From: Justin M. Forbes <jforbes(a)fedoraproject.org>
Turn on SECURITY_DMESG_RESTRICT
It was requested by ProdSec that we enable SECURITY_DMESG_RESTRICT as
this makes several security bugs more difficult to exploit. It should
be noted that this just controls the default setting of
kernel.dmesg_restrict sysctl and thus can be always set back to 0 at
runtime. Users in the wheel group also have access to journalctl -k or
sudo for dmesg access without giving it to every user on the system.
Signed-off-by: Justin M. Forbes <jforbes(a)fedoraproject.org>
diff --git a/redhat/configs/common/generic/CONFIG_SECURITY_DMESG_RESTRICT b/redhat/configs/common/generic/CONFIG_SECURITY_DMESG_RESTRICT
index blahblah..blahblah 100644
--- a/redhat/configs/common/generic/CONFIG_SECURITY_DMESG_RESTRICT
+++ b/redhat/configs/common/generic/CONFIG_SECURITY_DMESG_RESTRICT
@@ -1 +1 @@
-# CONFIG_SECURITY_DMESG_RESTRICT is not set
+CONFIG_SECURITY_DMESG_RESTRICT=y
diff --git a/redhat/configs/fedora/generic/CONFIG_SECURITY_DMESG_RESTRICT b/redhat/configs/fedora/generic/CONFIG_SECURITY_DMESG_RESTRICT
deleted file mode 100644
index blahblah..blahblah 0
--- a/redhat/configs/fedora/generic/CONFIG_SECURITY_DMESG_RESTRICT
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_SECURITY_DMESG_RESTRICT=y
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2930
From: Jeremy Linton <jlinton(a)redhat.com>
redhat/configs: For aarch64/RT, default kstack randomization off
Unlike other architectures which use their cycles counters to
seed the kstack randomization (which is sketchy) aarch64 uses
the kernel random number generator. For a list of reasons starting
with the lack of an enabled/fast cycle counter, a ubiquitous high
frequency timer, nor machines which have the v8.5 FEAT_RNG.
Using the kernel rng is largely an acceptable solution except
for RT workloads which can experience quite large latency spikes
as a result.
So, lets invert the default kstack randomization for RT kernels
on aarch64 until FEAT_RNG is common or a better solution is
found.
Signed-off-by: Jeremy Linton <jlinton(a)redhat.com>
diff --git a/redhat/configs/common/rt/generic/arm/aarch64/CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT b/redhat/configs/common/rt/generic/arm/aarch64/CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT
new file mode 100644
index blahblah..blahblah 100644
--- /dev/null
+++ b/redhat/configs/common/rt/generic/arm/aarch64/CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT
@@ -0,0 +1 @@
+# CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT is not set
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2933
From: Ondrej Mosnacek <omosnace(a)redhat.com>
kernel.spec: include the GDB plugin in kernel-debuginfo
Provide the GDB plugin files in the debuginfo package so that consumers
can use it when dubugging the kernel via GDB [1]. While it spossible to
do it without this plugin to some extent, it becomes essential when you
want to debug also code inside modules. And it provides many more
convenience commands on top of that.
Place the plugin files beside vmlinux so that gdb can auto-load it
(after some path setup). Example gdb command line using manually
extracted debuginfo RPM contents:
gdb --directory <extracted_dir>/usr/src/debug/*/linux-<kver> \
--cd <extracted_dir>/usr/lib/debug/lib/modules/<kver> \
-iex 'add-auto-load-safe-path <extracted_dir>/usr/lib/debug/lib/modules/<kver>' \
-ex 'target remote <gdb_socket_or_port>' vmlinux
I occasionally use this to debug kernels built as an RPM and having the
plugin included will be very useful to me.
[1] https://docs.kernel.org/dev-tools/gdb-kernel-debugging.html
Signed-off-by: Ondrej Mosnacek <omosnace(a)redhat.com>
diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template
index blahblah..blahblah 100644
--- a/redhat/kernel.spec.template
+++ b/redhat/kernel.spec.template
@@ -2413,6 +2413,13 @@ BuildKernel() {
cp %{vmlinux_decompressor} $RPM_BUILD_ROOT%{debuginfodir}/lib/modules/$KernelVer/vmlinux.decompressor
fi
fi
+
+ # build and copy the vmlinux-gdb plugin files into kernel-debuginfo
+ %{make} %{?_smp_mflags} scripts_gdb
+ cp -a --parents scripts/gdb/{,linux/}*.py $RPM_BUILD_ROOT%{debuginfodir}/lib/modules/$KernelVer
+ # this should be a relative symlink (Kbuild creates an absolute one)
+ ln -s scripts/gdb/vmlinux-gdb.py $RPM_BUILD_ROOT%{debuginfodir}/lib/modules/$KernelVer/vmlinux-gdb.py
+ %py_byte_compile %{python3} $RPM_BUILD_ROOT%{debuginfodir}/lib/modules/$KernelVer/scripts/gdb
%endif
find $RPM_BUILD_ROOT/lib/modules/$KernelVer -name "*.ko" -type f >modnames
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2929
From: Emanuele Giuseppe Esposito on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2917
We want to enable kernel.spec to optionally ship UKI addons defined in a
common config file in redhat folder.
