[RFC cip-dev][isar-cip-core][PATCH 09/14] Add class cis-hardening for post rootfs generation fixups

From: Quirin Gylstorff <[email protected]>

The kernel hardening can disable squashfs even when we build images that
use it. Add a conflict detection that is conditionally prepended to the
do_image_squashfs function. This makes sure we always catch the fact
that a squashfs image is built and can provide a clear error during
build, instead of not booting later on.

Co-Authored-by: Felix Moessbauer <[email protected]>
Co-Authored-by: Christoph Steiger <[email protected]>
Signed-off-by: Quirin Gylstorff <[email protected]>
---
 classes-recipe/cis-hardening.bbclass | 31 ++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 classes-recipe/cis-hardening.bbclass

diff --git a/classes-recipe/cis-hardening.bbclass b/classes-recipe/cis-hardening.bbclass
new file mode 100644
index 0000000..baf3e82
--- /dev/null
+++ b/classes-recipe/cis-hardening.bbclass
@@ -0,0 +1,31 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2026
+#
+# Authors:
+#  Felix Moessbauer <[email protected]>
+#
+# SPDX-License-Identifier: MIT
+
+# The config file is generated during install, hence
+# change permissions after all installs are settled
+apply_sshd_hardening[weight] = "1"
+apply_sshd_hardening() {
+    CIS_SSHD=/usr/share/cip-cis-rules/configuration/cis-5.2.1.sh
+    if [ -f "${ROOTFSDIR}/${CIS_SSHD}" ] && [ -f "${ROOTFSDIR}/usr/share/openssh/sshd_config" ]; then
+        sudo chroot "${ROOTFSDIR}" ${CIS_SSHD}
+    fi
+}
+ROOTFS_POSTPROCESS_COMMAND += "apply_sshd_hardening"
+
+python detect_squashfs_conflict() {
+    hardening_cfg = "{}/{}-hardening.kernel.cfg".format(d.getVar("DEPLOY_DIR_IMAGE"), d.getVar("DISTRO"))
+    with open(hardening_cfg) as f:
+        lines = list(map(lambda l: l.strip(), set(f.readlines())))
+
+    if "# CONFIG_SQUASHFS is not set" in lines:
+        bb.fatal("CIS kernel hardening disables squashfs, but squashfs is selected as image fs. Consider disabling the hardening option for squashfs or using an alternative fs.")
+}
+
+do_image_squashfs[prefuncs] += "detect_squashfs_conflict"
-- 
2.53.0