From: Herbert Xu on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2757
Upstream Status: RHEL only
Restore the changes to /dev/random which were reverted after 5.18.
This reverts commit 900f11e054896bae7b0146055698656e3d1e20a6 and
297bcb88233101e8d5062729ff3a5f989bad1c3b.
This also brings the code up-to-date with respect to centos-stream
commit 9de3a7339793d3c516b9305a8854267156f90c53 so that changes that
were made after the kernel-ark revert have been brought in.
Signed-off-by: Herbert Xu <herbert.xu(a)redhat.com>
---
crypto/drbg.c | 18 ++++-
crypto/rng.c | 149 +++++++++++++++++++++++++++++++++++++++++++-----
drivers/char/random.c | 122 ++++++++++++++++++++++++++++++++++++++++
include/linux/crypto.h | 1 +
include/linux/random.h | 10 +++
5 files changed, 281 insertions(+), 19 deletions(-)
From: Herbert Xu on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1304
NOTE: Truncated patchset since committer email 'herbert(a)gondor.apana.org.au'
does not match the submitter's GitLab public email address
'herbert.xu(a)redhat.com'.
Upstream: RHEL only
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1984784
The RHEL FIPS certification effort ran into an show-stopper with
/dev/urandom and getrandom(2) not being FIPS-compliant. At this
point there is no realistic chance of making them FIPS-compliant
upstream. It has also been deemed unrealistic to change user-space
to use the FIPS-compliant RNG through the Crypto API.
Therefore this patch series overrides /dev/*random as well as
getrandom(2) with the Crypto API RNG so that FIPS certification
can proceed.
Signed-off-by: Herbert Xu <herbert.xu(a)redhat.com>
---
crypto/rng.c | 73 ++++++++++++++++++++++++++++++-
drivers/char/random.c | 115 +++++++++++++++++++++++++++++++++++++++++++++++++
include/linux/random.h | 7 ++
3 files changed, 194 insertions(+), 1 deletions(-)
From: Don Zickus <dzickus(a)redhat.com>
Add wildcard macros -baseonly -gcov
There are multiple usecases for -baseonly and -gcov on various
targets in the Makefile. Instead of calling those targets out
repeatedly, lets generalize them a bit.
Allow adding -baseonly and -gcov to:
dist-rpm
dist-srpm
dist-brew
dist-koji
distg-brew
distg-koji
Gcov is useful for adding code coverage. Baseonly is useful to only
build the kernel for debugging purposes without userspace tools.
Signed-off-by: Don Zickus <dzickus(a)redhat.com>
diff --git a/redhat/Makefile b/redhat/Makefile
index blahblah..blahblah 100644
--- a/redhat/Makefile
+++ b/redhat/Makefile
@@ -297,6 +297,12 @@ dist-sources: dist-kabi dist-kabi-dup sources-rh
dist-test-patch: generate-testpatch-tmp
@mv $(TESTPATCH).tmp $(TESTPATCH);
+%-baseonly: RPMBUILDOPTS=--target $(MACH) --without debug --without debuginfo --without vdso_install --without bpftool --without perf --without tools --without selftests -bb
+%-baseonly: BUILDOPTS+=-debug -debuginfo -vdso_install -bpftool -perf -tools -selftests
+
+%-gcov: BUILDID=".gcov"
+%-gcov: BUILDOPTS+="+gcov"
+
do-rpmbuild: dist-sources
$(RPMBUILD) --define "_sourcedir $(SOURCES)" --define "_builddir $(RPM)/BUILD" --define "_srcrpmdir $(RPM)/SRPMS" --define "_rpmdir $(RPM)/RPMS" --define "_specdir $(RPM)/SPECS" --define "dist $(DIST)" $(RPMBUILDOPTS) $(RPM)/SOURCES/$(PACKAGE_NAME).spec
@@ -306,9 +312,9 @@ dist-all-rpms: dist-sources do-rpmbuild
dist-srpm: RPMBUILDOPTS=--nodeps -bs
dist-srpm: dist-sources do-rpmbuild
