From: Claudio Imbrenda <cimbrend(a)redhat.com>
[redhat] redhat/configs: Update configs for secure IPL
Bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=1976884
Upstream Status: RHEL-only
Tested: by IBM
Conflicts: None
This commit fixes a regression from RHEL8, where the following CONFIG
entries were created in order to support secure IPL on s390x
Signed-off-by: Claudio Imbrenda <cimbrend(a)redhat.com>
diff --git a/redhat/configs/ark/generic/s390x/CONFIG_SYSTEM_BLACKLIST_KEYRING
b/redhat/configs/ark/generic/s390x/CONFIG_SYSTEM_BLACKLIST_KEYRING
new file mode 100644
index blahblah..blahblah 100644
--- /dev/null
+++ b/redhat/configs/ark/generic/s390x/CONFIG_SYSTEM_BLACKLIST_KEYRING
@@ -0,0 +1 @@
+CONFIG_SYSTEM_BLACKLIST_KEYRING=y
diff --git a/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_LOAD_IPL_KEYS
b/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_LOAD_IPL_KEYS
new file mode 100644
index blahblah..blahblah 100644
--- /dev/null
+++ b/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_LOAD_IPL_KEYS
@@ -0,0 +1 @@
+# CONFIG_LOAD_IPL_KEYS is not set
diff --git a/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_SYSTEM_BLACKLIST_KEYRING
b/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_SYSTEM_BLACKLIST_KEYRING
new file mode 100644
index blahblah..blahblah 100644
--- /dev/null
+++ b/redhat/configs/ark/generic/s390x/zfcpdump/CONFIG_SYSTEM_BLACKLIST_KEYRING
@@ -0,0 +1 @@
+# CONFIG_SYSTEM_BLACKLIST_KEYRING is not set
diff --git a/redhat/configs/ark/generic/s390x/CONFIG_LOAD_IPL_KEYS
b/redhat/configs/common/generic/s390x/CONFIG_LOAD_IPL_KEYS
rename from redhat/configs/ark/generic/s390x/CONFIG_LOAD_IPL_KEYS
rename to redhat/configs/common/generic/s390x/CONFIG_LOAD_IPL_KEYS
index blahblah..blahblah 100644
--- a/redhat/configs/ark/generic/s390x/CONFIG_LOAD_IPL_KEYS
+++ b/redhat/configs/common/generic/s390x/CONFIG_LOAD_IPL_KEYS
diff --git a/redhat/configs/common/generic/s390x/CONFIG_SIGNATURE
b/redhat/configs/common/generic/s390x/CONFIG_SIGNATURE
new file mode 100644
index blahblah..blahblah 100644
--- /dev/null
+++ b/redhat/configs/common/generic/s390x/CONFIG_SIGNATURE
@@ -0,0 +1 @@
+CONFIG_SIGNATURE=y
diff --git a/redhat/configs/common/generic/s390x/CONFIG_SYSTEM_DATA_VERIFICATION
b/redhat/configs/common/generic/s390x/CONFIG_SYSTEM_DATA_VERIFICATION
new file mode 100644
index blahblah..blahblah 100644
--- /dev/null
+++ b/redhat/configs/common/generic/s390x/CONFIG_SYSTEM_DATA_VERIFICATION
@@ -0,0 +1 @@
+CONFIG_SYSTEM_DATA_VERIFICATION=y
diff --git a/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_INTEGRITY_ASYMMETRIC_KEYS
b/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_INTEGRITY_ASYMMETRIC_KEYS
new file mode 100644
index blahblah..blahblah 100644
--- /dev/null
+++ b/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_INTEGRITY_ASYMMETRIC_KEYS
@@ -0,0 +1 @@
+# CONFIG_INTEGRITY_ASYMMETRIC_KEYS is not set
diff --git
a/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_INTEGRITY_PLATFORM_KEYRING
b/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_INTEGRITY_PLATFORM_KEYRING
new file mode 100644
index blahblah..blahblah 100644
--- /dev/null
+++ b/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_INTEGRITY_PLATFORM_KEYRING
@@ -0,0 +1 @@
+# CONFIG_INTEGRITY_PLATFORM_KEYRING is not set
diff --git a/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_INTEGRITY_SIGNATURE
b/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_INTEGRITY_SIGNATURE
new file mode 100644
index blahblah..blahblah 100644
--- /dev/null
+++ b/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_INTEGRITY_SIGNATURE
@@ -0,0 +1 @@
+# CONFIG_INTEGRITY_SIGNATURE is not set
diff --git a/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_KEXEC_SIG
b/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_KEXEC_SIG
new file mode 100644
index blahblah..blahblah 100644
--- /dev/null
+++ b/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_KEXEC_SIG
@@ -0,0 +1 @@
+# CONFIG_KEXEC_SIG is not set
diff --git a/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_SIGNATURE
b/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_SIGNATURE
new file mode 100644
index blahblah..blahblah 100644
--- /dev/null
+++ b/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_SIGNATURE
@@ -0,0 +1 @@
+# CONFIG_SIGNATURE is not set
diff --git a/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_SYSTEM_DATA_VERIFICATION
b/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_SYSTEM_DATA_VERIFICATION
new file mode 100644
index blahblah..blahblah 100644
--- /dev/null
+++ b/redhat/configs/common/generic/s390x/zfcpdump/CONFIG_SYSTEM_DATA_VERIFICATION
@@ -0,0 +1 @@
+# CONFIG_SYSTEM_DATA_VERIFICATION is not set
diff --git a/redhat/configs/fedora/generic/s390x/CONFIG_LOAD_IPL_KEYS
b/redhat/configs/fedora/generic/s390x/CONFIG_LOAD_IPL_KEYS
deleted file mode 100644
index blahblah..blahblah 0
--- a/redhat/configs/fedora/generic/s390x/CONFIG_LOAD_IPL_KEYS
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_LOAD_IPL_KEYS=y
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1371