Rebase policy for linux-firmware
by Jóhann B. Guðmundsson
Hi
Looking into koji for linux firmware I see
linux-firmware-20130724-30.git31f6b30.fc20
linux-firmware-20130724-29.git31f6b30.fc19
linux-firmware-20130724-0.3.git31f6b30.fc18
and my question are these
Do we have a firm rebase policy for linux-firmware?
as well as
can we adapt the release numeric scheme we use in the kernel?
( as in something like... )
linux-firmware-20130724-300.fc20
linux-firmware-20130724-200.fc19
linux-firmware-20130724-100.fc18
JBG
10 years, 7 months
3.11.0-200.fc19.x86_64: modprobe partly ignored?
by Reindl Harald
Hi
3.11.0-200.fc19.x86_64 as VMware guest and "lsmod" says
ata_generic 12910 0
pata_acpi 13038 0
why is the modprobe-config suddenly ignored for these
two modules? all disks are pvscsi, no ATA at all
[root@testserver:~]$ cat /etc/modprobe.d/blacklist-lounge-vm.conf
blacklist kvm _
blacklist kvm_intel
blacklist kvm_amd
blacklist coretemp
blacklist microcode
blacklist i2c_core
blacklist vmwgfx
blacklist ttm
blacklist drm
blacklist mperf
blacklist acpi_cpufreq
blacklist pata_acpi
blacklist ata_generic
blacklist serio_raw
install kvm /usr/bin/true
install kvm_intel /usr/bin/true
install kvm_amd /usr/bin/true
install coretemp /usr/bin/true
install microcode /usr/bin/true
install i2c_core /usr/bin/true
install vmwgfx /usr/bin/true
install ttm /usr/bin/true
install drm /usr/bin/true
install mperf /usr/bin/true
install acpi_cpufreq /usr/bin/true
install pata_acpi /usr/bin/true
install ata_generic /usr/bin/true
install serio_raw /usr/bin/true
10 years, 7 months
[Fedora kexec-tools 0/7] Support kernel signature verification
by Vivek Goyal
This patch series modifies kexec-tools to support kernel signature verification
when running kernel has secureboot or secure modules enabled.
Thanks
Vivek
Vivek Goyal (7):
kexec: x86: struct x86_linux_param_header should be packed
kexec: Remount /proc and /sys in private mount namespace
kexec: Verifiy kernel signature if secureboot/secure modules is
enabled
kexec: Provide a configure option --enable-static
kexec: Provide option to enable signature checking logic
kexec: Set secureboot info in bootparams
kexec: Pass acpi_rsdp info in bootparams
configure.ac | 18 +++
include/x86/x86-linux.h | 9 +-
kexec/arch/i386/x86-linux-setup.c | 27 ++++
kexec/integrity-digsig.h | 26 ++++
kexec/kexec.c | 305 ++++++++++++++++++++++++++++++++++++++
kexec/kexec.h | 2 +
6 files changed, 384 insertions(+), 3 deletions(-)
create mode 100644 kexec/integrity-digsig.h
--
1.8.3.1
10 years, 7 months
Fedora Kernel Meeting Minutes 09-06-2013
by Justin Forbes
=======================
#fedora-meeting: kernel
=======================
Meeting started by jforbes at 18:01:11 UTC. The full logs are available
at
http://meetbot.fedoraproject.org/fedora-meeting/2013-09-06/fedora-meeting...
.
Meeting summary
---------------
* who's here? (jforbes, 18:01:30)
* F18/F19 (jforbes, 18:02:14)
* F19 will get 3.10.11 before a rebase to 3.11 kernels (jforbes,
18:06:30)
* F18 will get a 3.11 rebase shortly after F19 (a week or so)
(jforbes, 18:07:12)
* F20 (jforbes, 18:08:36)
* rawhide (jforbes, 18:11:25)
* coverity/trinity/upstream (jforbes, 18:16:00)
* Testing (jforbes, 18:21:39)
* open floor (jforbes, 18:27:26)
* F20 should remain on 3.11.x until release (jforbes, 18:28:40)
* September 20 meeting cancelled as 2/3 of the kernel team will be at
LPC (jforbes, 18:29:45)
Meeting ended at 18:30:45 UTC.
Action Items
------------
Action Items, by person
-----------------------
* **UNASSIGNED**
* (none)
People Present (lines said)
---------------------------
* jforbes (36)
* jwb (28)
* davej (20)
* brunowolff (3)
* nirik (2)
* zodbot (2)
Generated by `MeetBot`_ 0.1.4
.. _`MeetBot`: http://wiki.debian.org/MeetBot
10 years, 7 months
[RFC] [ima-evm-utils 0/5] evmctl: Sign using daemon and secureboot related enhancement
by Vivek Goyal
Hi,
This is an RFC patch series to get early feedback on stuff I am working
on.
This series does few things.
- Adds an extra structure to ima signature (security.ima) which will signal
the elf loader that this executable needs to be locked. This will be
useful for secureboot where signed /sbin/kexec needs to run memory
locked.
I have posted RFC kernel patches on Fedora kernel mailing list.
https://lists.fedoraproject.org/pipermail/kernel/2013-September/004432.html
kexec-tools patches are posted here.
https://lists.fedoraproject.org/pipermail/kernel/2013-September/004469.html
- Add a functionality to import signatures signed externally. (Patch 2)
- Add functionality to allow signing using external crypto card. (Patch 3)
- Add a functionality to create a daemon which cilents can connect to
and request file signing (Patch 4 and Patch 5).
