From: Josh Poimboeuf jpoimboe@redhat.com
redhat/configs: Enable CONFIG_X86_KERNEL_IBT for Fedora and ARK
Kernel IBT is a nice kernel hardening feature with virtually no performance impact. Since commit 4fd5f70ce14d ("x86/Kconfig: Enable kernel IBT by default"), its now enabled by default upstream. Enable it in Fedora and ARK as well.
Signed-off-by: Josh Poimboeuf jpoimboe@redhat.com
diff --git a/redhat/configs/common/generic/x86/CONFIG_X86_KERNEL_IBT b/redhat/configs/common/generic/x86/CONFIG_X86_KERNEL_IBT index blahblah..blahblah 100644 --- a/redhat/configs/common/generic/x86/CONFIG_X86_KERNEL_IBT +++ b/redhat/configs/common/generic/x86/CONFIG_X86_KERNEL_IBT @@ -1 +1 @@ -# CONFIG_X86_KERNEL_IBT is not set +CONFIG_X86_KERNEL_IBT=y
-- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346
From: Waiman Long on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1298001...
I think we should backport this IBT support to RHEL9. Hopefully we can do it in 9.3 or 9.4.
From: Patrick Talbert on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1322196...
This fails to build for x86_64: https://s3.amazonaws.com/arr-cki-prod-trusted- artifacts/trusted- artifacts/812113046/build%20x86_64/3967140915/artifacts/build.log
From: Justin M. Forbes on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1322203...
This seems unrelated
From: Justin M. Forbes on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1322275...
Verified with a local build, flipping this config item doesn't seem to break things.
From: Patrick Talbert on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1327145...
Hmm when I build this locally with the cki builder-rawhide image I get the same error. I wonder if it somehow has the wrong libbpf version. ~~~ ptalbert@toolbox (builder_rawhide):~/git/gitlab/kernel-ark (mr2346-rebase)$ rpm -qa | grep libbpf libbpf-1.1.0-2.fc38.x86_64 libbpf-devel-1.1.0-2.fc38.x86_64 ~~~
From: Justin M. Forbes on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1327284...
Right, so this does seem to fail in rawhide, but not when built on f37. It seems the version of dwarves (pahole) matters, and the newer pahole chokes.
From: Josh Poimboeuf on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1347649...
This combination of newer toolchain with kernel IBT seems to be uncovering a bug in the kernel's ELF note section alignment. I'm working on a fix to post upstream.
From: Patrick Talbert on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1348057...
The dwarves package was updated yesterday and the pipeline builder image has picked it up so now the pipeline can successfully build the kernel with this MR applied.
Are you saying there is some further problem that needs to be fixed before this should be merged?
From: Josh Poimboeuf on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1348699...
Hm, if I understand correctly the dwarves change is a workaround, whereas my patch is fixing the root cause. If it's working with the dwarves change then I think it should be fine to merge this MR.
From: Josh Poimboeuf on gitlab.com https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1352294...
After more upstream discussion, the dwarves workaround looks good enough. I still have an upstream patch under review but it doesn't need to block this MR.
kernel@lists.fedoraproject.org