From: Miko Larsson <mikoxyzzz(a)gmail.com>
redhat/configs: Strong stack protector for fedora
ark has had the strong stack protector enabled since at least three
years ago without any issues. Might as well enable it for fedora too for
the improved stack protection by moving CONFIG_STACKPROTECTOR_STRONG
(and CONFIG_STACKPROTECTOR for good measure) into the common config dir.
Signed-off-by: Miko Larsson <mikoxyzzz(a)gmail.com>
diff --git a/redhat/configs/ark/generic/CONFIG_STACKPROTECTOR b/redhat/configs/common/generic/CONFIG_STACKPROTECTOR
rename from redhat/configs/ark/generic/CONFIG_STACKPROTECTOR
rename to redhat/configs/common/generic/CONFIG_STACKPROTECTOR
index blahblah..blahblah 100644
--- a/redhat/configs/ark/generic/CONFIG_STACKPROTECTOR
+++ b/redhat/configs/common/generic/CONFIG_STACKPROTECTOR
diff --git a/redhat/configs/ark/generic/CONFIG_STACKPROTECTOR_STRONG b/redhat/configs/common/generic/CONFIG_STACKPROTECTOR_STRONG
rename from redhat/configs/ark/generic/CONFIG_STACKPROTECTOR_STRONG
rename to redhat/configs/common/generic/CONFIG_STACKPROTECTOR_STRONG
index blahblah..blahblah 100644
--- a/redhat/configs/ark/generic/CONFIG_STACKPROTECTOR_STRONG
+++ b/redhat/configs/common/generic/CONFIG_STACKPROTECTOR_STRONG
diff --git a/redhat/configs/fedora/generic/CONFIG_STACKPROTECTOR_STRONG b/redhat/configs/fedora/generic/CONFIG_STACKPROTECTOR_STRONG
deleted file mode 100644
index blahblah..blahblah 0
--- a/redhat/configs/fedora/generic/CONFIG_STACKPROTECTOR_STRONG
+++ /dev/null
@@ -1 +0,0 @@
-# CONFIG_STACKPROTECTOR_STRONG is not set
diff --git a/redhat/configs/fedora/generic/powerpc/CONFIG_STACKPROTECTOR b/redhat/configs/fedora/generic/powerpc/CONFIG_STACKPROTECTOR
deleted file mode 100644
index blahblah..blahblah 0
--- a/redhat/configs/fedora/generic/powerpc/CONFIG_STACKPROTECTOR
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_STACKPROTECTOR=y
diff --git a/redhat/configs/fedora/generic/x86/CONFIG_STACKPROTECTOR b/redhat/configs/fedora/generic/x86/CONFIG_STACKPROTECTOR
deleted file mode 100644
index blahblah..blahblah 0
--- a/redhat/configs/fedora/generic/x86/CONFIG_STACKPROTECTOR
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_STACKPROTECTOR=y
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2269
From: pbrobinson on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2268
NOTE: Truncated patchset due to missing public @redhat.com email
address on your GitLab profile at https://gitlab.com/-/profile.
Once that is fixed, close and reopen the merge request to
retrigger sending the emails.
It's enabled on all other Fedora architectures and there's
no reason arm architectures should be any different here.
It was likely an oversight. Minor config cleanup while at it.
Signed-off-by: Peter Robinson <pbrobinson(a)redhat.com>
---
redhat/configs/fedora/generic/arm/armv7/CONFIG_STACKPROTECTOR_PER_TASK | 1 +
redhat/configs/fedora/generic/arm/CONFIG_STACKPROTECTOR | 1 -
redhat/configs/fedora/generic/x86/CONFIG_STACKPROTECTOR | 1 -
redhat/configs/fedora/generic/powerpc/CONFIG_STACKPROTECTOR => redhat/configs/fedora/generic/CONFIG_STACKPROTECTOR | 0
redhat/configs/fedora/generic/CONFIG_STACKPROTECTOR_STRONG | 2 +-
5 files changed, 2 insertions(+), 3 deletions(-)
From: pbrobinson on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2268
NOTE: Truncated patchset due to missing public @redhat.com email
address on your GitLab profile at https://gitlab.com/-/profile.
