >/dev/null 2>&1 || true + chown root:${OSSEC_GID} ${DIR}/agentless/* + chown ${OSSEC_UUID}:${OSSEC_GID} ${DIR}/.ssh + chown root:${OSSEC_GID} ${DIR}/etc/shared/* + + chmod 550 ${DIR}/etc + chmod 440 ${DIR}/etc/internal_options.conf + chmod 660 ${DIR}/etc/local_internal_options.conf >/dev/null 2>&1 || true + chmod 440 ${DIR}/etc/client.keys >/dev/null 2>&1 || true + chmod 550 ${DIR}/agentless/* + chmod 700 ${DIR}/.ssh + chmod 770 ${DIR}/etc/shared + chmod 660 ${DIR}/etc/shared/* + + # For the /var/run + chmod 770 ${DIR}/var/run + chown root:${OSSEC_GID} ${DIR}/var/run + + # For util.sh + chown root:${OSSEC_GID} ${DIR}/bin/util.sh + chmod +x ${DIR}/bin/util.sh + + # For binaries and active response + chmod 755 ${DIR}/active-response/bin/* + chown root:${OSSEC_GID} ${DIR}/active-response/bin/* + chown root:${OSSEC_GID} ${DIR}/bin/* + chmod 550 ${DIR}/bin/* + + # For ossec.conf + chown root:${OSSEC_GID} ${DIR}/etc/ossec.conf + chmod 660 ${DIR}/etc/ossec.conf + + # Debconf + . /usr/share/debconf/confmodule + db_input high ossec-hids-agent/server-ip || true + db_go + + db_get ossec-hids-agent/server-ip + SERVER_IP=$RET + + sed -i "s/<server-ip>[^<]\+<\/server-ip>/<server-ip>${SERVER_IP}<\/server-ip>/" ${DIR}/etc/ossec.conf + db_stop + + # ossec-init.conf + if [ -e ${DIR}/etc/ossec-init.conf ] && [ -d /etc/ ]; then + if [ -e /etc/ossec-init.conf ]; then + rm -f /etc/ossec-init.conf + fi + ln -s ${DIR}/etc/ossec-init.conf /etc/ossec-init.conf + fi + + # init.d/ossec file + if [ -x ${DIR}/etc/init.d/ossec ] && [ -d /etc/init.d/ ]; then + if [ -e /etc/init.d/ossec ]; then + rm -f /etc/init.d/ossec + fi + ln -s ${DIR}/etc/init.d/ossec /etc/init.d/ossec + fi + + # Service + if [ -x /etc/init.d/ossec ]; then + update-rc.d -f ossec defaults + fi + + # Delete tmp directory + if [ -d ${OSSEC_HIDS_TMP_DIR} ]; then + rm -r ${OSSEC_HIDS_TMP_DIR} + fi +} + +USERADD_PACKAGES = "${PN}" +USERADD_PARAM_${PN} = "--system --home-dir /var/ossec -g ossec --shell /bin/false ossec" +GROUPADD_PARAM_${PN} = "--system ossec" + +RDEPENDS_${PN} = "openssl bash" -- 2.25.1
|
|
|
|
Re: core-image-sato -staticdev issue
sateesh m
Hi Guys, I am facing one more issue No eligible RPROVIDERs exist for 'core-image-sato' Thanks & Regards, Sateesh
On Sun, Apr 25, 2021 at 10:00 PM sateesh m via lists.yoctoproject.org <sateesh0457=gmail.com@...> wrote: Hi Guys, --
Regards, Sateesh
|
|
|
|
core-image-sato -staticdev issue
sateesh m
Hi Guys,
I am newly facing this when I want to build core-image-sato image. how can I fix this issue can anybody know please suggest me. local.conf I enabled EXTRA_IMAGE_FEATURES += "staticdev-pkgs" but same issue I am facing. Loading cache: 100% |
Loaded 0 entries from dependency cache.
Parsing recipes: 100% |#######################################################################################################################################| Time: 0:00:17
Parsing of 3450 .bb files complete (0 cached, 3450 parsed). 5058 targets, 469 skipped, 0 masked, 0 errors.
