3867 2013-02-07 21:46:26 +0000 Add Bastille Linux Support to Yocto 2013-10-01 14:21:02 +0000 1 1 7 Build System, Metadata & Runtime Meta-yocto meta-yocto 1.5 x86 Multiple VERIFIED WORKSFORME High enhancement 1.5 M4 4660 1 scott.a.garman mulhern corneliux.stoicescu david.c.stewart jessica.zhang mulhern poky.bs.watcher poky.watcher sgw sh88ting.star song.liu --- --- No (bug/feature does not impact docs) oldest_to_newest 29653 0 scott.a.garman 2013-02-07 21:46:26 +0000 This is a feature request to add Bastille Linux support to Yocto. Bastille includes a set of (perl) scripts to analyze and report recomended best security practices. This is a matter of adding a recipe for Bastille to Yocto - assuming it may not make it into oe-core, I've filed this bug against meta-yocto. 31690 1 sgw 2013-04-08 14:31:04 +0000 *** Bug 4208 has been marked as a duplicate of this bug. *** 31692 2 david.c.stewart 2013-04-08 14:43:08 +0000 I'm adding the comments I made on 4208, so it's clear that the work is more than adding a recipe. We should adopt a tool like Bastille Linux as part of the build system (perhaps an optional part). Bastille can be run against a running Linux system to identify common backdoors and security holes. A recipe probably needs to be developed plus a method for running it as part of the sanity test. Then there should be an easy way for developers using Yocto to run Bastille as a QA pass on their device. This enhancement should be marked HIGH (P1) for the 1.5 release 34903 3 andrei.adrianx.dinu 2013-07-25 14:47:51 +0000 Bastille can be found in : http://git.yoctoproject.org/cgit/cgit.cgi/meta-security under /recipes-security/bastille 35226 4 corneliux.stoicescu 2013-07-31 14:19:20 +0000 At the moment Bastille does not work. When trying to use the file permissions modifying module, /var/log/Bastille/error-log reports: {Wed Jul 31 15:21:08 2013} ERROR Didn't carry out general permissions modifications as they are very specific to Red Hat / Mandrake 35409 5 corneliux.stoicescu 2013-08-06 10:03:59 +0000 This needs more work: - Distribution checker must be disabled - Poky Irrelevant questions must be removed from the form (bastille -c). We should make it contain only changes relevant to poky's features. This can be done through a patch and scaled to contain new features by adding a patch for Bastille in the layers that add that feature. Reopening. 35767 6 corneliux.stoicescu 2013-08-20 14:58:25 +0000 "Distribution checker must be disabled" refers to the error described in the second above comment: {Wed Jul 31 15:21:08 2013} ERROR Didn't carry out general permissions modifications as they are very specific to Red Hat / Mandrake 35917 7 mulhern 2013-08-26 14:09:06 +0000 Some of these problems and also #4660 problems addressed in: http://git.yoctoproject.org/cgit/cgit.cgi/poky-contrib/log/?h=mulhern/bastille-final. Comment 5 The config file is used as a reference indicating what are the relevant poky questions. Now, editing the config file before a build will automatically update Bastille's questions files so that the questions it believes are required will exactly match those in the config file. At the moment Bastille itself, i.e., the code that is downloaded, continues to be comprehensively broken. The comment (4) problem is probably just one of very many. 36117 8 mulhern 2013-08-30 20:18:07 +0000 CCB has approved decision not to fix because of low quality of Bastille source. 36119 9 mulhern 2013-08-30 21:23:47 +0000 http://git.yoctoproject.org/cgit/cgit.cgi/meta-security/commit/?id=5ec81ec5b117de41ed56eb05df271f103213d7be The changes have been committed and are at the URL above. 36601 10 corneliux.stoicescu 2013-09-12 12:03:27 +0000 Cannot install bastille using: poky master:bd76847d867f9f76f76f033439cfb834cf59380f meta-security master:23815f300174ce6cab48356e3fffba9868b626d4 Error as follows: DEBUG: Executing shell function do_install Fatal error reading config file: [Errno 13] Permission denied: '/home/cornel/work/poky/build/tmp/work/qemux86_64-poky-linux/bastille/3.2.1-r0/Bastille/Questions/AccountSecurity.txt' WARNING: /home/cornel/work/poky/build/tmp/work/qemux86_64-poky-linux/bastille/3.2.1-r0/temp/run.do_install.12528:1 exit 1 from /home/cornel/work/poky/meta-security/recipes-security/bastille/files/set_required_questions.py /home/cornel/work/poky/build/tmp/work/qemux86_64-poky-linux/bastille/3.2.1-r0/config Questions ERROR: Function failed: do_install (log file is located at /home/cornel/work/poky/build/tmp/work/qemux86_64-poky-linux/bastille/3.2.1-r0/temp/log.do_install.12528) Even though this is marked as WONTFIX, should I reopen or open a new bug? 36638 11 mulhern 2013-09-13 00:05:55 +0000 It should install, so if it is not installing it is a bug and should be taken care of. The error [Errno 13] is pretty specific. The program found the Account Security.txt file, but could not open it for reading. I can't reproduce the problem, because the necessary r bit is set for that file on my machine. So, either it's a transient problem, or something exciting and new is happening to permission bits in the work directory, or you're using a variant of Python that takes a different view of file permissions. If you can reproduce please make sure to find out as much as you can about the actual permission bits of the file and of the version of Python you're using. Hopefully, it will turn out to be a transient problem, though. 36652 12 corneliux.stoicescu 2013-09-13 07:54:26 +0000 Bug 5177 opened for install issue. Because of this bug, I was not able to Verify this in 1.5 M4. 37417 13 corneliux.stoicescu 2013-10-01 14:21:02 +0000 Install issues cleared. The bastille package has seen some improvements. Setting this to VERIFIED as per comments in bug 4660.