kernel-cve-check.bbclass

#
# kernel-cve-check.bbclass
#
# This class checks fixed CVEs in kernel by using cip-kernel-sec
# and adds them to the CVE_CHECK_WHITELIST before the cve_check runs.
#
# This class reads cip version from 'LINUX_CIP_VERSION' variable.
# Set the version of cip kernel to be used in the variable.
#
# Example:
#   LINUX_CIP_VERSION = 'v4.19.165-cip41'
#
# In order to use this class inherit this class in the local.conf
# and run cve_check task.

inherit cve-check

KERNEL_CVE_CHECK_DIR ?= "${CVE_CHECK_DB_DIR}/KERNEL"
CVE_CHECK_ERROR_ON_FAILURE ??= "0"

# Consider ignore information.
# If value is "0", add CVEs that are registered as negligible to whitelist.
KERNEL_CVE_CHECK_INCLUDE_IGNORE ?= "1"

# Add ignore information to cve manifest.
KERNEL_CVE_CHECK_SHOW_IGNORE_INFO ?= "0"

# Remote branch name. bitbake detects it from kernel-src by default.
KERNEL_CVE_CHECK_LINUX_GIT_REMOTE_REPO ??= ""
KERNEL_CVE_CHECK_LINUX_GIT_REMOTE_AUTODETECT ??= "1"

# It requires an initial value to ignore kernel cve check if PN is not kernel
KERNEL_PN = "not_kernel"
KERNEL_CVE_CHECK_TASK_ORDER = ""

python() {
    if d.getVar("PN") in ['linux-base', 'linux-k510']:
        d.appendVar("DEPENDS", " python3-html5lib-native python3-pyyaml-native ")
        d.setVar('KERNEL_PN', d.getVar('PN'))
        d.setVar('KERNEL_CVE_CHECK_TASK_ORDER', '{}:do_unpack {}:do_prepare_recipe_sysroot'.format(d.getVar('KERNEL_PN'), d.getVar('KERNEL_PN')))
}

###############################################################################
# update_cip_kernel_sec
###############################################################################

def remove_remote(workdir):
    """
    Remove needless remotes from remotes.yml.
    """
    import yaml

    remotes_path = os.path.join(workdir, "remotes.yml")

    with open(remotes_path) as f:
        content = yaml.safe_load(f)

    with open(remotes_path, "w") as f:
        yaml.dump({"cip": content["cip"]}, f, default_flow_style=False)

python update_cip_kernel_sec () {
    """
    Update cip-kernel-sec repository.
    """
    from bb.fetch2 import runfetchcmd

    kernel_cve_check_dir = d.getVar("KERNEL_CVE_CHECK_DIR")
    cip_kernel_sec_path = os.path.join(kernel_cve_check_dir, "cip-kernel-sec")
    git_uri = "https://gitlab.com/cip-project/cip-kernel/cip-kernel-sec.git"

    if not os.path.isdir(kernel_cve_check_dir):
        os.mkdir(kernel_cve_check_dir)

    try:
        if not os.path.isdir(cip_kernel_sec_path):
            # first run
            runfetchcmd("git clone %s cip-kernel-sec" % git_uri, d, workdir=kernel_cve_check_dir)
            remove_remote(os.path.join(cip_kernel_sec_path, "conf"))
            runfetchcmd("git update-index --skip-worktree conf/remotes.yml", d, workdir=cip_kernel_sec_path)
        else:
            runfetchcmd("git pull", d, workdir=cip_kernel_sec_path)
    except Exception as e:
        bb.debug(2, "update_cip_kernel_sec: %s, %s" % (git_uri, e))
}

do_populate_cve_db[postfuncs] += "update_cip_kernel_sec"

