* [debsecan] export dpkg status for debsecan
@ 2020-10-01 5:06 Daniel Sangorrin
2020-10-01 5:06 ` [debsecan] meta/classes: export dpkg status file " Daniel Sangorrin
0 siblings, 1 reply; 5+ messages in thread
From: Daniel Sangorrin @ 2020-10-01 5:06 UTC (permalink / raw)
To: jan.kiszka; +Cc: isar-users
Hello,
This patch causes rootfs builds to export the /var/lib/dpkg/status
file, which is required for debsecan to scan vulnerabilities. It is
very similar to what generate-manifest does already, it is just
that debsecan needs this file format.
I have tested it by building [isar-cip-core](https://gitlab.com/cip-project/cip-core/isar-cip-core)
QEMU images and it works fine, however I couldn't (didn't know how to) test SDK creation because
we are not using that feature yet.
[debsecan] meta/classes: export dpkg status file for debsecan
Thanks,
Daniel
^ permalink raw reply [flat|nested] 5+ messages in thread
* [debsecan] meta/classes: export dpkg status file for debsecan
2020-10-01 5:06 [debsecan] export dpkg status for debsecan Daniel Sangorrin
@ 2020-10-01 5:06 ` Daniel Sangorrin
2020-10-05 6:06 ` Jan Kiszka
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Daniel Sangorrin @ 2020-10-01 5:06 UTC (permalink / raw)
To: jan.kiszka; +Cc: isar-users
Although the currently exported manifest has enough
information for scanning vulnerabilities, the tool
debsecan depends on the /var/lib/dpkg/status file
format. This patch adds a feature to export such file.
All rootfs'es export the file by default and with
the same file name syntax as the manifests, except
for the file extension which is ".dpkg_status"
instead of ".manifest".
Remove the feature with:
ROOTFS_FEATURES_remove = "export-dpkg-status"
Signed-off-by: Daniel Sangorrin <daniel.sangorrin@toshiba.co.jp>
---
meta/classes/image.bbclass | 3 ++-
meta/classes/rootfs.bbclass | 8 ++++++++
meta/recipes-devtools/buildchroot/buildchroot.inc | 3 ++-
meta/recipes-devtools/sdkchroot/sdkchroot.bb | 3 ++-
4 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/meta/classes/image.bbclass b/meta/classes/image.bbclass
index a296cc0..8e350a3 100644
--- a/meta/classes/image.bbclass
+++ b/meta/classes/image.bbclass
@@ -63,9 +63,10 @@ image_do_mounts() {
}
ROOTFSDIR = "${IMAGE_ROOTFS}"
-ROOTFS_FEATURES += "clean-package-cache finalize-rootfs generate-manifest"
+ROOTFS_FEATURES += "clean-package-cache finalize-rootfs generate-manifest export-dpkg-status"
ROOTFS_PACKAGES += "${IMAGE_PREINSTALL} ${IMAGE_INSTALL}"
ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
+ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
inherit rootfs
inherit image-sdk-extension
diff --git a/meta/classes/rootfs.bbclass b/meta/classes/rootfs.bbclass
index afec1cb..bd73ee6 100644
--- a/meta/classes/rootfs.bbclass
+++ b/meta/classes/rootfs.bbclass
@@ -11,6 +11,7 @@ ROOTFS_PACKAGES ?= ""
# available features are:
# 'clean-package-cache' - delete package cache from rootfs
# 'generate-manifest' - generate a package manifest of the rootfs into ${ROOTFS_MANIFEST_DEPLOY_DIR}
+# 'export-dpkg-status' - exports /var/lib/dpkg/status file to ${ROOTFS_DPKGSTATUS_DEPLOY_DIR}