Once that is fixed, close and reopen the merge request to
retrigger sending the emails.
It's enabled on all other Fedora architectures and there's
no reason arm architectures should be any different here.
It was likely an oversight. Minor config cleanup while at it.
Signed-off-by: Peter Robinson <pbrobinson(a)redhat.com>
---
redhat/configs/fedora/generic/arm/CONFIG_STACKPROTECTOR | 1 -
redhat/configs/fedora/generic/x86/CONFIG_STACKPROTECTOR | 1 -
redhat/configs/fedora/generic/powerpc/CONFIG_STACKPROTECTOR => redhat/configs/fedora/generic/CONFIG_STACKPROTECTOR | 0
redhat/configs/fedora/generic/CONFIG_STACKPROTECTOR_STRONG | 2 +-
4 files changed, 1 insertions(+), 3 deletions(-)
From: Don Zickus <dzickus(a)redhat.com>
Revert "redhat: fix elf got hardening for vm tools"
This reverts commit eb5aebd77015bc57616c5d05a7b6206c8ff871cb.
A recent rework of the tools/vm area relies on a proper CFLAGS
definition to include the proper header files. The kernel.spec file
purposely overwrites the CFLAGS to get the right switches to pass
rpminspect. As a consequence tools/vm fails to compile.
For now just revert the change and await a proper fix.
To duplicate:
cd tools/vm
make CFLAGS= slabinfo page_owner_sort
make -C ../lib/api
make[1]: Entering directory
'/home/dzickus/devel/git/kernel-ark/tools/lib/api'
/usr/bin/make -C /home/dzickus/devel/git/kernel-ark/tools/build CFLAGS= LDFLAGS= fixdep
CC fd/array.o
LD fd/libapi-in.o
CC fs/fs.o
fs/fs.c:17:10: fatal error: debug-internal.h: No such file or directory
17 | #include "debug-internal.h"
| ^~~~~~~~~~~~~~~~~~
compilation terminated.
make[3]: *** [/home/dzickus/devel/git/kernel-ark/tools/build/Makefile.build:97: fs/fs.o] Error 1
make[2]: *** [/home/dzickus/devel/git/kernel-ark/tools/build/Makefile.build:139: fs] Error 2
make[1]: *** [Makefile:79: libapi-in.o] Error 2
make[1]: Leaving directory
'/home/dzickus/devel/git/kernel-ark/tools/lib/api'
make: *** [Makefile:19: ../lib/api/libapi.a] Error 2
Signed-off-by: Don Zickus <dzickus(a)redhat.com>
diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template
index blahblah..blahblah 100755
--- a/redhat/kernel.spec.template
+++ b/redhat/kernel.spec.template
@@ -2340,7 +2340,7 @@ pushd tools/gpio/
popd
# build VM tools
pushd tools/vm/
-%{tools_make} CFLAGS="${RPM_OPT_FLAGS}" LDFLAGS="%{__global_ldflags}" slabinfo page_owner_sort
+%{tools_make} slabinfo page_owner_sort
popd
pushd tools/tracing/rtla
%{tools_make}
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2236
From: Mark Salter <msalter(a)redhat.com>
redhat/configs: Turn on CONFIG_SPI_TEGRA210_QUAD for RHEL
Delete current comfig from ark and move fedora config to
common.