###############################################################################
# kernel_cve_check
###############################################################################

def get_issue_list(cip_kernel_sec_path):
    """
    Get issue list registered to cip-kernel-sec.
    """
    import glob
    glob_param = cip_kernel_sec_path + "/issues/CVE-*.yml"

    return [os.path.basename(name)[:-4] for name in glob.glob(glob_param)]

python kernel_cve_check () {
    """
    Check cves by cip-kernel-sec
    """
    from bb.fetch2 import runfetchcmd
    import requests
    import bb.process
    import yaml
    import os
    import tempfile
    from datetime import datetime, date

    kernel_path = d.getVar("S")
    linux_cip_ver = d.getVar("LINUX_CIP_VERSION")
    kernel_cve_check_dir = d.getVar("KERNEL_CVE_CHECK_DIR")
    cip_kernel_sec_path = os.path.join(kernel_cve_check_dir, "cip-kernel-sec")
    include_ignore = d.getVar("KERNEL_CVE_CHECK_INCLUDE_IGNORE")
    python_path = d.getVar("STAGING_BINDIR_NATIVE") + "/python3-native/python3"
    remote_repo_name = d.getVar("KERNEL_CVE_CHECK_LINUX_GIT_REMOTE_REPO")
    remote_repo_autodetect = d.getVar("KERNEL_CVE_CHECK_LINUX_GIT_REMOTE_AUTODETECT")

    if linux_cip_ver is None:
        bb.error("LINUX_CIP_VERSION is not set. Please set version")
        return

    cip_kernel_sec_fetch_head = os.path.join(cip_kernel_sec_path, ".git/FETCH_HEAD")
    cve_check_error = True
    if os.path.isfile(cip_kernel_sec_fetch_head):
        timestamp = datetime.fromtimestamp(os.path.getmtime(cip_kernel_sec_fetch_head))
        if timestamp.date() == date.today():
            cve_check_error = False

    if cve_check_error:
        if d.getVar("CVE_CHECK_ERROR_ON_FAILURE") == "0":
            d.setVar("CVE_CHECK_DB_FILE", "")
            bb.note("kernel_cve_check: cip-kernel-sec repository sync failure, skipping CVE check")
        else:
            bb.fatal("kernel_cve_check: cip-kernel-sec repository sync failure")
        return

    opt_ignore = "--include-ignored" if include_ignore == "1" else ""
    with tempfile.NamedTemporaryFile(delete=False) as f:
        output_filename = f.name

    # Try to get remote name from kernel repository
    if not remote_repo_name and remote_repo_autodetect == "1":
        try:
            bb.debug(2, "No remote name is defined and KERNEL_CVE_CHECK_LINUX_GIT_REMOTE_AUTODETECT is set. bitbake detects remote name from kernel-src")
            stdout, _ = bb.process.run('git remote', cwd=kernel_path, shell=True)
            remote_repo_name = stdout.splitlines()[0]
        except bb.process.ExecutionError as e:
            bb.warn("Failed to detect remote name. bitbake assumes that remote is 'origin'. Please consider setting KERNEL_CVE_CHECK_LINUX_GIT_REMOTE_REPO")

    cert_path = requests.certs.where()
    cmd = "SSL_CERT_FILE='%s' %s scripts/report_affected.py %s --include-fixed --output-format=yaml --output-filename=%s --remote-name cip:%s --git-repo %s %s" % (cert_path, python_path, opt_ignore, output_filename, remote_repo_name, kernel_path, linux_cip_ver)
    try:
        runfetchcmd(cmd, d, workdir=cip_kernel_sec_path)
    except bb.fetch2.FetchError as e:
        bb.warn("Failed to run report_affected.py: %s" % (e))

    fixed_cves = None
    tmp_affected_cves = []
    with open(output_filename) as f:
        yaml_data = yaml.safe_load(f)
        k = list(yaml_data)[0]