# 'finalize-rootfs' - delete files needed to chroot into the rootfs
ROOTFS_FEATURES ?= ""
@@ -201,6 +202,13 @@ rootfs_generate_manifest () {
${ROOTFS_MANIFEST_DEPLOY_DIR}/"${PF}".manifest
}
+ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'export-dpkg-status', 'rootfs_export_dpkg_status', '', d)}"
+rootfs_export_dpkg_status() {
+ mkdir -p ${ROOTFS_DPKGSTATUS_DEPLOY_DIR}
+ cp '${ROOTFSDIR}'/var/lib/dpkg/status \
+ '${ROOTFS_DPKGSTATUS_DEPLOY_DIR}'/'${PF}'.dpkg_status
+}
+
ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'finalize-rootfs', 'rootfs_postprocess_finalize', '', d)}"
rootfs_postprocess_finalize() {
sudo -s <<'EOSUDO'
diff --git a/meta/recipes-devtools/buildchroot/buildchroot.inc b/meta/recipes-devtools/buildchroot/buildchroot.inc
index b4d7b76..e9c2cfe 100644
--- a/meta/recipes-devtools/buildchroot/buildchroot.inc
+++ b/meta/recipes-devtools/buildchroot/buildchroot.inc
@@ -20,7 +20,8 @@ ROOTFSDIR = "${BUILDCHROOT_DIR}"
ROOTFS_PACKAGES = "${BUILDCHROOT_PREINSTALL}"
ROOTFS_CLEAN_FILES = ""
ROOTFS_MANIFEST_DEPLOY_DIR = "${DEPLOY_DIR_BUILDCHROOT}"
-ROOTFS_FEATURES += "generate-manifest"
+ROOTFS_DPKGSTATUS_DEPLOY_DIR = "${DEPLOY_DIR_BUILDCHROOT}"
+ROOTFS_FEATURES += "generate-manifest export-dpkg-status"
BUILDCHROOT_PREINSTALL_COMMON = " \
make \
diff --git a/meta/recipes-devtools/sdkchroot/sdkchroot.bb b/meta/recipes-devtools/sdkchroot/sdkchroot.bb
index 467e682..796fefa 100644
--- a/meta/recipes-devtools/sdkchroot/sdkchroot.bb
+++ b/meta/recipes-devtools/sdkchroot/sdkchroot.bb
@@ -22,8 +22,9 @@ ROOTFS_ARCH = "${HOST_ARCH}"
ROOTFS_DISTRO = "${HOST_DISTRO}"
ROOTFSDIR = "${S}"
ROOTFS_PACKAGES = "${SDKCHROOT_PREINSTALL} ${TOOLCHAIN}"
-ROOTFS_FEATURES += "clean-package-cache generate-manifest"
+ROOTFS_FEATURES += "clean-package-cache generate-manifest export-dpkg-status"
ROOTFS_MANIFEST_DEPLOY_DIR = "${DEPLOY_DIR_SDKCHROOT}"
+ROOTFS_DPKGSTATUS_DEPLOY_DIR = "${DEPLOY_DIR_SDKCHROOT}"
python() {
if d.getVar("HOST_ARCH") not in ['i386', 'amd64']:
--
2.25.1
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [debsecan] meta/classes: export dpkg status file for debsecan
2020-10-01 5:06 ` [debsecan] meta/classes: export dpkg status file " Daniel Sangorrin
@ 2020-10-05 6:06 ` Jan Kiszka
2020-10-05 15:21 ` Baurzhan Ismagulov
2020-11-26 17:18 ` Anton Mikanovich
2 siblings, 0 replies; 5+ messages in thread
From: Jan Kiszka @ 2020-10-05 6:06 UTC (permalink / raw)
To: Daniel Sangorrin; +Cc: isar-users
On 01.10.20 07:06, Daniel Sangorrin wrote:
> Although the currently exported manifest has enough
> information for scanning vulnerabilities, the tool
> debsecan depends on the /var/lib/dpkg/status file
> format. This patch adds a feature to export such file.
>
> All rootfs'es export the file by default and with
> the same file name syntax as the manifests, except
> for the file extension which is ".dpkg_status"
> instead of ".manifest".
