| Summary: | Add section on doing security checks in order to create a secure image | ||
|---|---|---|---|
| Product: | [Documentation] Development Manual | Reporter: | Saul Wold <sgw> |
| Component: | development | Assignee: | Jeff Osier-Mixon <jefro> |
| Status: | VERIFIED FIXED | QA Contact: | Alexandru Georgescu <alexandru.c.georgescu> |
| Severity: | enhancement | ||
| Priority: | Medium+ | CC: | alexandru.c.georgescu, bluelightning, bogdanx.a.voiculescu, jefro, maxin.baby.john, sgw, srifenbark |
| Version: | 1.6 | ||
| Target Milestone: | 1.7 M4 | ||
| Hardware: | x86 | ||
| OS: | Multiple | ||
| Whiteboard: | 22 September 2014: IN PROGRESS REVIEW | ||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | Done (doc changes complete) | |
|
Description
Saul Wold
2013-11-05 19:35:49 UTC
Hi, What are the practices? Who understands how to do this? Scott Changing to NEEDINFO. Updated the instructions to set password to the root user: https://wiki.yoctoproject.org/wiki/FAQ:How_do_I_set_or_change_the_root_password Enhancement - moving to 1.7. I sent out a specific email to Saul and also included Paul asking some targeted questions around this issue. Scott Hi, I have enhanced the "Making Images More Secure" section in the dev-manual (http://www.yoctoproject.org/docs/1.7/dev-manua/dev-manual.html#making-images-more-secure) to incorporate some information that Paul Eggleton sent me to help address this issue. The result is some sub-sections that describe various things the use can do or consider to make their image more secure. We still need some further information in a couple areas though. In particular, we need to decide how extensively to document the meta/conf/distro/include/security_flags.inc file and those flags. I left what we had in there regarding some general information about flags. Another area is the small section pointing to some tools we now provide in the meta-security layer in the YP repositories. I don't understand what the tools are. We probably need to describe this stuff better. This is a start. If you have feedback on the changes I put in you can comment and we can move forward. I am still leaving this bug in NEED INFO for now. I don't think it is quite ready for IN PROGRESS REVIEW. Thanks, Scott Hi, I have updated this section to the point where I think it can go to a general review. I have worked with Paul Eggleton to get to this point so he has provided extensive review of the material. I am marking the status now to IN PROGRESS REVIEW. I will leave it open as that for a while for further comments. See http://www.yoctoproject.org/docs/1.7/dev-manual/dev-manual.html#making-images-more-secure Regarding the documentation of the many flags. I think we can move this to a separate documentation bug after these general improvements to the section are approved. Thanks, Scott Setting to M3 for 1.7. Still under review. I will let it ride longer and then if no comments come I am closing it. Scott assigned to jefro That section looks good as a high-level overview with sufficient warnings that this is a brief summary and nothing more. :) When it mentions "using SMACK or SELinux" it would be helpful to link to meta-selinux at http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/ Ross, Thanks for the review feedback. I have updated that area to include a reference to the meta-selinux layer. You can see the change at http://www.yoctoproject.org/docs/1.7/dev-manual/dev-manual.html#making-images-more-secure. I will keep it in IN PROGRESS REVIEW and if I don't hear of anything more after a while I will close the bug. Scott I'm not sure why I am the owner of this, but it looks to me like it can be closed. I will mark it closed then. Scott Scott, is there something QA needs to verify on this? Thanks! Alex, Nope... I think it can be closed. The fix is in the daisy, dizzy, and master branches. Scott verified as per above comments |