Meta-security: Past, Present, and Future

### Overview In this Automotive Linux Summit presentation, Scott Murray introduces the past, present, and future of `meta-security`, a security toolbox metadata layer for the OpenEmbedded and Yocto Project ecosystems. Having recently stepped up as co-maintainer alongside Marta Rybczynska after longtime sole maintainer Armen Kuster stepped down, Murray outlines the scope of the layer, its current maintenance state, upcoming development roadmaps, and its practical applicability to embedded and automotive Linux systems (including Software Defined Vehicles, or SDVs).

### Key Topics - **Origins and Maintainership Transition**: Created by Intel in 2013 and maintained by Armen Kuster from 2014 to mid-2024, `meta-security` transitioned maintainership to Scott Murray and Marta Rybczynska via the Yocto Project steering committee. - **Toolbox Composition and Sub-layers**: The core layer and its sub-layers provide security tooling across multiple domains: compliance and auditing tools (OpenSCAP, Lynis), intrusion detection systems (AIDE, Samhain, Suricata), mandatory access control implementations outside SELinux (AppArmor, Smack, TOMOYO Linux), virus and rootkit scanners (ClamAV), as well as sub-layers like `meta-hardening`, `meta-integrity` (IMA/EVM), `meta-parsec` (PARSEC platform abstraction for security), and `meta-tpm` (TPM 1.x and 2.x). - **Layer Overlap Consolidation**: The maintainers plan to reduce overlap between `meta-security` and Wind River's `meta-secure-core`, specifically targeting consolidation around TPM packages (`meta-tpm2`) and IMA/integrity tooling to provide a unified upstream community source.

### Technical Details - **Continuous Integration & Testing**: Armen Kuster's initial GitLab CI suite has been revived and adapted on Marta Rybczynska's company (Yugr) GitLab runners. Builds for `master` and the recent LTS branch (`scarthgap`) are working, while local test validation is facilitated by tools like `gitlab-ci-local`. Work is ongoing to debug runtime tests in QEMU, particularly for Suricata (which requires specific build flags), Smack, and IMA. - **Release Tracking and Tooling**: The maintainers aim to stabilize patch review turnaround to under two weeks, clean up long-unmaintained packages (e.g., Bastille), and support the Kirkstone LTS branch prior to its April EOL. They are also evaluating the automated `auto-upgrade-helper` tool for recipe updates, balancing CVE-driven updates against stability risks associated with backporting complex packages (especially tools adopting Rust components). - **Automotive and SDV Applications**: Murray highlights several practical use cases for automotive architectures: using `dm-verity` for low-overhead read-only rootfs validation tied to trusted boot; PARSEC for hardware-agnostic root-of-trust and keystore access across vehicle models; runtime intrusion detection (Suricata, Samhain) on network gateways or compute nodes running cloud containers; and compliance tooling (OpenSCAP) for post-deployment vulnerability scanning despite fleet-scale logging challenges.

### Takeaways `meta-security` provides a comprehensive, vendor-neutral security toolbox for Yocto-based distributions. With refreshed maintainership and active CI pipelines, current efforts focus on runtime test stability, eliminating duplication with `meta-secure-core`, and engaging community users to align layer tooling with real-world threat models and validation needs.