>
> Remove the feature with:
> ROOTFS_FEATURES_remove = "export-dpkg-status"
>
> Signed-off-by: Daniel Sangorrin <daniel.sangorrin@toshiba.co.jp>
> ---
> meta/classes/image.bbclass | 3 ++-
> meta/classes/rootfs.bbclass | 8 ++++++++
> meta/recipes-devtools/buildchroot/buildchroot.inc | 3 ++-
> meta/recipes-devtools/sdkchroot/sdkchroot.bb | 3 ++-
> 4 files changed, 14 insertions(+), 3 deletions(-)
>
> diff --git a/meta/classes/image.bbclass b/meta/classes/image.bbclass
> index a296cc0..8e350a3 100644
> --- a/meta/classes/image.bbclass
> +++ b/meta/classes/image.bbclass
> @@ -63,9 +63,10 @@ image_do_mounts() {
> }
>
> ROOTFSDIR = "${IMAGE_ROOTFS}"
> -ROOTFS_FEATURES += "clean-package-cache finalize-rootfs generate-manifest"
> +ROOTFS_FEATURES += "clean-package-cache finalize-rootfs generate-manifest export-dpkg-status"
> ROOTFS_PACKAGES += "${IMAGE_PREINSTALL} ${IMAGE_INSTALL}"
> ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
> +ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
>
> inherit rootfs
> inherit image-sdk-extension
> diff --git a/meta/classes/rootfs.bbclass b/meta/classes/rootfs.bbclass
> index afec1cb..bd73ee6 100644
> --- a/meta/classes/rootfs.bbclass
> +++ b/meta/classes/rootfs.bbclass
> @@ -11,6 +11,7 @@ ROOTFS_PACKAGES ?= ""
> # available features are:
> # 'clean-package-cache' - delete package cache from rootfs
> # 'generate-manifest' - generate a package manifest of the rootfs into ${ROOTFS_MANIFEST_DEPLOY_DIR}
> +# 'export-dpkg-status' - exports /var/lib/dpkg/status file to ${ROOTFS_DPKGSTATUS_DEPLOY_DIR}
> # 'finalize-rootfs' - delete files needed to chroot into the rootfs
> ROOTFS_FEATURES ?= ""
>
> @@ -201,6 +202,13 @@ rootfs_generate_manifest () {
> ${ROOTFS_MANIFEST_DEPLOY_DIR}/"${PF}".manifest
> }
>
> +ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'export-dpkg-status', 'rootfs_export_dpkg_status', '', d)}"
> +rootfs_export_dpkg_status() {
> + mkdir -p ${ROOTFS_DPKGSTATUS_DEPLOY_DIR}
> + cp '${ROOTFSDIR}'/var/lib/dpkg/status \
> + '${ROOTFS_DPKGSTATUS_DEPLOY_DIR}'/'${PF}'.dpkg_status
> +}
> +
> ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'finalize-rootfs', 'rootfs_postprocess_finalize', '', d)}"
> rootfs_postprocess_finalize() {
> sudo -s <<'EOSUDO'
> diff --git a/meta/recipes-devtools/buildchroot/buildchroot.inc b/meta/recipes-devtools/buildchroot/buildchroot.inc
> index b4d7b76..e9c2cfe 100644
> --- a/meta/recipes-devtools/buildchroot/buildchroot.inc
> +++ b/meta/recipes-devtools/buildchroot/buildchroot.inc
> @@ -20,7 +20,8 @@ ROOTFSDIR = "${BUILDCHROOT_DIR}"
> ROOTFS_PACKAGES = "${BUILDCHROOT_PREINSTALL}"
> ROOTFS_CLEAN_FILES = ""
> ROOTFS_MANIFEST_DEPLOY_DIR = "${DEPLOY_DIR_BUILDCHROOT}"
> -ROOTFS_FEATURES += "generate-manifest"
> +ROOTFS_DPKGSTATUS_DEPLOY_DIR = "${DEPLOY_DIR_BUILDCHROOT}"
> +ROOTFS_FEATURES += "generate-manifest export-dpkg-status"
>
> BUILDCHROOT_PREINSTALL_COMMON = " \
> make \
> diff --git a/meta/recipes-devtools/sdkchroot/sdkchroot.bb b/meta/recipes-devtools/sdkchroot/sdkchroot.bb
> index 467e682..796fefa 100644
> --- a/meta/recipes-devtools/sdkchroot/sdkchroot.bb
> +++ b/meta/recipes-devtools/sdkchroot/sdkchroot.bb
> @@ -22,8 +22,9 @@ ROOTFS_ARCH = "${HOST_ARCH}"
> ROOTFS_DISTRO = "${HOST_DISTRO}"
> ROOTFSDIR = "${S}"
> ROOTFS_PACKAGES = "${SDKCHROOT_PREINSTALL} ${TOOLCHAIN}"
> -ROOTFS_FEATURES += "clean-package-cache generate-manifest"
> +ROOTFS_FEATURES += "clean-package-cache generate-manifest export-dpkg-status"
> ROOTFS_MANIFEST_DEPLOY_DIR = "${DEPLOY_DIR_SDKCHROOT}"
> +ROOTFS_DPKGSTATUS_DEPLOY_DIR = "${DEPLOY_DIR_SDKCHROOT}"
>
> python() {
> if d.getVar("HOST_ARCH") not in ['i386', 'amd64']:
>
Looks good to me!