-dist-srpm-gcov: BUILDID=".gcov"
-dist-srpm-gcov: BUILDOPTS+="+gcov"
-dist-srpm-gcov: dist-srpm
+dist-srpm-%: dist-srpm
+ @# phony command to force this to be a target and not variable
+ @FOO=BAR
dist-rpms: RPMBUILDOPTS=--target $(MACH) -bb
dist-rpms: dist-sources do-rpmbuild
@@ -322,8 +328,7 @@ dist-prep: dist-sources do-rpmbuild
dist-perf: RPMBUILDOPTS=--without up --without smp --without zfcpdump --without debug --without doc --without headers --without --without doc --without debuginfo --target $(MACH) -bb
dist-perf: dist-sources do-rpmbuild
-dist-rpm-baseonly: RPMBUILDOPTS=--target $(MACH) --without debug --without debuginfo --without vdso_install --without bpftool --without perf --without tools -bb
-dist-rpm-baseonly: dist-sources do-rpmbuild
+dist-rpm-%: dist-sources do-rpmbuild
# unless you know what you're doing, you don't want to use the next four ones
dist-release-finish: setup-source
@@ -388,9 +393,25 @@ distg-koji: BUILD_FLAGS ?= $(KOJI_FLAGS) $(TEST_FLAGS)
dist-brew dist-koji: dist-%: dist-srpm
$* $(BUILD_PROFILE) build $(BUILD_FLAGS) $(BUILD_TARGET) $(SRPMS)/$(PACKAGE_NAME)-$(KVERSION)-$(PKGRELEASE)$(DIST).src.rpm $(OUTPUT_FILE)
+dist-brew-%: dist-brew
+ @# phony command to force this to be a target and not variable
+ @FOO=BAR
+
+dist-koji-%: dist-koji
+ @# phony command to force this to be a target and not variable
+ @FOO=BAR
+
distg-brew distg-koji: distg-%:
$* $(BUILD_PROFILE) build $(BUILD_FLAGS) $(BUILD_TARGET) "$(RHGITURL)?redhat/koji#$(RHGITCOMMIT)"
+distg-brew-%: dist-brew
+ @# phony command to force this to be a target and not variable
+ @FOO=BAR
+
+distg-koji-%: dist-koji
+ @# phony command to force this to be a target and not variable
+ @FOO=BAR
+
.PHONY: $(REDHAT)/rpm/SOURCES/$(PACKAGE_NAME).spec
$(REDHAT)/rpm/SOURCES/$(PACKAGE_NAME).spec:
@echo "dist-sources"
@@ -469,34 +490,30 @@ dist-full-help:
@echo 'Building targets:'
@echo ' All RPM/SRPM files will be put under the redhat/rpm/ directory.'
@echo ''
- @echo ' dist-srpm - Create a source RPM and put it into the redhat/rpm/SRPMS/'
+ @echo ' dist-srpm@ - Create a source RPM and put it into the redhat/rpm/SRPMS/'
@echo ' directory. See the dist-brew target for available options.'
- @echo ' dist-srpm-gcov - Create a source RPM with gcov enabled and put it into the'
- @echo ' redhat/rpm/SRPMS/ directory.'
- @echo ' dist-brew - Create a kernel SRPM and then call brew to build the'
+ @echo ' dist-brew@ - Create a kernel SRPM and then call brew to build the'
@echo ' created SRPM. Add BUILDOPTS="+<opt> -<opt> [...]" to'
@echo ' enable/disable build options.'
@echo ' Available <opt>s and their default values:' \
$$(sed -n -e 's/^%define with_\([^ \t]*\).*\?_without_.*/+\1/p' \
-e 's/^%define with_\([^ \t]*\).*\?_with_.*/-\1/p' kernel.spec.template | \
grep -v 'only$$') | fmt -80
- @echo ' dist-koji - Create a kernel SRPM and then call koji to build the'
+ @echo ' dist-koji@ - Create a kernel SRPM and then call koji to build the'
@echo ' created SRPM. See the dist-brew target for available'
@echo ' options.'
- @echo ' distg-brew - Pass HEAD of the current git branch to brew to build an'
+ @echo ' distg-brew@ - Pass HEAD of the current git branch to brew to build an'
@echo ' RPM set. Do not forget to push to the remote repository'
@echo ' first. Preceed make command by RHGITCOMMIT=<commitID>'
@echo ' specify commit ID to use.'
