Re: [RFC cip-dev][isar-cip-core][PATCH 09/14] Add class cis-hardening for post rootfs generation fixups

On 24.07.26 14:39, Quirin Gylstorff wrote:
> From: Quirin Gylstorff <[email protected]>
> 
> The kernel hardening can disable squashfs even when we build images that
> use it. Add a conflict detection that is conditionally prepended to the
> do_image_squashfs function. This makes sure we always catch the fact
> that a squashfs image is built and can provide a clear error during
> build, instead of not booting later on.

This sounds like whac a mole to me. Squashfs is just one recent example,
but there could be more. The underlying rule of CIS is (to my
understanding) "disable unused filesystems". Can't we manage that list
more effectively? See also below.

> 
> Co-Authored-by: Felix Moessbauer <[email protected]>
> Co-Authored-by: Christoph Steiger <[email protected]>
> Signed-off-by: Quirin Gylstorff <[email protected]>
> ---
>  classes-recipe/cis-hardening.bbclass | 31 ++++++++++++++++++++++++++++
>  1 file changed, 31 insertions(+)
>  create mode 100644 classes-recipe/cis-hardening.bbclass
> 
> diff --git a/classes-recipe/cis-hardening.bbclass b/classes-recipe/cis-hardening.bbclass
> new file mode 100644
> index 0000000..baf3e82
> --- /dev/null
> +++ b/classes-recipe/cis-hardening.bbclass
> @@ -0,0 +1,31 @@
> +#
> +# CIP Core, generic profile
> +#
> +# Copyright (c) Siemens AG, 2026
> +#
> +# Authors:
> +#  Felix Moessbauer <[email protected]>
> +#
> +# SPDX-License-Identifier: MIT
> +
> +# The config file is generated during install, hence
> +# change permissions after all installs are settled
> +apply_sshd_hardening[weight] = "1"
> +apply_sshd_hardening() {
> +    CIS_SSHD=/usr/share/cip-cis-rules/configuration/cis-5.2.1.sh
> +    if [ -f "${ROOTFSDIR}/${CIS_SSHD}" ] && [ -f "${ROOTFSDIR}/usr/share/openssh/sshd_config" ]; then
> +        sudo chroot "${ROOTFSDIR}" ${CIS_SSHD}
> +    fi
> +}
> +ROOTFS_POSTPROCESS_COMMAND += "apply_sshd_hardening"

Above, you only talked about squashfs. What is this hunk about?

> +
> +python detect_squashfs_conflict() {
> +    hardening_cfg = "{}/{}-hardening.kernel.cfg".format(d.getVar("DEPLOY_DIR_IMAGE"), d.getVar("DISTRO"))
> +    with open(hardening_cfg) as f:
> +        lines = list(map(lambda l: l.strip(), set(f.readlines())))
> +
> +    if "# CONFIG_SQUASHFS is not set" in lines:
> +        bb.fatal("CIS kernel hardening disables squashfs, but squashfs is selected as image fs. Consider disabling the hardening option for squashfs or using an alternative fs.")
> +}
> +
> +do_image_squashfs[prefuncs] += "detect_squashfs_conflict"

If this needs to be extended to "CONFIG_ANOTHER_FS", it would be nicer
to just have a generic conflict checker function so that a single-line
statement can be added for it. Maybe there are even further kernel
config options than filesystems that want such cross-checking?

Even better would be if we also had a visualization of the conflict in
the hardening Kconfig menu...

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center