Jan
--
Siemens AG, Corporate Technology, CT RDA IOT SES-DE
Corporate Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [debsecan] meta/classes: export dpkg status file for debsecan
2020-10-01 5:06 ` [debsecan] meta/classes: export dpkg status file " Daniel Sangorrin
2020-10-05 6:06 ` Jan Kiszka
@ 2020-10-05 15:21 ` Baurzhan Ismagulov
2020-11-26 17:18 ` Anton Mikanovich
2 siblings, 0 replies; 5+ messages in thread
From: Baurzhan Ismagulov @ 2020-10-05 15:21 UTC (permalink / raw)
To: isar-users
Hello Daniel,
On Thu, Oct 01, 2020 at 02:06:35PM +0900, Daniel Sangorrin wrote:
> Although the currently exported manifest has enough
> information for scanning vulnerabilities, the tool
> debsecan depends on the /var/lib/dpkg/status file
> format. This patch adds a feature to export such file.
>
> All rootfs'es export the file by default and with
> the same file name syntax as the manifests, except
> for the file extension which is ".dpkg_status"
> instead of ".manifest".
>
> Remove the feature with:
> ROOTFS_FEATURES_remove = "export-dpkg-status"
Looks good to me, either. Please let me apply a couple of series from the list,
then we'll have to rebase this.
With kind regards,
Baurzhan.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [debsecan] meta/classes: export dpkg status file for debsecan
2020-10-01 5:06 ` [debsecan] meta/classes: export dpkg status file " Daniel Sangorrin
2020-10-05 6:06 ` Jan Kiszka
2020-10-05 15:21 ` Baurzhan Ismagulov
@ 2020-11-26 17:18 ` Anton Mikanovich
2 siblings, 0 replies; 5+ messages in thread
From: Anton Mikanovich @ 2020-11-26 17:18 UTC (permalink / raw)
To: isar-users
01.10.2020 08:06, Daniel Sangorrin wrote:
> Although the currently exported manifest has enough
> information for scanning vulnerabilities, the tool
> debsecan depends on the /var/lib/dpkg/status file
> format. This patch adds a feature to export such file.
>
> All rootfs'es export the file by default and with
> the same file name syntax as the manifests, except
> for the file extension which is ".dpkg_status"
> instead of ".manifest".
>
> Remove the feature with:
> ROOTFS_FEATURES_remove = "export-dpkg-status"
>
> Signed-off-by: Daniel Sangorrin <daniel.sangorrin@toshiba.co.jp>
Rebased and applied on next, thanks.
Result is below.
From d3914aeebc5dcd020b85898ffde8f0b7abf2ccaa Mon Sep 17 00:00:00 2001
From: Daniel Sangorrin <daniel.sangorrin@toshiba.co.jp>
Date: Thu, 1 Oct 2020 14:06:35 +0900
Subject: [debsecan] meta/classes: export dpkg status file for debsecan
Although the currently exported manifest has enough
information for scanning vulnerabilities, the tool
debsecan depends on the /var/lib/dpkg/status file
format. This patch adds a feature to export such file.
All rootfs'es export the file by default and with
the same file name syntax as the manifests, except
for the file extension which is ".dpkg_status"
instead of ".manifest".
Remove the feature with:
ROOTFS_FEATURES_remove = "export-dpkg-status"
Signed-off-by: Daniel Sangorrin <daniel.sangorrin@toshiba.co.jp>
---
meta/classes/image.bbclass | 3 ++-
meta/classes/rootfs.bbclass | 8 ++++++++
meta/recipes-devtools/buildchroot/buildchroot.inc | 3 ++-
meta/recipes-devtools/sdkchroot/sdkchroot.bb | 3 ++-
4 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/meta/classes/image.bbclass b/meta/classes/image.bbclass
index a296cc0..8e350a3 100644
--- a/meta/classes/image.bbclass
+++ b/meta/classes/image.bbclass
@@ -63,9 +63,10 @@ image_do_mounts() {
}
ROOTFSDIR = "${IMAGE_ROOTFS}"
-ROOTFS_FEATURES += "clean-package-cache finalize-rootfs generate-manifest"