Signed-off-by: Mark Salter <msalter(a)redhat.com>
diff --git a/redhat/configs/ark/generic/arm/aarch64/CONFIG_SPI_TEGRA210_QUAD b/redhat/configs/ark/generic/arm/aarch64/CONFIG_SPI_TEGRA210_QUAD
deleted file mode 100644
index blahblah..blahblah 0
--- a/redhat/configs/ark/generic/arm/aarch64/CONFIG_SPI_TEGRA210_QUAD
+++ /dev/null
@@ -1 +0,0 @@
-# CONFIG_SPI_TEGRA210_QUAD is not set
diff --git a/redhat/configs/fedora/generic/arm/CONFIG_SPI_TEGRA210_QUAD b/redhat/configs/common/generic/arm/CONFIG_SPI_TEGRA210_QUAD
rename from redhat/configs/fedora/generic/arm/CONFIG_SPI_TEGRA210_QUAD
rename to redhat/configs/common/generic/arm/CONFIG_SPI_TEGRA210_QUAD
index blahblah..blahblah 100644
--- a/redhat/configs/fedora/generic/arm/CONFIG_SPI_TEGRA210_QUAD
+++ b/redhat/configs/common/generic/arm/CONFIG_SPI_TEGRA210_QUAD
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2266
From: Scott Weaver <scweaver(a)redhat.com>
kernel.spec: add llvm-devel build requirement
The bpftool and the llvm system feature check requires the llvm-devel
package. The bpftool package is only created if selftests is defined and
when selftests is enabled, then samples/bpf will be built which will use
the llvm feature check. Therefore the llvm-devel package is added as a
build requirement of selftests to keep it consistent with the llvm
package already specified there.
This change came in eb9d1acf634ba ('bpftool: Add LLVM as default
library for disassembling JIT-ed programs').
Signed-off-by: Scott Weaver <scweaver(a)redhat.com>
diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template
index blahblah..blahblah 100755
--- a/redhat/kernel.spec.template
+++ b/redhat/kernel.spec.template
@@ -635,7 +635,7 @@ BuildRequires: python3-docutils
BuildRequires: zlib-devel binutils-devel
%endif
%if %{with_selftests}
-BuildRequires: clang llvm fuse-devel
+BuildRequires: clang llvm llvm-devel fuse-devel
%ifnarch %{arm}
BuildRequires: numactl-devel
%endif
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2264
Hi, we tested your kernel and here are the results:
Overall result: FAILED
Merge: OK
Compile: OK
Test: FAILED
Kernel information:
Brew / Koji Task ID: 96628555
You can find all the details about the test run at
https://datawarehouse.cki-project.org/kcidb/checkouts/66965
One or more kernel tests failed:
Unrecognized or new issues:
aarch64 - Boot test
Logs: https://datawarehouse.cki-project.org/kcidb/tests/6807697
We also see the following known issues which are not related to your changes:
Issue: NFS Connectathon: SELinux prevents rpcbind
URL: https://gitlab.com/redhat/centos-stream/tests/kernel/kernel-tests/-/issues/…
Affected tests:
aarch64 - NFS Connectathon
ppc64le - NFS Connectathon
x86_64 - NFS Connectathon
Issue: Storage blktests - blk: scsi/007: Reading from scsi_debug failed
URL: https://bugzilla.redhat.com/show_bug.cgi?id=2027550
Affected tests:
s390x - Storage - blktests - blk
If you find a failure unrelated to your changes, please ask the test maintainer to review it.
This will prevent the failures from being incorrectly reported in the future.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
From: Scott Weaver <scweaver(a)redhat.com>
kernel.spec: add llvm-devel build requirement
The bpftool and selftests feature check requires the llvm-devel package
as well as the bpftool itself (if llvm is available). The bpftool
package is only created if selftests is defined, therefore the
llvm-devel package is added as a build requirement of selftests to keep
it consistent with the llvm package already specified.
This change came in eb9d1acf634ba ('bpftool: Add LLVM as default
library for disassembling JIT-ed programs').
Signed-off-by: Scott Weaver <scweaver(a)redhat.com>
diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template
index blahblah..blahblah 100755
--- a/redhat/kernel.spec.template
+++ b/redhat/kernel.spec.template
@@ -635,7 +635,7 @@ BuildRequires: python3-docutils
BuildRequires: zlib-devel binutils-devel
%endif
%if %{with_selftests}
-BuildRequires: clang llvm fuse-devel
+BuildRequires: clang llvm llvm-devel fuse-devel
%ifnarch %{arm}
BuildRequires: numactl-devel
%endif
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2264
From: Vitaly Kuznetsov <vkuznets(a)redhat.com>
redhat: Add sub-RPM with a EFI unified kernel image for virtual machines
The new 'kernel-unified-virt' sub-RPM is added on x86_64 targets.