NOTE: Resolving any missing task queue dependencies
ERROR: Nothing RPROVIDES '-staticdev' (sources/openembedded-core/meta/recipes-sato/images/core-image-sato.bb RDEPENDS on or otherwise requires it)
NOTE: Runtime target '-staticdev' is unbuildable, removing...
Missing or unbuildable dependency chain was: ['-staticdev']
ERROR: Required build target 'core-image-sato' has no buildable providers.
Missing or unbuildable dependency chain was: ['core-image-sato', '-staticdev']
Summary: There were 2 ERROR messages shown, returning a non-zero exit code.
Regards, Sateesh
|
|
|
|
Re: core-image-sato -staticdev
Dorinda
Hi Sateesh, It seems you're trying to install static development packages. if that's the case, then I think you should try adding "staticdev-pkgs" to the EXTRA_IMAGE_FEATURES variable in the local.conf Best Regards, Dorinda.
On Sun, Apr 25, 2021, 07:30 sateesh m <sateesh0457@...> wrote: Hi Guys,
|
|
|
|
core-image-sato -staticdev
sateesh m
Hi Guys,
I am newly facing this when I want to build core-image-sato image. how can I fix this issue can anybody know please suggest me. Loading cache: 100% |
Loaded 0 entries from dependency cache.
Parsing recipes: 100% |#######################################################################################################################################| Time: 0:00:17
Parsing of 3450 .bb files complete (0 cached, 3450 parsed). 5058 targets, 469 skipped, 0 masked, 0 errors.
NOTE: Resolving any missing task queue dependencies
ERROR: Nothing RPROVIDES '-staticdev' (sources/openembedded-core/meta/recipes-sato/images/core-image-sato.bb RDEPENDS on or otherwise requires it)
NOTE: Runtime target '-staticdev' is unbuildable, removing...
Missing or unbuildable dependency chain was: ['-staticdev']
ERROR: Required build target 'core-image-sato' has no buildable providers.
Missing or unbuildable dependency chain was: ['core-image-sato', '-staticdev']
Summary: There were 2 ERROR messages shown, returning a non-zero exit code.
-- Regards, Sateesh
|
|
|
|
OpenBIOS
jchludzinski
What is the relationship between OpenBIOS and YOCTO? Between OpenBIOS and U-boot?
|
|
|
|
[PATCH yocto-autobuilder-helper 4/4] config.json: add a target to test standalone X11 image
Alexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@...>
--- config.json | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/config.json b/config.json index 6de85a4..b38bc61 100644 --- a/config.json +++ b/config.json @@ -751,6 +751,11 @@ ] } }, + "only-x11" : { + "MACHINE" : "qemux86-64", + "BBTARGETS" : "core-image-sato core-image-sato:do_populate_sdk core-image-sato:do_populate_sdk_ext core-image-sato-sdk", + "SANITYTARGETS" : "core-image-sato:do_testimage core-image-sato:do_testsdk core-image-sato:do_testsdkext core-image-sato-sdk:do_testimage" + }, "musl-qemux86" : { "MACHINE" : "qemux86", "SDKMACHINE" : "x86_64", -- 2.30.2
|
|
|
|
[PATCH yocto-autobuilder-helper 3/4] config.json: pam is required when weston starts under systemd
Alexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@...>
--- config.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config.json b/config.json index 8e0f0ac..6de85a4 100644 --- a/config.json +++ b/config.json @@ -976,7 +976,7 @@ "BBTARGETS" : "core-image-weston", "SANITYTARGETS" : "core-image-weston:do_testimage", "extravars" : [ - "DISTRO_FEATURES_append = ' systemd'", + "DISTRO_FEATURES_append = ' pam systemd'", "VIRTUAL-RUNTIME_init_manager = 'systemd'", "TEST_SUITES_append = ' systemd'" ] @@ -996,7 +996,7 @@ "SANITYTARGETS" : "core-image-weston:do_testimage", "extravars" : [ "TEST_SUITES_append = ' systemd'", - "DISTRO_FEATURES_append = ' systemd'", + "DISTRO_FEATURES_append = ' pam systemd'", "VIRTUAL-RUNTIME_init_manager = 'systemd'", "DISTRO_FEATURES_BACKFILL_CONSIDERED = 'sysvinit'" ] -- 2.30.2
|
|
|