All the signing enhancements I need so that various build servers can
make use of it to sign /sbin/kexec and bzImage using appropriate keys.
This is still a work in progress and code is very raw. I wanted to get
the code out to get early feedback.
Thanks
Vivek
Vivek Goyal (5):
evmctl: Allow adding a memlock information in security.ima
evmctl: Allow importing external signature
evmctl: Allow signing using external crypto engine
evmctl-allow-launching-daemon
evmctl-client: A simple client to request signing from evmctl daemon
configure.ac | 1 +
src/Makefile.am | 9 +-
src/client.c | 697 +++++++++++++++++++++++++++++++++
src/daemon.h | 83 ++++
src/evmctl.c | 1166 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-
5 files changed, 1934 insertions(+), 22 deletions(-)
create mode 100644 src/client.c
create mode 100644 src/daemon.h
--
1.8.3.1
10 years, 7 months
[Fedora 00/19] kernel: Enable Kdump with secureboot/secure modules
by Vivek Goyal
Enabling secureboot or secure modules disable loading kexec kernel. This
also disables kdump feature.
These kernel patches add infrastructure which should allow signing /sbin/kexec
and extend trust chain to user space and allowing loading kernel securly.
I have put some details of problems and solution here.
http://people.redhat.com/vgoyal/kdump-secureboot/kdump-secureboot-summary...
https://fedoraproject.org/wiki/Changes/Kdump_with_secureboot
There are other changes for kexec-tools and ima-evm-utils. Those will be
posted separately little later.
Please review.
Thanks
Vivek
Vivek Goyal (19):
system_keyring: Make keyring searchable for root
mm: vm_brk(), align the length to page boundary
integrity: Add a function to determine digital signature length
ima: Allow adding more memory locking metadata after digital signature
v2
integrity: Allow digital signature verification with a given keyring
ptr
integrity-export-a-function-to-retrieve-hash-alog-from-digsig
export-ima-function-to-verify-integrity
mm: Define a task flag MMF_VM_LOCKED for memlocked tasks and don't
allow munlock
binfmt_elf: Elf executable signature verification
ima: define functions to appraise memory buffer contents
keyctl: Introduce a new operation KEYCTL_VERIFY_SIGNATURE
ptrace: Do not allow ptrace() from unsigned process to signed one
binfmt_elf: Do not mark process signed if binary has elf interpreter
kexec: Allow only signed processes to call sys_kexec() in secureboot
mode
kexec: Export sysfs attributes for secureboot and secure modules to
user space
kexec: Remove the loading restrictions of secure_modules() now
bootparam: Pass acpi_rsdp pointer in bootparam
modsign_uefi: Do not load uefi certs in kdump kernel
keys: Chagne default lookup method for key type asymmetric
arch/x86/include/uapi/asm/bootparam.h | 3 +-
arch/x86/kernel/acpi/boot.c | 5 +
crypto/asymmetric_keys/asymmetric_type.c | 1 +
drivers/acpi/osl.c | 10 ++
fs/Kconfig.binfmt | 13 +++
fs/binfmt_elf.c | 103 +++++++++++++++++-
include/linux/acpi.h | 1 +
include/linux/compat.h | 4 +-
include/linux/cred.h | 2 +
include/linux/ima.h | 27 +++++
include/linux/integrity.h | 19 ++++
include/linux/sched.h | 2 +
include/linux/syscalls.h | 3 +-
include/uapi/linux/keyctl.h | 16 +++
kernel/cred.c | 2 +
kernel/kexec.c | 32 ++++--
kernel/ksysfs.c | 20 ++++
kernel/modsign_uefi.c | 9 ++
kernel/system_keyring.c | 2 +-
mm/mlock.c | 6 ++
mm/mmap.c | 8 +-
security/commoncap.c | 11 ++
security/integrity/digsig.c | 180 +++++++++++++++++++++++++++++--
security/integrity/digsig_asymmetric.c | 18 +---
security/integrity/ima/ima_api.c | 51 +++++++++
security/integrity/ima/ima_appraise.c | 131 +++++++++++++++++++++-
security/integrity/integrity.h | 35 ++++--
security/keys/compat.c | 31 +++++-
security/keys/internal.h | 2 +
security/keys/keyctl.c | 83 +++++++++++++-
30 files changed, 779 insertions(+), 51 deletions(-)
--
1.8.3.1
10 years, 7 months
[ANNOUNCE] Make RPMs from upstream kernel easy
by Igor Gnatenko
Hi folks!
Let me present utility for create RPMs from any state of Linus git tree.
In future I've planned to support linux-stable git tree. kernel-package
should to simplify kernel-bisecting, testing patches, testing latest
upstream kernels, etc.
How it works:
1. Download latest Fedora kernel.spec and configs into sources/ dir.
If you have custom "config-local" in this directory utility will not
download it.
2. Parse kernel.spec, replace needed variables, etc.
3. Archive latest stable (for compliance w/ kernel-maint)
4. Make patch from stable to current commit
(for compliance w/ kernel-maint)
5. Put all needed sources for build srpm to sources/ dir.
Now I work at:
1. automation make srpm, rpm
2. support linux-stable git tree
3. support automatically add user-patches from sources/ directory
Please feel free to test, write bugreports, patches, etc. to my utility.
How to use it you can find in README at my git repo[0].
[0]https://github.com/ignatenkobrain/kernel-package
Kernel maintainers, please fix me if I do wrong.
Thanks all.
--
Igor Gnatenko
Fedora release 19 (Schrödinger’s Cat)
Linux 3.11.0-0.rc7.git0.1.fc19.x86_64
10 years, 7 months