        # We don't need ignored data because CVEs in ignore section is not affected to this kernel version.
        tmp_affected_cves.extend(yaml_data[k]["affected"])
        fixed_cves = yaml_data[k]["fixed"]

    os.unlink(output_filename)

    whitelist = []
    for cve in get_issue_list(cip_kernel_sec_path):
        if cve not in tmp_affected_cves:
            whitelist.append(cve)

    bb.debug(2, "Whitelisted by cip-kernel-sec:\n    %s" % "\n    ".join(whitelist))
    d.appendVar("CVE_CHECK_WHITELIST", ' ' + ' '.join(whitelist))

    safelist_str = d.getVar("CVE_CHECK_WHITELIST")
    safelist = safelist_str.split(" ")

    affected_cves = []
    for cve in tmp_affected_cves:
        if not cve in safelist:
            affected_cves.append(cve)
        else:
            fixed_cves.append(cve)

    d.setVar("CIP_KERNEL_SEC_AFFECTED_CVES", " ".join(affected_cves))
    d.setVar("CIP_KERNEL_SEC_FIXED_CVES", " ".join(fixed_cves))
}

do_cve_check[prefuncs] += "${@bb.utils.contains('PN', d.getVar('KERNEL_PN'), 'kernel_cve_check', '', d)}"
do_cve_check[depends] += "${@bb.utils.contains('PN', d.getVar('KERNEL_PN'), d.getVar('KERNEL_CVE_CHECK_TASK_ORDER'), '', d)}"

###############################################################################
# write_ignore_info
###############################################################################

def get_ignore_info(cip_kernel_sec_path, cve_id, d):
    """
    Get ignore reason for the cve_id.
    """
    import sys

    sys.path.append(cip_kernel_sec_path + "/scripts")
    import kernel_sec.issue

    cwd = os.getcwd()
    os.chdir(cip_kernel_sec_path)
    issue = kernel_sec.issue.load(cve_id)
    os.chdir(cwd)

    ignore = issue.get('ignore', {})
    for branch_name in ignore:
        if branch_name == "all" or branch_name == "cip/4.19":
            return ignore[branch_name].replace('\n', ' ')
    return None

def insert_ignore_info(file_name, d):
    """
    Insert IGNORE INFO attribute.
    """
    if not os.path.isfile(file_name):
        bb.error("%s is not found." % file_name)
        return

    kernel_cve_check_dir =d.getVar("KERNEL_CVE_CHECK_DIR")
    cip_kernel_sec_path = os.path.join(kernel_cve_check_dir, "cip-kernel-sec")
    issue_list = get_issue_list(cip_kernel_sec_path)

    with open(file_name, "r") as f:
        content = f.readlines()

    for index,line in enumerate(content):
        ignore_info = None
        if line.startswith("PACKAGE NAME:"):
            pkg_name = line.split()[2]
        if line.startswith("CVE:") and pkg_name == d.getVar('KERNEL_PN'):
            cve_id = line.split()[1]
            if cve_id in issue_list:
                ignore_info = get_ignore_info(cip_kernel_sec_path, cve_id, d)
                if ignore_info:
                    content.insert(index+6, "IGNORE INFO: %s\n" % ignore_info)

    with open(file_name, "w") as f:
        for line in content:
            f.write(line)

python write_ignore_info () {
    """
    Write ignore information to CVE manifest
    """

    cve_file = d.getVar("CVE_CHECK_LOG")

    insert_ignore_info(cve_file, d)

    if d.getVar("CVE_CHECK_COPY_FILES") == "1":
        cve_dir = d.getVar("CVE_CHECK_DIR")
        deploy_file = os.path.join(cve_dir, d.getVar("PN"))
        insert_ignore_info(deploy_file, d)

    if d.getVar("CVE_CHECK_CREATE_MANIFEST") == "1":
        tmp_file = d.getVar("CVE_CHECK_TMP_FILE")
        insert_ignore_info(tmp_file, d)
}

do_cve_check[postfuncs] += "${@bb.utils.contains('PN', d.getVar('KERNEL_PN'), 'write_ignore_info', '', d) if d.getVar('KERNEL_CVE_CHECK_SHOW_IGNORE_INFO') == '1' else ''}"