Security: Difference between revisions

From Yocto Project
Jump to navigationJump to search
Line 4: Line 4:




== Branches that are maintained with security fixes  ==
== Branches maintained with security fixes  ==


{| class="wikitable"
{| class="wikitable"
Line 46: Line 46:




All CVEs (security patches) should be backported to all branches above (if possible) except versions in grey.  
All CVEs (security patches) should be backported to all branches above (if at all possible).  
Versions in grey are no longer actively maintained, but well-tested security patches may still be accepted for them.)  
Versions in grey are no longer actively maintained, but well-tested security patches may still be accepted for them.)  






See [https://wiki.yoctoproject.org/wiki/Stable_branch_maintenance Stable branches]for the detailed info regarding the policies and maintenance of Stable branch
See [https://wiki.yoctoproject.org/wiki/Stable_branch_maintenance Stable branches maintenance]for detailed info regarding the policies and maintenance of Stable branch


== Kernel security patches ==
== Kernel security patches ==

Revision as of 14:09, 11 November 2014

Since the Yocto Project is intended to be flexible and meet the needs of many applications, we leave policy-making decisions around security to our end users. Our goal instead is to ship each release with metadata that follows best practices in that we do not release recipe versions which are known to have significant security vulnerabilities. Generally this is done by upgrading recipes to newer versions that are no longer vulnerable to these issues.

We are tracking security vulnerabilities in the Yocto Project against the National Vulnerability Database.


Branches maintained with security fixes

Major version Current Version Branch name BitBake version Maintainer
1.7 1.7 dizzy 1.24 Armin Kuster <akuster808@gmail.com>
1.6 1.6.1 daisy 1.22 Saul Wold <sgw@linux.intel.com>
1.5 1.5.3 dora 1.20 Robert Yang <liezhi.yang@windriver.com>
1.4 1.4.3* dylan 1.18 Paul Eggleton <paul.eggleton@linux.intel.com>
1.3 1.3.2 danny 1.16 Ross Burton <ross.burton@intel.com>


All CVEs (security patches) should be backported to all branches above (if at all possible). Versions in grey are no longer actively maintained, but well-tested security patches may still be accepted for them.)


See Stable branches maintenancefor detailed info regarding the policies and maintenance of Stable branch

Kernel security patches

Kernel security patches are backported to Linux-yoco kernels regularly from https://www.kernel.org/

Linux-yocto

linux-yocto_3.10 & linux-yocto_3.14 (maintainer: Ross Burton)

Vendor kernels

Kernel security patches are also backported to Linux-vendor kernels from https://www.kernel.org/

  • meta-intel (meta-intel uses Linux-yocto)
  • meta-fsl-ppc (maintainer: xxx)
  • meta-fsl-arm (maintainer: xxx)
  • meta-xilinx (maintainer: xxx)
  • meta-ti (maintainer: xxx)
  • etc

How to test

If there is any test case for the vulnerability by the upstream project or community

- Run the test to reproduce the problem and after applying the correction to verify that the problem is solved. 
- Run the regression test

If there isn’t any test case and it is complicated and time consuming to write a testcase

- Run the regressions test


Regression test

  • Build the core image for at least two architectures (preferably one big-endian and one little-endian)
  • Run ptest (for those branches/packages that there is ptest mechanism)

Patch name convention and commit comment

Security patches should have reference to the CVE identifier both in the patch file/s and the commit comment.

Please make sure to add the package name in the subject and the reference to the CVE. Example for the commit comment:

   bash: CVE-2014-6278
   
   <short description>
   
   References
   E.g. linke to CVE or other useful info/blog/advisory.
   
   Signed-off-by: <your email addres>
   Signed-off-by: xxxx

For additional guideline refer to: Commit Patch Message Guidelines

Some security related links/useful tools

Security Issues Addressed in Yocto 1.7 / Poky x.