[Openembedded-architecture] Trusted/secure/etc layers

[Tom Rini]

On Tue, May 01, 2018 at 04:33:39PM +0100, Burton, Ross wrote:

> Hi,
> 
> As discussed on the planning call, there are lots of layers which all
> solve a part of the trusted/secure problem.
> 
> So let's crowdsource the collation: can everyone who knows of or is
> maintaining a relevant layer please post it here, and talk about what
> they plan to work on.

So first, a very inexhaustive list:

Defunct but still in use:
https://github.com/intel/meta-intel-iot-security provides SMACK stuff
not found elsewhere (AFAICT) so it used by AGL.  Also provides IMA stuff
that is found elsewhere.

https://git.yoctoproject.org/cgit/cgit.cgi/meta-security/tree/ provides
TPM1/TPM2 capabilities, a large number of tools (defensive and post
mortem), apparmor and SMACK support.

https://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/tree/ provides
SELinux support.

https://github.com/flihp/meta-measured provides TPM support, Intel TXT
and other useful things.  I've not personally used this but I know
others that will chime in on this thread have.

https://github.com/jiazhang0/meta-secure-core/ provides IMA, TPM1/TPM2,
intrusion detection system (ids), UEFI Secure Boot (via MOK), luks and key
management / creation support.

I'll leave it to others to chime in with other layers and/or expand on
what I've said about the above.

-- 
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <http://lists.openembedded.org/pipermail/openembedded-architecture/attachments/20180501/f51a0552/attachment-0002.sig>