This contains an EFI application that provides a combined vmlinux,
initrd and cmdline, as a so called 'unified kernel image'. The
spec for this is defined by the boot loader specification
https://uapi-group.org/specifications/specs/boot_loader_specification/
The key benefit of a unified kernel is that its secure boot
signature covers the initrd and cmdline contents, allowing
a trustworthy measured boot process with attestation, which
is not practical with locally generated initrds/cmdlines.
Since the initrd is pre-generated its contents have to be
very generic, to be usable on a wide variety of deployments.
To make this problem tractable, the sub-RPM targets only
usage in virtual machines. With such a restriction, the
initrd only needs a very small set of block driver modules
present, in order to be usable across KVM, Hyper-V and Xen
hypervisors which will cover essentially all common public
and private clouds.
Similarly the kernel cmdline cannot contain any host specific
data, which means the root filesystem to mount needs to be
able to be automatically detected. A virtual machine image
intending to use this unified kernel package thus needs to
comply with the discoverable partitions specification:
https://uapi-group.org/specifications/specs/discoverable_partitions_specifi…
Based-on-patch-by: Daniel P. Berrangé <berrange(a)redhat.com>
Based-on-patch-by: Gerd Hoffmann <kraxel(a)redhat.com>
Signed-off-by: Vitaly Kuznetsov <vkuznets(a)redhat.com>
diff --git a/redhat/Makefile b/redhat/Makefile
index blahblah..blahblah 100644
--- a/redhat/Makefile
+++ b/redhat/Makefile
@@ -639,6 +639,7 @@ sources-rh: $(TARBALL) generate-testpatch-tmp setup-source dist-configs-check
../Makefile.rhelver \
README.rst \
kernel-local \
+ dracut-virt.conf \
$(SOURCES)/
@if [ "$(RELEASED_KERNEL)" -ne 0 ]; then \
cp keys/redhatsecureboot{301,501,ca5,ca1}.cer $(SOURCES)/; \
diff --git a/redhat/dracut-virt.conf b/redhat/dracut-virt.conf
new file mode 100644
index blahblah..blahblah 100644
--- /dev/null
+++ b/redhat/dracut-virt.conf
@@ -0,0 +1,35 @@
+# generic + compressed please
+hostonly="no"
+compress="xz"
+
+# VMs can't update microcode anyway
+early_microcode="no"
+
+# modules: basics
+dracutmodules+=" base systemd systemd-initrd dracut-systemd dbus dbus-broker usrmount shutdown "
+
+# modules: storage support
+dracutmodules+=" dm lvm rootfs-block fs-lib "
+
+# modules: tpm and crypto
+dracutmodules+=" crypt crypt-loop tpm2-tss "
+
+# drivers: virtual buses, pci
+drivers+=" virtio-pci virtio-mmio " # qemu-kvm
+drivers+=" hv-vmbus pci-hyperv " # hyperv
+drivers+=" xen-pcifront " # xen
+
+# drivers: storage
+drivers+=" ahci nvme scsi-hd scsi-cd " # generic
+drivers+=" virtio-blk virtio-scsi " # qemu-kvm
+drivers+=" hv-storvsc sd_mod " # hyperv
+drivers+=" xen-blkfront " # xen
+
+# root encryption
+drivers+=" dm_crypt "
+
+# filesystems
+filesystems+=" vfat ext4 xfs overlay "
+
+# systemd-pcrphase
+install_items+=" /lib/systemd/system/systemd-pcrphase-initrd.service /usr/lib/systemd/systemd-pcrphase /usr/lib/systemd/system/initrd.target.wants/systemd-pcrphase-initrd.service "
diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template
index blahblah..blahblah 100755
--- a/redhat/kernel.spec.template
+++ b/redhat/kernel.spec.template
@@ -91,6 +91,12 @@ Summary: The Linux kernel
