[cip-dev][isar-cip-core][PATCH v2 00/12] Add recipes for image hardening

This patch series adds the option to harden the build image according to the guidelines published by CIS.
The patch introduces the following packages:

cip-cis-rules-config: user-facing configuration, stored in .config.json and configurable interactively via Kconfig.
cip-cis-rules: uses the configuration from cip-cis-rules-config to generate a custom Debian package containing the necessary hardening configuration.
cis-validation: an optional package to validate the hardening rules.

Additionally, the kernel configuration is checked against the hardening rules.
This patch set is currently developed and tested for hardening level 2.

Changes v2:

- rebased onto commit 73d8558efc2fb49436aafac36126564c6a725565
- reorder patches
  - README is now first to explain architecture
  - layer.conf before arming
  - kernel and image are armed together
- use external repo for cip-cis-rules https://gitlab.com/cip-playground/cip-cis-rules
- menuconfig now uses devshell to be independent from kas environment
- generate config.json and kconfig on the fly
- bugfixes
- rename cip-cis-validation to cis-validation
- remove CIP_ prefix from variables
- rework readme

Clara Kowalsky (2):
  Add cis-validation to validate the hardening based on the CIS rules
  Add kas file for hardening configuration

Quirin Gylstorff (10):
  Add doc/README.cis-hardening.md
  Add cip-cis-rules to apply hardening configuration to the system
  Add github.com/ovh/debian-cis for the hardening validation
  Add cip-cis-rules-config to configure the hardening according to CIS
  Apply hardening configuration to the kernel
  Add class for validating the CIS options in the kernel config
  Add class cis-hardening for post rootfs generation fixups
  layer.conf: use variables to control path of hardening config
  Integrate cis-hardening into cip-core-image
  Add Kconfig option to select cis-validation

 Kconfig                                       |  10 +
 README.md                                     |   1 +
 classes-recipe/cis-hardening.bbclass          |  47 ++
 .../cis-kernel-hardening-validation.bbclass   | 110 ++++
 conf/layer.conf                               |   3 +
 doc/README.cis-hardening.md                   | 229 +++++++
 kas/opt/cis-hardening.yml                     |  19 +
 recipes-core/images/cip-core-image.inc        |   4 +
 recipes-kernel/linux/kernel-hardening.inc     |  16 +
 recipes-kernel/linux/linux-cip-common.inc     |   1 +
 .../cip-cis-rules-config.bb                   | 162 +++++
 .../cip-cis-rules-config/files/postinst       |  32 +
 .../cip-cis-rules-config/files/rules.tmpl     |  19 +
 .../files/scripts/cis-hardening-to-kconfig.py | 350 ++++++++++
 .../files/scripts/config.schema.json          | 124 ++++
 .../files/scripts/enable-cis-rules.py         | 333 ++++++++++
 .../files/scripts/gen-kernel-config.py        | 165 +++++
 .../files/scripts/select-hardenings.py        | 618 ++++++++++++++++++
 .../cip-cis-rules/cip-cis-rules_1.0.0.bb      |  23 +
 .../cis-hardening/cis-hardening_4.1-6.bb      |  17 +
 .../cis-validation/cis-validation_1.0.bb      |  51 ++
 .../files/cis-validation.service              |  13 +
 .../cis-validation/files/cis-validation.tmpl  |  65 ++
 .../files/generate-overrides.py               | 103 +++
 .../cis-validation/files/postinst             |  52 ++
 25 files changed, 2567 insertions(+)
 create mode 100644 classes-recipe/cis-hardening.bbclass
 create mode 100644 classes-recipe/cis-kernel-hardening-validation.bbclass
 create mode 100644 doc/README.cis-hardening.md
 create mode 100644 kas/opt/cis-hardening.yml
 create mode 100644 recipes-kernel/linux/kernel-hardening.inc
 create mode 100644 recipes-security/cip-cis-rules-config/cip-cis-rules-config.bb
 create mode 100644 recipes-security/cip-cis-rules-config/files/postinst
 create mode 100644 recipes-security/cip-cis-rules-config/files/rules.tmpl
 create mode 100755 recipes-security/cip-cis-rules-config/files/scripts/cis-hardening-to-kconfig.py
 create mode 100644 recipes-security/cip-cis-rules-config/files/scripts/config.schema.json
 create mode 100644 recipes-security/cip-cis-rules-config/files/scripts/enable-cis-rules.py
 create mode 100755 recipes-security/cip-cis-rules-config/files/scripts/gen-kernel-config.py
 create mode 100755 recipes-security/cip-cis-rules-config/files/scripts/select-hardenings.py
 create mode 100644 recipes-security/cip-cis-rules/cip-cis-rules_1.0.0.bb
 create mode 100644 recipes-security/cis-hardening/cis-hardening_4.1-6.bb
 create mode 100644 recipes-security/cis-validation/cis-validation_1.0.bb
 create mode 100644 recipes-security/cis-validation/files/cis-validation.service
 create mode 100644 recipes-security/cis-validation/files/cis-validation.tmpl
 create mode 100755 recipes-security/cis-validation/files/generate-overrides.py
 create mode 100644 recipes-security/cis-validation/files/postinst

-- 
2.55.0