[isar-cip-core PATCH 1/6] opt-security.yml: Sample settings to install security
From: Kazuhiro Hayashi kazuhiro3.hayashi@...
opt-security.yml: Sample settings to install security
Signed-off-by: Kazuhiro Hayashi <kazuhiro3.hayashi@...>
SECURITY.md | 52 ++++++++++++++++++++++++++++++++++++++++++++++++
opt-security.yml | 34 +++++++++++++++++++++++++++++++
2 files changed, 86 insertions(+)
create mode 100644 SECURITY.md
create mode 100644 opt-security.yml
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
@@ -0,0 +1,52 @@
+How to customize images for security features
+This is the "temporal" document about how to create and use
+the CIP Core generic profile images for security feature evaluation.
+* isar-cip-core: https://gitlab.com/zuka0828/isar-cip-core/-/blob/master/README.md
+* ISAR User Manual: https://github.com/ilbers/isar/blob/master/doc/user_manual.md
+* isar-cip-core: master branch
+* Host: Debian 10 buster amd64
+ * Installed packages: `docker-ce`, `qemu-system`
+ * Users who does the following actions must be in the groups `docker` and `kvm`
+Create kas file
+Create a kas file named `opt-security.yml` to add security settings.
+Add security packages to rootfs
+Set `IMAGE_PREINSTALL` to the list of packages required to enable
+the security features. This variable can be set through the kas file.
+ security: |
+ IMAGE_PREINSTALL = "openssl"
+Build images for QEMU x86 64bit machine:
+ $ ./kas-docker --isar build kas.yml:board-qemu-amd64.yml:opt-security.yml
+Run on QEMU
+Run the generated images on QEMU (x86 64bit).
+ $ ./start-qemu.sh amd64
diff --git a/opt-security.yml b/opt-security.yml
new file mode 100644
@@ -0,0 +1,34 @@
+# KAS configuration for CIP Core generic profile to enable security features
+# Copyright (c) Toshiba Corporation, 2020
+# Kazuhiro Hayashi <kazuhiro3.hayashi@...>
+# SPDX-License-Identifier: MIT
+ version: 8
+ security: |
+ # TODO: Add sudo or sudo-ldap
+ IMAGE_PREINSTALL = "\
+ openssl libssl1.1 \
+ fail2ban \
+ openssh-server openssh-sftp-server openssh-client \
+ syslog-ng-core syslog-ng-mod-journal \
+ aide aide-common \
+ libnftables0 nftables \
+ libpam-pkcs11 \
+ chrony \
+ tpm2-tools \
+ tpm2-abrmd \
+ libtss2-esys0 libtss2-udev \
+ libpam-cracklib \
+ acl \
+ libauparse0 audispd-plugins auditd \
+ uuid-runtime \
\ No newline at end of file
On 26.06.20 08:44, venkata wrote:
From: Kazuhiro Hayashi kazuhiro3.hayashi@...<mailto:kazuhiro3.hayashi@...>This line seems to have been mangled. It should be in line with the Signed-off-by.
opt-security.yml: Sample settings to install securityThat file is added by this patch already.
+Shouldn't we target for a security image (recipe) instead?
General question: What is this series targeting? Seems patch 2 and 3 are left-overs from the development. Is this an RFC series only?
Siemens AG, Corporate Technology, CT RDA IOT SES-DE
Corporate Competence Center Embedded Linux
Daniel Sangorrin <daniel.sangorrin@...>
toggle quoted messageShow quoted text
-----Original Message-----It seems that opt-security.yaml was already removed in the security branch:
Venkata-san: could you rebase your patches for the master branch?
For example, instead of sending one patch where you add opt-security.yaml and then another patch where you remove it (which may have happened in your branch, but we don't care), just send the patch that uses core-image-security. That will make things easier to review.
Also, as we have talked in the meetings, it looks like the security layer at the moment is just adding some packages but don't you need to add configuration files to harden the final file system? For example, you may want to change the configuration of the ssh server so that passwords are not accepted (only ssh keys). And the same for the rest of packages. In that case, you probably want to create a new kas-security.yaml.
On Mon, Jun 29, 2020 at 05:26 PM, Daniel Sangorrin wrote:
I understood now, i will rebase the patches with master branch and i will resend the patches for review, sorry for the confusion-----Original Message-----It seems that opt-security.yaml was already removed in the security branch:
Also, as we have talked in the meetings, it looks like the security layer at the moment is just adding some packages but don't you need to add configuration files to harden the final file system? For example, you may want to change the configuration of the ssh server so that passwords are not accepted (only ssh keys). And the same for the rest of packages. In that case, you probably want to create a new kas-security.yaml.Currently we don't have such configuration changes, but most probably in the future may be after discussion with Certification Body we may need to include configurations to fullfill the security requirement, we will keep this point in security WG discussions and get some consensus.