@echo ' To set the remote repo, invoke:'
@echo ' git config rhg.url git://<repo_path>'
- @echo ' distg-koji - Pass HEAD of the current git branch to koji to build an'
+ @echo ' distg-koji@ - Pass HEAD of the current git branch to koji to build an'
@echo ' RPM set. Do not forget to push to the remote repository'
@echo ' first. See the distg-brew target for options and'
@echo ' configuration.'
- @echo ' dist-rpms - Create the binary RPMS for the kernel.'
+ @echo ' dist-rpms@ - Create the binary RPMS for the kernel.'
@echo ' See the dist-brew target for available options.'
- @echo ' dist-rpm-baseonly - Create the binary RPMS for the kernel and modules'
- @echo ' (no userspace tools or debuginfo).'
@echo ' dist-kernel-<type> - Create binary RPMS for a particular kernel type.'
@echo ' Available <type>s:'\
$$(sed -n 's/^%define with_\([^ ]*only\).*/\1/p' kernel.spec.template)
@@ -524,6 +541,12 @@ dist-full-help:
@echo ' dist-rhel-configs - build ELN configs'
@echo ' dist-fedora-configs - build Fedora configs'
+ @echo ''
+ @echo 'Wildcard targets: [indicated by '@' above]'
+ @echo ' *-baseonly - builds only the kernel (disables userspace and debuginfo)'
+ @echo ' - Examples: dist-srpm-baseonly, dist-brew-baseonly'
+ @echo ' *-gcov - builds a kernel with gcov enabled'
+ @echo ' - Examples: dist-srpm-gcov, dist-brew-gcov'
@echo ''
@echo 'kABI targets:'
@echo ' dist-kabi - Create kABI stablelist files in redhat/kabi/kabi-rhel*/'
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1444
From: Don Zickus <dzickus(a)redhat.com>
Fix binutils breakage
The binutils package in Rawhide has stricter checks about PIE/PIC code
and will start reporting errors if it detects mixing and matching no-PIE
with PIE binaries (especially around bpf binaries).
Example errors look like:
/usr/bin/ld: /tmp/ccL7dkfR.o: relocation R_X86_64_32S against `.rodata'
can not be used when making a PIE object; recompile with -fPIE
/usr/bin/ld: failed to set dynamic section sizes: bad value
collect2: error: ld returned 1 exit status
Fix this by adding more CFLAGS to force PIE/PIC generated binaries to
bpf releated selftests, tools and samples.
This patch was provided by Carlos O'Donell and understands how it works.
I am just the middle man.
All -fPIE errors are resolved except for one about libbpf.a. The static
version of the library doesn't take CFLAGS so it can't be forced to
build with PIE/PIC. This error is ignored by the spec file, so it is
ignored by this patch too.
Signed-off-by: Don Zickus <dzickus(a)redhat.com>
diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template
index blahblah..blahblah 100644
--- a/redhat/kernel.spec.template
+++ b/redhat/kernel.spec.template
@@ -2769,7 +2769,7 @@ if [ ! -f include/generated/autoconf.h ]; then
%{make} %{?_smp_mflags} modules_prepare
fi
-%{make} %{?_smp_mflags} ARCH=$Arch V=1 M=samples/bpf/ VMLINUX_H="${RPM_VMLINUX_H}" || true
+%{make} %{?_smp_mflags} TPROGS_USER_CFLAGS="%{?build_hostcflags}" TPROGS_USER_LDFLAGS="%{?build_hostldflags}" EXTRA_CFLAGS="%{?build_hostcflags}" EXTRA_LDFLAGS="%{?build_hostldflags}" ARCH=$Arch V=1 M=samples/bpf/ VMLINUX_H="${RPM_VMLINUX_H}" || true
# Prevent bpf selftests to build bpftool repeatedly:
export BPFTOOL=$(pwd)/tools/bpf/bpftool/bpftool
@@ -2783,7 +2783,7 @@ pushd tools/testing/selftests
force_targets=""
%endif
-%{make} %{?_smp_mflags} ARCH=$Arch V=1 TARGETS="bpf mm livepatch net net/forwarding net/mptcp netfilter tc-testing memfd drivers/net/bonding" SKIP_TARGETS="" $force_targets INSTALL_PATH=%{buildroot}%{_libexecdir}/kselftests VMLINUX_H="${RPM_VMLINUX_H}" install
+%{make} %{?_smp_mflags} USERCFLAGS="%{?build_hostcflags}" USERLDFLAGS="%{?build_hostldflags}" ARCH=$Arch V=1 TARGETS="bpf mm livepatch net net/forwarding net/mptcp netfilter tc-testing memfd drivers/net/bonding" SKIP_TARGETS="" $force_targets INSTALL_PATH=%{buildroot}%{_libexecdir}/kselftests VMLINUX_H="${RPM_VMLINUX_H}" install