%global zipmodules 1
%endif
+%ifarch x86_64
+%global efiuki 1
+%else
+%global efiuki 0
+%endif
+
%if %{zipmodules}
%global zipsed -e 's/\.ko$/\.ko.xz/'
%endif
@@ -699,6 +705,21 @@ BuildRequires: llvm
BuildRequires: lld
%endif
+%if %{efiuki}
+BuildRequires: dracut
+# For dracut UEFI uki binaries
+BuildRequires: binutils
+# For the initrd
+BuildRequires: lvm2
+%if 0%{?fedora} > 37
+BuildRequires: systemd-boot-unsigned
+%endif
+# For systemd-stub and systemd-pcrphase
+BuildRequires: systemd-udev >= 252-1
+# For TPM operations in UKI initramfs
+BuildRequires: tpm2-tools
+%endif
+
# Because this is the kernel, it's hard to get a single upstream URL
# to represent the base without needing to do a bunch of patching. This
# tarball is generated from a src-git tree. If you want to see the
@@ -826,6 +847,8 @@ Source82: update_scripts.sh
Source84: mod-internal.list
Source85: mod-partner.list
+Source86: dracut-virt.conf
+
Source100: rheldup3.x509
Source101: rhelkpatch1.x509
@@ -1331,6 +1354,13 @@ Requires: kernel-%{?1:%{1}-}-modules-core-uname-r = %{KVERREL}%{?1:+%{1}}\
%endif\
%{expand:%%kernel_debuginfo_package %{?1:%{1}}}\
%endif\
+%if %{efiuki}\
+%package %{?1:%{1}-}uki-virt\
+Summary: %{variant_summary} unified kernel image for virtual machines\
+Provides: installonlypkg(kernel)\
+Provides: kernel-%{?1:%{1}-}uname-r = %{KVERREL}%{?1:+%{1}}\
+Requires: kernel%{?1:-%{1}}-modules-core-uname-r = %{KVERREL}%{?1:+%{1}}\
+%endif\
%{nil}
#
@@ -1400,6 +1430,14 @@ Linux operating system. The kernel handles the basic functions
of the operating system: memory allocation, process allocation, device
input and output, etc.
+%if %{efiuki}
+%description debug-uki-virt
+Prebuilt debug unified kernel image for virtual machines.
+
+%description uki-virt
+Prebuilt default unified kernel image for virtual machines.
+%endif
+
%if %{with_ipaclones}
%kernel_ipaclones_package
%endif
@@ -2180,6 +2218,45 @@ BuildKernel() {
touch lib/modules/$KernelVer/modules.builtin
fi
+%if %{efiuki}
+ popd
+
+ KernelUnifiedImageDir="$RPM_BUILD_ROOT/lib/modules/$KernelVer"
+ KernelUnifiedImage="$KernelUnifiedImageDir/$InstallName-virt.efi"
+
+ mkdir -p $KernelUnifiedImageDir
+
+ dracut --conf=%{SOURCE86} \
+ --confdir=$(mktemp -d) \
+ --verbose \
+ --kver "$KernelVer" \
+ --kmoddir "$RPM_BUILD_ROOT/lib/modules/$KernelVer/" \
+ --logfile=$(mktemp) \
+ --uefi \
+ --kernel-image $(realpath $KernelImage) \
+ --kernel-cmdline 'console=tty0 console=ttyS0' \
+ $KernelUnifiedImage
+
+%if %{signkernel}
+
+ %pesign -s -i $KernelUnifiedImage -o $KernelUnifiedImage.tmp -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0}
+ %pesign -s -i $KernelUnifiedImage.tmp -o $KernelUnifiedImage.signed -a %{secureboot_ca_1} -c %{secureboot_key_1} -n %{pesign_name_1}
+ rm -f $KernelUnifiedImage.tmp
+
+ if [ ! -s $KernelUnifiedImage.signed ]; then
+ echo "pesigning failed"
+ exit 1
+ fi
+ mv $KernelUnifiedImage.signed $KernelUnifiedImage
+
+# signkernel
+%endif
+
+ pushd $RPM_BUILD_ROOT
+
+# efiuki
+%endif
+
remove_depmod_files
# Go back and find all of the various directories in the tree. We use this
@@ -2873,12 +2950,14 @@ fi\
# It also defines a %%postun script that does the same thing.
# %%kernel_modules_core_post [<subpackage>]
#
+# FIXME: /bin/kernel-install can't handle UKIs (yet), so cleanup depmod files in %postun for now.