If that file is populated, and the kernel-uki-virt is built, kernel-uki-virt
rpm will also contain a folder called addons that will contain the uki addons.
Signed-off-by: Emanuele Giuseppe Esposito <eesposit(a)redhat.com>
---
redhat/scripts/uki_addons.py | 137 +++++++++++++++++++++++++++++++++++++++++
redhat/Makefile | 2 +
redhat/kernel.spec.template | 15 ++++
redhat/uki_cmdline_addons.conf | 3 +
4 files changed, 157 insertions(+), 0 deletions(-)
Hi, we tested your kernel and here are the results:
Overall result: FAILED
Merge: OK
Compile: OK
Test: FAILED
Kernel information:
Brew / Koji Task ID: 112999067
You can find all the details about the test run at
https://datawarehouse.cki-project.org/kcidb/checkouts/127850
One or more kernel tests failed:
Unrecognized or new issues:
aarch64 - Reboot test
Logs: https://datawarehouse.cki-project.org/kcidb/tests/11225352
Non-passing ran subtests:
❌ FAIL /10_avc_check
We also see the following known issues which are not related to your changes:
Issue: [rawhide] avc: denied { checkpoint_restore } for pid=793 comm="agetty" capability=40 scontext=system_u:system_r:getty_t:s0-s0:c0.c1023 tcontext=system_u:system_r:getty_t:s0-s0:c0.c1023 tclass=capability2 permissive=1
URL: https://bugzilla.redhat.com/show_bug.cgi?id=2259622
Affected tests:
aarch64 - Boot test
aarch64 - stress: stress-ng - interrupt
aarch64 - Reboot test
ppc64le - Boot test
ppc64le - Reboot test
s390x - Boot test
s390x - stress: stress-ng - interrupt
s390x - Reboot test
x86_64 - Boot test
x86_64 - stress: stress-ng - interrupt
x86_64 - Reboot test
Issue: NFS Connectathon: SELinux prevents rpcbind
URL: https://bugzilla.redhat.com/1758147
Affected tests:
ppc64le - Filesystem - NFS Connectathon
If you find a failure unrelated to your changes, please ask the test maintainer to review it.
This will prevent the failures from being incorrectly reported in the future.
Please reply to this email if you have any questions about the tests that we
ran or if you have any suggestions on how to make future tests more effective.
,-. ,-.
( C ) ( K ) Continuous
`-',-.`-' Kernel
( I ) Integration
`-'
______________________________________________________________________________
From: Don Zickus <dzickus(a)redhat.com>
Fix dist-get-buildreqs breakage around perl(ExtUtils::Embed)
CKI fails with
$ export missing=$(make dist-get-buildreqs | grep "Missing dependencies:" | cut -d":" -f2)
$ if [ "$missing" == "" ]; then echo "Missing dependencies should not be null but are empty. Review test log." && exit 1; fi;
$ dnf -y install $missing
Last metadata expiration check: 0:00:29 ago on Sat Feb 3 23:44:30 2024.
No match for argument: perl(ExtUtils
Error: Unable to find a match: perl(ExtUtils
This is because it was trying to "cut -d':' -f2" this line:
Missing dependencies: perl(ExtUtils::Embed)
And it grabbed the content between the ':', leaving out ::Embed. Easy
fix, convert cut's parameter '-f2' to '-f2-' to included everything
after the first ':'.
Running the command locally resolves the issue.
Signed-off-by: Don Zickus <dzickus(a)redhat.com>
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index blahblah..blahblah 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -461,10 +461,10 @@ test_makefile:
- git config user.name "Fedora Kernel Team"
- git config user.email "kernel-team(a)fedoraproject.org"
script:
- - export missing=$(make dist-get-buildreqs | grep "Missing dependencies:" | cut -d":" -f2)
+ - export missing=$(make dist-get-buildreqs | grep "Missing dependencies:" | cut -d":" -f2-)
- if [ "$missing" == "" ]; then echo "Missing dependencies should not be null but are empty. Review test log." && exit 1; fi;
- dnf -y install $missing
- - export missingafter=$(make dist-get-buildreqs | grep "Missing dependencies:" | cut -d":" -f2)
+ - export missingafter=$(make dist-get-buildreqs | grep "Missing dependencies:" | cut -d":" -f2-)
- if [ "$missingafter" != "" ]; then echo "Missing dependencies should be null but are $missingafter. Review test log." && exit 1; fi;
rules:
- *only-os-build-mr
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2924