# 'make install' for bpf is broken and upstream refuses to fix it.
# Install the needed files manually.
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2749
From: Florian Westphal on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2823
Disable DCCP conntrack and the old iptables-32-bit-compat interface in all
configurations.
Set
CONFIG_NETFILTER_NETLINK_HOOK=m
in all configurations (only enabled in rhel so far)
and disable
CONFIG_NF_CT_PROTO_DCCP and CONFIG_NETFILTER_XTABLES_COMPAT
in all configurations.
Signed-off-by: Florian Westphal <fwestpha(a)redhat.com>
---
redhat/configs/rhel/generic/CONFIG_NETFILTER_NETLINK_HOOK => redhat/configs/common/generic/CONFIG_NETFILTER_NETLINK_HOOK | 0
redhat/configs/rhel/generic/CONFIG_NETFILTER_XTABLES_COMPAT => redhat/configs/common/generic/CONFIG_NETFILTER_XTABLES_COMPAT | 0
redhat/configs/common/generic/CONFIG_NF_CT_PROTO_DCCP | 2 +-
redhat/configs/fedora/generic/CONFIG_NETFILTER_NETLINK_HOOK | 1 -
redhat/configs/fedora/generic/CONFIG_NETFILTER_XTABLES_COMPAT | 1 -
5 files changed, 1 insertions(+), 3 deletions(-)
Hi, we tested your kernel and here are the results:
Overall result: PASSED
Merge: OK
Compile: OK
Test: OK
Tested-by: CKI Project <cki-project(a)redhat.com>
Kernel information:
Brew / Koji Task ID: 109672301
You can find all the details about the test run at
https://datawarehouse.cki-project.org/kcidb/checkouts/116845
One or more kernel tests failed:
We also see the following known issues which are not related to your changes:
Issue: NFS Connectathon: SELinux prevents rpcbind
URL: https://bugzilla.redhat.com/1758147
Affected tests:
x86_64 - Filesystem - NFS Connectathon
If you find a failure unrelated to your changes, please ask the test maintainer to review it.
This will prevent the failures from being incorrectly reported in the future.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
From: Alexander Larsson on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2825
NOTE: Truncated patchset due to missing public @redhat.com email
address on your GitLab profile at https://gitlab.com/-/profile.
Once that is fixed, close and reopen the merge request to
retrigger sending the emails.
This is equivalent to this cs9 change, but for ark:
https://gitlab.com/redhat/centos-stream/src/kernel/centos-
stream-9/-/merge_requests/3317
Signed-off-by: Alexander Larsson <alexl(a)redhat.com>
---
fs/erofs/super.c | 9 ++++++++
fs/ext4/super.c | 11 ++++++++++
redhat/configs/rhel/generic/CONFIG_EROFS_FS | 2 +-
redhat/configs/rhel/generic/CONFIG_EROFS_FS_DEBUG | 1 +
redhat/configs/rhel/generic/CONFIG_EROFS_FS_POSIX_ACL | 1 +
redhat/configs/rhel/generic/CONFIG_EROFS_FS_SECURITY | 1 +
redhat/configs/rhel/generic/CONFIG_EROFS_FS_XATTR | 1 +
redhat/configs/rhel/generic/CONFIG_EROFS_FS_ZIP | 1 +
redhat/configs/rhel/generic/CONFIG_FS_VERITY | 2 +-
redhat/configs/rhel/generic/CONFIG_FS_VERITY_BUILTIN_SIGNATURES | 1 +
redhat/configs/rhel/generic/CONFIG_FS_VERITY_DEBUG | 1 +
11 files changed, 29 insertions(+), 2 deletions(-)
From: Alexander Larsson on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2825
NOTE: Truncated patchset due to missing public @redhat.com email
address on your GitLab profile at https://gitlab.com/-/profile.
Once that is fixed, close and reopen the merge request to
retrigger sending the emails.
This is equivalent to this cs9 change, but for ark:
https://gitlab.com/redhat/centos-stream/src/kernel/centos-
stream-9/-/merge_requests/3317
Signed-off-by: Alexander Larsson <alexl(a)redhat.com>
---
fs/erofs/super.c | 5 +++++
fs/ext4/super.c | 9 +++++++++
redhat/configs/rhel/generic/CONFIG_EROFS_FS | 2 +-
redhat/configs/rhel/generic/CONFIG_EROFS_FS_DEBUG | 1 +
redhat/configs/rhel/generic/CONFIG_EROFS_FS_POSIX_ACL | 1 +
redhat/configs/rhel/generic/CONFIG_EROFS_FS_SECURITY | 1 +
redhat/configs/rhel/generic/CONFIG_EROFS_FS_XATTR | 1 +
redhat/configs/rhel/generic/CONFIG_EROFS_FS_ZIP | 1 +
redhat/configs/rhel/generic/CONFIG_FS_VERITY | 2 +-
redhat/configs/rhel/generic/CONFIG_FS_VERITY_BUILTIN_SIGNATURES | 1 +
redhat/configs/rhel/generic/CONFIG_FS_VERITY_DEBUG | 1 +
11 files changed, 23 insertions(+), 2 deletions(-)
Hi, we tested your kernel and here are the results:
Overall result: PASSED
Merge: OK
Compile: OK
Test: OK
Tested-by: CKI Project <cki-project(a)redhat.com>
Kernel information:
Brew / Koji Task ID: 109318980
You can find all the details about the test run at
https://datawarehouse.cki-project.org/kcidb/checkouts/115761
One or more kernel tests failed:
We also see the following known issues which are not related to your changes:
Issue: NFS Connectathon: SELinux prevents rpcbind
URL: https://bugzilla.redhat.com/1758147
Affected tests:
ppc64le - Filesystem - NFS Connectathon
If you find a failure unrelated to your changes, please ask the test maintainer to review it.
This will prevent the failures from being incorrectly reported in the future.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
From: Sabrina Dubroca on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1619
This MR introduces a new kABI macro, RH_KABI_EXCLUDE_WITH_SIZE. The
implementation is identical to RH_KABI_EXTEND_WITH_SIZE, but the meaning is
more in line with RH_KABI_EXCLUDE. The size check and reserved space allows us
to exclude an element embedded inside a kABI-protected structure while
reserving space for it to grow in the future.
The size checks that are part of multiple kABI macros are currently not
enabled because the config option to turn them on is missing. Those size
checks only make sense on regular builds, so they're disabled on debug
kernels.
Signed-off-by: Sabrina Dubroca <sdubroca(a)redhat.com>
---
include/linux/rh_kabi.h | 30 +++++++++-
redhat/configs/rhel/debug/CONFIG_RH_KABI_SIZE_ALIGN_CHECKS | 1 +
redhat/configs/rhel/generic/s390x/zfcpdump/CONFIG_RH_KABI_SIZE_ALIGN_CHECKS | 1 +
redhat/configs/rhel/generic/CONFIG_RH_KABI_SIZE_ALIGN_CHECKS | 1 +
redhat/configs/rhel/rt/generic/CONFIG_RH_KABI_SIZE_ALIGN_CHECKS | 1 +
Kconfig.redhat | 9 +++
6 files changed, 41 insertions(+), 2 deletions(-)
From: Sabrina Dubroca on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1619
This MR introduces a new kABI macro, RH_KABI_EXCLUDE_WITH_SIZE. The
implementation is identical to RH_KABI_EXTEND_WITH_SIZE, but the meaning is
more in line with RH_KABI_EXCLUDE. The size check and reserved space allows us
to exclude an element embedded inside a kABI-protected structure while
reserving space for it to grow in the future.