+#
%define kernel_modules_core_post() \
%{expand:%%posttrans %{?1:%{1}-}modules-core}\
/sbin/depmod -a %{KVERREL}%{?1:+%{1}}\
%{nil}\
%{expand:%%postun %{?1:%{1}-}modules-core}\
-/sbin/depmod -a %{KVERREL}%{?1:+%{1}}\
+rm -f /lib/modules/%{KVERREL}%{?1:+%{1}}/modules.*\
%{nil}
# This macro defines a %%posttrans script for a kernel package.
@@ -2926,6 +3005,20 @@ mkdir -p %{_localstatedir}/lib/rpm-state/%{name}\
touch %{_localstatedir}/lib/rpm-state/%{name}/installing_core_%{KVERREL}%{?-v:+%{-v*}}\
%{nil}
+#
+# This macro defines scripts for a kernel*-uki-virt package
+#
+# FIXME: /bin/kernel-install can't handle UKIs (yet), so just cp/rm as temporary stop-gap
+#
+%define kernel_uki_virt_scripts() \
+%{expand:%%posttrans %{?1:%{1}-}uki-virt}\
+mkdir -p /boot/efi/EFI/Linux\
+cp /lib/modules/%{KVERREL}%{?1:+%{1}}/vmlinuz-virt.efi /boot/efi/EFI/Linux/vmlinuz-%{KVERREL}%{?1:+%{1}}-virt.efi\
+%{nil}\
+%{expand:%%postun %{?1:%{1}-}uki-virt}\
+rm -f /boot/efi/EFI/Linux/vmlinuz-%{KVERREL}%{?1:+%{1}}-virt.efi\
+%{nil}
+
#
# This macro defines a %%preun script for a kernel package.
# %%kernel_variant_preun <subpackage>
@@ -2939,6 +3032,10 @@ then\
fi\
%{nil}
+%if %{efiuki}
+%kernel_uki_virt_scripts
+%endif
+
%kernel_variant_preun
%kernel_variant_post -r kernel-smp
@@ -2948,6 +3045,9 @@ fi\
%endif
%if %{with_debug}
+%if %{efiuki}
+%kernel_uki_virt_scripts debug
+%endif
%kernel_variant_preun debug
%kernel_variant_post -v debug
%endif
@@ -3188,6 +3288,11 @@ fi
%{expand:%%files -f debuginfo%{?3}.list %{?3:%{3}-}debuginfo}\
%endif\
%endif\
+%if %{efiuki}\
+%{expand:%%files %{?3:%{3}-}uki-virt}\
+/lib/modules/%{KVERREL}%{?3:+%{3}}/%{?-k:%{-k*}}%{!?-k:vmlinuz}-virt.efi\
+%ghost /%{image_install_path}/efi/EFI/Linux/%{?-k:%{-k*}}%{!?-k:vmlinuz}-%{KVERREL}%{?3:+%{3}}-virt.efi\
+%endif\
%if %{?3:1} %{!?3:0}\
%{expand:%%files %{3}}\
%endif\
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2175
From: Justin M. Forbes on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2263
For many years, rawhide kernels have forced users to run debug builds on
git snapshots by not building a non debug kernel as an option. While
this has served us well, in finding occasional bugs that are less likely
to surface otherwise, the performance of debug kernels has gotten
considerably worse over time. After evaluating the debug configs to see
if performance could be improved, it has become clear that we would have
to trade off too much to regain performance. We would be better served
by leaving more debug options enabled and offering a non debug kernel
for all users on all builds.
Signed-off-by: Justin M. Forbes <jforbes(a)fedoraproject.org>
---
redhat/scripts/genspec/genspec.sh | 13 +++++--------
redhat/kernel.spec.template | 4 ++--
2 files changed, 7 insertions(+), 10 deletions(-)