5482 2013-11-05 19:35:49 +0000 Add section on doing security checks in order to create a secure image 2015-03-30 07:02:56 +0000 1 1 9 Documentation Development Manual development 1.6 x86 Multiple VERIFIED FIXED 22 September 2014: IN PROGRESS REVIEW Medium+ enhancement 1.7 M4 1 sgw jefro alexandru.c.georgescu bluelightning bogdanx.a.voiculescu jefro maxin.baby.john sgw srifenbark alexandru.c.georgescu --- --- Done (doc changes complete) oldest_to_newest 38570 0 sgw 2013-11-05 19:35:49 +0000 We need to document some best practices for securing the image, along with examples. Items include setting the root password, running some set of meta-security programs. 38587 1 srifenbark 2013-11-06 14:24:10 +0000 Hi, What are the practices? Who understands how to do this? Scott 39678 2 srifenbark 2014-01-07 13:52:22 +0000 Changing to NEEDINFO. 40833 3 maxin.baby.john 2014-03-03 12:22:29 +0000 Updated the instructions to set password to the root user: https://wiki.yoctoproject.org/wiki/FAQ:How_do_I_set_or_change_the_root_password 42076 4 srifenbark 2014-04-01 22:41:37 +0000 Enhancement - moving to 1.7. 43611 5 srifenbark 2014-05-28 09:05:28 +0000 I sent out a specific email to Saul and also included Paul asking some targeted questions around this issue. Scott 43617 6 srifenbark 2014-05-28 12:18:56 +0000 Hi, I have enhanced the "Making Images More Secure" section in the dev-manual (http://www.yoctoproject.org/docs/1.7/dev-manua/dev-manual.html#making-images-more-secure) to incorporate some information that Paul Eggleton sent me to help address this issue. The result is some sub-sections that describe various things the use can do or consider to make their image more secure. We still need some further information in a couple areas though. In particular, we need to decide how extensively to document the meta/conf/distro/include/security_flags.inc file and those flags. I left what we had in there regarding some general information about flags. Another area is the small section pointing to some tools we now provide in the meta-security layer in the YP repositories. I don't understand what the tools are. We probably need to describe this stuff better. This is a start. If you have feedback on the changes I put in you can comment and we can move forward. I am still leaving this bug in NEED INFO for now. I don't think it is quite ready for IN PROGRESS REVIEW. Thanks, Scott 43700 7 srifenbark 2014-06-02 07:45:00 +0000 Hi, I have updated this section to the point where I think it can go to a general review. I have worked with Paul Eggleton to get to this point so he has provided extensive review of the material. I am marking the status now to IN PROGRESS REVIEW. I will leave it open as that for a while for further comments. See http://www.yoctoproject.org/docs/1.7/dev-manual/dev-manual.html#making-images-more-secure Regarding the documentation of the many flags. I think we can move this to a separate documentation bug after these general improvements to the section are approved. Thanks, Scott 44083 8 srifenbark 2014-06-19 04:53:01 +0000 Setting to M3 for 1.7. Still under review. I will let it ride longer and then if no comments come I am closing it. Scott 44162 9 jefro 2014-06-24 17:19:13 +0000 assigned to jefro 45689 10 ross.burton 2014-09-18 15:38:54 +0000 That section looks good as a high-level overview with sufficient warnings that this is a brief summary and nothing more. :) When it mentions "using SMACK or SELinux" it would be helpful to link to meta-selinux at http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/ 45742 11 srifenbark 2014-09-22 13:42:36 +0000 Ross, Thanks for the review feedback. I have updated that area to include a reference to the meta-selinux layer. You can see the change at http://www.yoctoproject.org/docs/1.7/dev-manual/dev-manual.html#making-images-more-secure. I will keep it in IN PROGRESS REVIEW and if I don't hear of anything more after a while I will close the bug. Scott 46605 12 jefro 2014-10-27 20:08:58 +0000 I'm not sure why I am the owner of this, but it looks to me like it can be closed. 46607 13 srifenbark 2014-10-27 20:31:14 +0000 I will mark it closed then. Scott 47099 14 alexandru.c.georgescu 2014-11-20 10:42:32 +0000 Scott, is there something QA needs to verify on this? Thanks! 47107 15 srifenbark 2014-11-20 13:58:49 +0000 Alex, Nope... I think it can be closed. The fix is in the daisy, dizzy, and master branches. Scott 47555 16 alexandru.c.georgescu 2014-12-15 11:38:27 +0000 verified as per above comments