The size checks that are part of multiple kABI macros are currently not
enabled because the config option to turn them on is missing. Those size
checks only make sense on regular builds, so they're disabled on debug
kernels.
Signed-off-by: Sabrina Dubroca <sdubroca(a)redhat.com>
---
include/linux/rh_kabi.h | 26 ++++++++++
redhat/configs/ark/debug/CONFIG_RH_KABI_SIZE_ALIGN_CHECKS | 1 +
redhat/configs/ark/generic/CONFIG_RH_KABI_SIZE_ALIGN_CHECKS | 1 +
redhat/configs/ark/kgcov/CONFIG_RH_KABI_SIZE_ALIGN_CHECKS | 1 +
redhat/configs/common/generic/CONFIG_RH_KABI_SIZE_ALIGN_CHECKS | 1 +
Kconfig.redhat | 9 +++
6 files changed, 39 insertions(+), 0 deletions(-)
Hey All,
I would like to invite all of you to participate in the Kernel 6.6
Test week is happening from 2023-11-12 to 2023-11-19. It's
fairly simple, head over to the wiki [0] and read in detail about the
test week and simply run the test case mentioned in[1] and enter your
results.
As usual, the Fedora QA team will hangout at #fedora-test-day(a)libera.chat
for questions and discussion.
[0] http://fedoraproject.org/wiki/Test_Day:2023-11-12_Kernel_6.6_Test_Week
[1] https://testdays.fedoraproject.org/events/172
--
//sumantro
Fedora QE
TRIED AND PERSONALLY TESTED, ERGO TRUSTED
Hey everyone,
The current kernel configs generate
# CONFIG_MODULE_SIG_FORCE is not set
CONFIG_MODULE_SIG_ALL=y
# CONFIG_MODULE_SIG_SHA256 is not set
# CONFIG_MODULE_SIG_SHA384 is not set
CONFIG_MODULE_SIG_SHA512=y
# CONFIG_MODULE_SIG_SHA3_256 is not set
# CONFIG_MODULE_SIG_SHA3_384 is not set
# CONFIG_MODULE_SIG_SHA3_512 is not set
CONFIG_MODULE_SIG_HASH="sha512"
With https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2802
we can strengthen the module signing algorithm to
CONFIG_MODULE_SIG_SHA3_512.
I'd like to do this before Fedora40, as it will be the basis of
centos-stream-10 and RHEL10.
Thoughts or concerns?
P.
From: Zbigniew Jędrzejewski-Szmek on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2819
NOTE: Truncated patchset due to missing public @redhat.com email
address on your GitLab profile at https://gitlab.com/-/profile.
Once that is fixed, close and reopen the merge request to
retrigger sending the emails.
Mode 0600 was introduced in [1], with the justification that
"You can just chmod 644 them later if you (unlikely) need them without root.".
The time where a different mode is needed has come ;)
I'm building initrd images as part of the mkosi project [2], and in general
mkosi is designed to be executed unprivileged, and currently this fails when
copying in the kernel module files, because System.map is not readable.
Mode 0600 is not useful for files that are packaged, anyone can trivially get
the file from the web, or even from the dnf cache, etc. The packaging
guidelines
[3] say:
"Inside of /usr [...] [files] MUST be universally readable."
A similar case came up recently with polkit rules [4]. Apparently RH security
folks found the change acceptable. Also, at least on Debian System.map is
0644.