+ROOTFS_FEATURES += "clean-package-cache finalize-rootfs
generate-manifest export-dpkg-status"
ROOTFS_PACKAGES += "${IMAGE_PREINSTALL} ${IMAGE_INSTALL}"
ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
+ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
inherit rootfs
inherit image-sdk-extension
diff --git a/meta/classes/rootfs.bbclass b/meta/classes/rootfs.bbclass
index 44b78a9..5b63ae7 100644
--- a/meta/classes/rootfs.bbclass
+++ b/meta/classes/rootfs.bbclass
@@ -11,6 +11,7 @@ ROOTFS_PACKAGES ?= ""
# available features are:
# 'clean-package-cache' - delete package cache from rootfs
# 'generate-manifest' - generate a package manifest of the rootfs into
${ROOTFS_MANIFEST_DEPLOY_DIR}
+# 'export-dpkg-status' - exports /var/lib/dpkg/status file to
${ROOTFS_DPKGSTATUS_DEPLOY_DIR}
# 'finalize-rootfs' - delete files needed to chroot into the rootfs
ROOTFS_FEATURES ?= ""
@@ -201,6 +202,13 @@ rootfs_generate_manifest () {
${ROOTFS_MANIFEST_DEPLOY_DIR}/"${PF}".manifest
}
+ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES',
'export-dpkg-status', 'rootfs_export_dpkg_status', '', d)}"
+rootfs_export_dpkg_status() {
+ mkdir -p ${ROOTFS_DPKGSTATUS_DEPLOY_DIR}
+ cp '${ROOTFSDIR}'/var/lib/dpkg/status \
+ '${ROOTFS_DPKGSTATUS_DEPLOY_DIR}'/'${PF}'.dpkg_status
+}
+
ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES',
'finalize-rootfs', 'rootfs_postprocess_finalize', '', d)}"
rootfs_postprocess_finalize() {
sudo -s <<'EOSUDO'
diff --git a/meta/recipes-devtools/buildchroot/buildchroot.inc
b/meta/recipes-devtools/buildchroot/buildchroot.inc
index 835968d..5a2befb 100644
--- a/meta/recipes-devtools/buildchroot/buildchroot.inc
+++ b/meta/recipes-devtools/buildchroot/buildchroot.inc
@@ -20,7 +20,8 @@ ROOTFSDIR = "${BUILDCHROOT_DIR}"
ROOTFS_PACKAGES = "${BUILDCHROOT_PREINSTALL}"
ROOTFS_CLEAN_FILES = ""
ROOTFS_MANIFEST_DEPLOY_DIR = "${DEPLOY_DIR_BUILDCHROOT}"
-ROOTFS_FEATURES += "generate-manifest"
+ROOTFS_DPKGSTATUS_DEPLOY_DIR = "${DEPLOY_DIR_BUILDCHROOT}"
+ROOTFS_FEATURES += "generate-manifest export-dpkg-status"
BUILDCHROOT_COMPAT_PREINSTALL_compat-arch = " \
libc6:${COMPAT_DISTRO_ARCH} \
diff --git a/meta/recipes-devtools/sdkchroot/sdkchroot.bb
b/meta/recipes-devtools/sdkchroot/sdkchroot.bb
index 893b287..d7a848e 100644
--- a/meta/recipes-devtools/sdkchroot/sdkchroot.bb
+++ b/meta/recipes-devtools/sdkchroot/sdkchroot.bb
@@ -31,8 +31,9 @@ ROOTFS_ARCH = "${HOST_ARCH}"
ROOTFS_DISTRO = "${HOST_DISTRO}"
ROOTFSDIR = "${S}"
ROOTFS_PACKAGES = "${SDK_PREINSTALL} ${SDK_INSTALL} ${TOOLCHAIN}"
-ROOTFS_FEATURES += "clean-package-cache generate-manifest"
+ROOTFS_FEATURES += "clean-package-cache generate-manifest
export-dpkg-status"
ROOTFS_MANIFEST_DEPLOY_DIR = "${DEPLOY_DIR_SDKCHROOT}"
+ROOTFS_DPKGSTATUS_DEPLOY_DIR = "${DEPLOY_DIR_SDKCHROOT}"
python() {
if d.getVar("HOST_ARCH") not in ['i386', 'amd64']:
--
2.20.1
--
Anton Mikanovich
Promwad Ltd.
External service provider of ilbers GmbH
Maria-Merian-Str. 8
85521 Ottobrunn, Germany
+49 (89) 122 67 24-0
Commercial register Munich, HRB 214197
General Manager: Baurzhan Ismagulov
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-11-26 17:18 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-01 5:06 [debsecan] export dpkg status for debsecan Daniel Sangorrin
2020-10-01 5:06 ` [debsecan] meta/classes: export dpkg status file " Daniel Sangorrin
2020-10-05 6:06 ` Jan Kiszka
2020-10-05 15:21 ` Baurzhan Ismagulov
2020-11-26 17:18 ` Anton Mikanovich
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox