Yocto Project/OpenEmbedded Meets Security
summary
Explains concrete Yocto/OpenEmbedded actions: enable inherit CVE check to scan NVD (note NVD moved to JSON/Git and CVE format 5.0), use meta-security and security-flag.inc for scanners, hardening flags and per-service users, audit distro-features (avoid poky defaults like debug and NFS), split all product changes into a private layer, prune dependencies (one pass can remove ~100 packages), follow Kernel Self Protection options, and post-process CVE results to merge and prioritize fixes across images.
AI-written summary · about
chapters (7)
- 0:00Security challenges in embedded
- 5:54Yocto security introduction
- 7:19Secure devices with Yocto
- 15:00Hardening configuration practices
- 23:19Vulnerability management
- 28:51Existing products and future plans
- 34:19Q&A
related talks
40mSecuring a Yocto-based Distribution: The Case of AllScenariosOS
35mDetecting and Defusing the Ticking Time Bomb: Understanding CVEs and Upstreaming in Yocto
19mScanning for known vulnerabilities in an embedded distribution
53mThe Cyber Resilience Act: Navigating Its Impact on Yocto-Based Products
44mSecuring a Yocto Built System- 53mThe Cyber Resilience Act: Navigating Its Impact on Yocto-Based Products
42mComparison and Proposal of Vulnerability Management Approaches in Yocto-Based...
59mGetting Started with Embedded Linux Security