[1] https://src.fedoraproject.org/rpms/kernel/c/d287769cc9dbdad68eb0123b149e8c
8edae4632f
[2] https://github.com/systemd/mkosi/pull/2040
[3] https://docs.fedoraproject.org/en-US/packaging-
guidelines/#_file_permissions
[4] https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/153
---
redhat/kernel.spec.template | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)
Hi, we tested your kernel and here are the results:
Overall result: PASSED
Merge: OK
Compile: OK
Test: OK
Tested-by: CKI Project <cki-project(a)redhat.com>
Kernel information:
Brew / Koji Task ID: 108766203
You can find all the details about the test run at
https://datawarehouse.cki-project.org/kcidb/checkouts/113945
One or more kernel tests failed:
We also see the following known issues which are not related to your changes:
Issue: NFS Connectathon: SELinux prevents rpcbind
URL: https://bugzilla.redhat.com/1758147
Affected tests:
ppc64le - Filesystem - NFS Connectathon
If you find a failure unrelated to your changes, please ask the test maintainer to review it.
This will prevent the failures from being incorrectly reported in the future.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
Hi Fedora users, developers, and friends!
It's time to start thinking about Test Days for Fedora 40.
For anyone who isn't aware, a Test Day is an event usually focused
around IRC for interaction and a Wiki page for instructions and results,
with the aim being to get a bunch of interested users and developers
together to test a specific feature or area of the distribution. You can
run a Test Day on just about anything for which it would be useful to do
some fairly focused testing in 'real time' with a group of testers; it
doesn't have to be code, for instance, we often run Test Days for
l10n/i18n topics. For more information on Test Days, see
https://fedoraproject.org/wiki/QA/Test_Days .
Anyone who wants to can host their own Test Day, or you can request that
the QA group helps you out with organization or any combination of the
two. To propose a Test Day, just file a ticket in fedora-qa pagure - here's
an example https://pagure.io/fedora-qa/issue/624 . For
instructions on hosting a Test Day, see
https://fedoraproject.org/wiki/QA/SOP_Test_Day_management .
You can see the schedule at https://pagure.io/fedora-qa/issues?tags=test+days .
There are many slots open right now. Consider the development
schedule, though, in deciding when you want to run your Test Day - for
some topics you may want to avoid
the time before the Beta release or the time after the feature freeze
or the Final Freeze.
We normally aim to schedule Test Days on Thursdays; however, if you want
to run a series of related Test Days, it's often a good idea to do
something like Tuesday / Wednesday / Thursday of the same week (this is
how we usually run the X Test Week, for instance). If all the Thursday
slots fill up but more people want to run Test Days, we will open up
Tuesday slots as overflows. And finally, if you really want to run a
Test Day in a specific time frame due to the development schedule, but
the Thursday slot for that week is full, we can add a slot on another
day. We're flexible! Just put in your ticket the date or time frame you'd
like, and we'll figure it out from there.
If you don't want to run your own Test Day, but you are willing to
help with another, feel free to join one or more of already accepted
Test Days:
GNOME Test Day*
i18n Test Day*
Kernel Test Week(s)*
Upgrade Test Day*
IoT Test Week*
Cloud Test Day*
Fedora CoreOS Test Week*
And don't be afraid, there are a lot of more slots available for your
own Test Day!
[*] These are the test days we run generally to make sure everything
is working fine, the dates get announced as we move into the release
cycle.
If you have any questions about the Test Day process, please don't
hesitate to contact me or any member of the Fedora QA team on test at
lists.fedoraproject.org or in #fedora-qa on IRC. Thanks!
--
//sumantro
Fedora QE
TRIED AND PERSONALLY TESTED, ERGO TRUSTED
From: Gerd Hoffmann on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2817
NOTE: Truncated patchset due to missing public @redhat.com email
address on your GitLab profile at https://gitlab.com/-/profile.
Once that is fixed, close and reopen the merge request to
retrigger sending the emails.
Need to support root filesystem on virtiofs.
Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com>
---
redhat/dracut-virt.conf | 6 ++++++
1 files changed, 6 insertions(+), 0 deletions(-)
From: Scott Weaver <scweaver(a)redhat.com>
Add snd-hda-cirrus-scodec-test to mod-internal.list
This is a new kunit test that needs to be added to the mod-internal list
in order to be able to access the kunit symbols.
