Bug 3867

*** Bug 4208 has been marked as a duplicate of this bug. ***

I'm adding the comments I made on 4208, so it's clear that the work is more than adding a recipe.

We should adopt a tool like Bastille Linux as part of the build system (perhaps an optional part).

Bastille can be run against a running Linux system to identify common backdoors and security holes.

A recipe probably needs to be developed plus a method for running it as part of the sanity test. Then there should be an easy way for developers using Yocto to run Bastille as a QA pass on their device.

This enhancement should be marked HIGH (P1) for the 1.5 release

Bastille can be found in :

http://git.yoctoproject.org/cgit/cgit.cgi/meta-security

under /recipes-security/bastille

At the moment Bastille does not work. When trying to use the file permissions modifying module, /var/log/Bastille/error-log reports:

{Wed Jul 31 15:21:08 2013} ERROR Didn't carry out general permissions
         modifications as they are very specific to Red Hat / Mandrake

This needs more work:
- Distribution checker must be disabled
- Poky Irrelevant questions must be removed from the form (bastille -c). We should make it contain only changes relevant to poky's features. This can be done through a patch and scaled to contain new features by adding a patch for Bastille in the layers that add that feature.

Reopening.

"Distribution checker must be disabled" refers to the error described in the second above comment:

{Wed Jul 31 15:21:08 2013} ERROR Didn't carry out general permissions
         modifications as they are very specific to Red Hat / Mandrake

Some of these problems and also #4660 problems addressed in:
http://git.yoctoproject.org/cgit/cgit.cgi/poky-contrib/log/?h=mulhern/bastille-final.

Comment 5
The config file is used as a reference indicating what are the relevant poky questions. Now, editing the config file before a build will automatically update Bastille's questions files so that the questions it believes are required will
exactly match those in the config file.

At the moment Bastille itself, i.e., the code that is downloaded, continues to be
comprehensively broken. The comment (4) problem is probably just one of very many.

CCB has approved decision not to fix because of low quality of Bastille source.

http://git.yoctoproject.org/cgit/cgit.cgi/meta-security/commit/?id=5ec81ec5b117de41ed56eb05df271f103213d7be

The changes have been committed and are at the URL above.

Cannot install bastille using:
poky master:bd76847d867f9f76f76f033439cfb834cf59380f
meta-security master:23815f300174ce6cab48356e3fffba9868b626d4

Error as follows:
DEBUG: Executing shell function do_install
Fatal error reading config file: [Errno 13] Permission denied: '/home/cornel/work/poky/build/tmp/work/qemux86_64-poky-linux/bastille/3.2.1-r0/Bastille/Questions/AccountSecurity.txt'
WARNING: /home/cornel/work/poky/build/tmp/work/qemux86_64-poky-linux/bastille/3.2.1-r0/temp/run.do_install.12528:1 exit 1 from
  /home/cornel/work/poky/meta-security/recipes-security/bastille/files/set_required_questions.py /home/cornel/work/poky/build/tmp/work/qemux86_64-poky-linux/bastille/3.2.1-r0/config Questions
ERROR: Function failed: do_install (log file is located at /home/cornel/work/poky/build/tmp/work/qemux86_64-poky-linux/bastille/3.2.1-r0/temp/log.do_install.12528)

Even though this is marked as WONTFIX, should I reopen or open a new bug?

It should install, so if it is not installing it is a bug and should be taken care of.

The error [Errno 13] is pretty specific. The program found the Account Security.txt file, but could not open it for reading. I can't reproduce the problem, because the necessary r bit is set for that file on my machine.

So, either it's a transient problem, or something exciting and new is happening to permission bits in the work directory, or you're using a variant of Python that takes a different view of file permissions.

If you can reproduce please make sure to find out as much as you can about the actual permission bits of the file and of the version of Python you're using.
Hopefully, it will turn out to be a transient problem, though.

Bug 5177 opened for install issue. Because of this bug, I was not able to Verify this in 1.5 M4.

Install issues cleared. The bastille package has seen some improvements. Setting this to VERIFIED as per comments in bug 4660.