[cip-dev][isar-cip-core][PATCH v2 08/12] Add class cis-hardening for post rootfs generation fixups

The kernel hardening can disable squashfs even when we build images that
use it. Add a conflict detection that is conditionally prepended to the
do_image_squashfs function. This makes sure we always catch the fact
that a squashfs image is built and can provide a clear error during
build, instead of not booting later on.

Co-Authored-by: Felix Moessbauer <[email protected]>
Co-Authored-by: Christoph Steiger <[email protected]>
Signed-off-by: Quirin Gylstorff <[email protected]>
---
 classes-recipe/cis-hardening.bbclass | 47 ++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 classes-recipe/cis-hardening.bbclass

diff --git a/classes-recipe/cis-hardening.bbclass b/classes-recipe/cis-hardening.bbclass
new file mode 100644
index 00000000..6ede5376
--- /dev/null
+++ b/classes-recipe/cis-hardening.bbclass
@@ -0,0 +1,47 @@
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2026
+#
+# Authors:
+#  Felix Moessbauer <[email protected]>
+#
+# SPDX-License-Identifier: MIT
+
+# The config file is generated during install, hence
+# change permissions after all installs are settled
+apply_sshd_hardening[weight] = "1"
+apply_sshd_hardening() {
+    CIS_SSHD=/usr/share/cip-cis-rules/configuration/cis-5.2.1.sh
+    if [ -f "${ROOTFSDIR}/${CIS_SSHD}" ] && [ -f "${ROOTFSDIR}/usr/share/openssh/sshd_config" ]; then
+        sudo chroot "${ROOTFSDIR}" ${CIS_SSHD}
+    fi
+}
+ROOTFS_POSTPROCESS_COMMAND += "apply_sshd_hardening"
+
+def assert_hardening_kernel_option(d, option, state, error):
+    """
+    Fail with the given error if a kernel hardening option is set to the given
+    state in the hardening config file.
+    """
+    hardening_cfg = "{}/{}-hardening.kernel.cfg".format(d.getVar("DEPLOY_DIR_IMAGE"), d.getVar("DISTRO"))
+    with open(hardening_cfg) as f:
+        lines = {line.strip() for line in f}
+
+    if state == "yes":
+        has_option = "CONFIG_{}=y".format(option) in lines
+    elif state == "not set":
+        has_option = "# CONFIG_{} is not set".format(option) in lines
+    else:
+        bb.fatal("Unsupported CIS kernel hardening option state: {}".format(state))
+
+    if has_option:
+        bb.fatal(error)
+
+python detect_squashfs_conflict() {
+    assert_hardening_kernel_option(d, "SQUASHFS", "not set",
+        "CIS kernel hardening disables squashfs, but squashfs is selected as image fs. "
+        "Consider disabling the hardening option for squashfs or using an alternative fs.")
+}
+
+do_image_squashfs[prefuncs] += "detect_squashfs_conflict"
-- 
2.55.0