Signed-off-by: Scott Weaver <scweaver(a)redhat.com>
diff --git a/redhat/scripts/mod/mod-internal.list b/redhat/scripts/mod/mod-internal.list
index blahblah..blahblah 100644
--- a/redhat/scripts/mod/mod-internal.list
+++ b/redhat/scripts/mod/mod-internal.list
@@ -65,6 +65,7 @@ rocker
scftorture
siphash_kunit
slub_kunit
+snd-hda-cirrus-scodec-test
soc-topology-test
soc-utils-test
stackinit_kunit
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2816
From: Don Zickus <dzickus(a)redhat.com>
Fix s390 zfcpfdump bpf build failures for cgroups
BPF fails to build under s390's zfcpdump variant because cgroups is
disabled. Zfcpdump is a dump kernel and isn't expected to run bpf.
Just disable bpf for that kernel variant.
Signed-off-by: Don Zickus <dzickus(a)redhat.com>
diff --git a/redhat/configs/pending-rhel/generic/s390x/zfcpdump/CONFIG_BPF_SYSCALL b/redhat/configs/rhel/generic/s390x/zfcpdump/CONFIG_BPF_SYSCALL
rename from redhat/configs/pending-rhel/generic/s390x/zfcpdump/CONFIG_BPF_SYSCALL
rename to redhat/configs/rhel/generic/s390x/zfcpdump/CONFIG_BPF_SYSCALL
index blahblah..blahblah 100644
--- a/redhat/configs/pending-rhel/generic/s390x/zfcpdump/CONFIG_BPF_SYSCALL
+++ b/redhat/configs/rhel/generic/s390x/zfcpdump/CONFIG_BPF_SYSCALL
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2812
From: Justin M. Forbes on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2795
New kunit tests with 6.7 that need to be added to mod-internal list as
they need the kunit symbols.
Signed-off-by: Justin M. Forbes <jforbes(a)fedoraproject.org>
---
redhat/scripts/mod/mod-internal.list | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
Hi, we tested your kernel and here are the results:
Overall result: PASSED
Merge: OK
Compile: OK
Test: OK
Tested-by: CKI Project <cki-project(a)redhat.com>
Kernel information:
Brew / Koji Task ID: 108485780
You can find all the details about the test run at
https://datawarehouse.cki-project.org/kcidb/checkouts/112851
One or more kernel tests failed:
We also see the following known issues which are not related to your changes:
Issue: NFS Connectathon: SELinux prevents rpcbind
URL: https://bugzilla.redhat.com/1758147
Affected tests:
ppc64le - Filesystem - NFS Connectathon
If you find a failure unrelated to your changes, please ask the test maintainer to review it.
This will prevent the failures from being incorrectly reported in the future.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
From: Justin M. Forbes <jforbes(a)fedoraproject.org>
Add cfg80211-tests and mac80211-tests to mod-internal.list
New kunit tests with 6.7 that need to be added to mod-internal list as
they need the kunit symbols.
Signed-off-by: Justin M. Forbes <jforbes(a)fedoraproject.org>
diff --git a/redhat/scripts/mod/mod-internal.list b/redhat/scripts/mod/mod-internal.list
index blahblah..blahblah 100644
--- a/redhat/scripts/mod/mod-internal.list
+++ b/redhat/scripts/mod/mod-internal.list
@@ -1,5 +1,6 @@
bitfield_kunit
checksum_kunit
+cfg80211-tests
clk-fractional-divider_test
clk-gate_test
clk_test
@@ -44,6 +45,7 @@ lib_test
list-test
locktorture
mac80211_hwsim
+mac80211-tests
memcpy_kunit
mptcp_crypto_test
mptcp_token_test
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2795
From: Thorsten Leemhuis on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2771
NOTE: Truncated patchset since committer email 'fedora(a)leemhuis.info'
does not match the submitter's GitLab public email address
'linux(a)leemhuis.info'.
In the past few weeks while building linux-next for my kernel vanilla
repositories I noticed a few upstream changes that requires changes to mod-
internal.list for the kernel-ark build to succeed. Changes like these will
most likely be needed in kernel-ark soon, as the those upstream changes are
heading towards mainline currently. I'm providing these mod-internal.list
changes in advance in case they might helpful for @jmflinuxtx or somebody else
(either for cherry-picking for for merging as a whole).
Signed-off-by: Thorsten Leemhuis <fedora(a)leemhuis.info>
---
redhat/scripts/mod/mod-internal.list | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)