%global security_hardening none Summary: Kernel Name: linux-secure Version: 4.9.47 Release: 2%{?dist} License: GPLv2 URL: http://www.kernel.org/ Group: System Environment/Kernel Vendor: VMware, Inc. Distribution: Photon Source0: http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz %define sha1 linux=49110526c8e572513bd3295495ccd28754b5292d Source1: config-secure Source2: aufs4.9.tar.gz %define sha1 aufs=ebe716ce4b638a3772c7cd3161abbfe11d584906 Source3: initramfs.trigger # common Patch0: x86-vmware-read-tsc_khz-only-once-at-boot-time.patch Patch1: x86-vmware-use-tsc_khz-value-for-calibrate_cpu.patch Patch2: x86-vmware-add-basic-paravirt-ops-support.patch Patch3: x86-vmware-add-paravirt-sched-clock.patch Patch4: x86-vmware-log-kmsg-dump-on-panic.patch Patch5: double-tcp_mem-limits.patch Patch6: linux-4.9-sysctl-sched_weighted_cpuload_uses_rla.patch Patch7: linux-4.9-watchdog-Disable-watchdog-on-virtual-machines.patch Patch9: SUNRPC-Do-not-reuse-srcport-for-TIME_WAIT-socket.patch Patch10: SUNRPC-xs_bind-uses-ip_local_reserved_ports.patch Patch11: net-9p-vsock.patch Patch12: x86-vmware-sta.patch # secure Patch13: 0001-NOWRITEEXEC-and-PAX-features-MPROTECT-EMUTRAMP.patch Patch14: 0002-Added-rap_plugin.patch Patch15: 0003-Added-PAX_RANDKSTACK.patch # HyperV Patches Patch16: 0004-vmbus-Don-t-spam-the-logs-with-unknown-GUIDs.patch Patch17: 0005-Drivers-hv-utils-Fix-the-mapping-between-host-versio.patch Patch18: 0006-Drivers-hv-vss-Improve-log-messages.patch Patch19: 0007-Drivers-hv-vss-Operation-timeouts-should-match-host-.patch Patch20: 0008-Drivers-hv-vmbus-Use-all-supported-IC-versions-to-ne.patch Patch21: 0009-Drivers-hv-Log-the-negotiated-IC-versions.patch Patch22: 0010-vmbus-fix-missed-ring-events-on-boot.patch Patch23: 0011-vmbus-remove-goto-error_clean_msglist-in-vmbus_open.patch Patch24: 0012-vmbus-dynamically-enqueue-dequeue-the-channel-on-vmb.patch Patch25: 0013-vmbus-fix-the-missed-signaling-in-hv_signal_on_read.patch Patch26: 0014-hv_sock-introduce-Hyper-V-Sockets.patch #FIPS patches - allow some algorithms Patch27: 0001-Revert-crypto-testmgr-Disable-fips-allowed-for-authe.patch Patch28: 0002-allow-also-ecb-cipher_null.patch Patch29: add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch # Fix CVE-2017-11600 Patch30: xfrm-policy-check-policy-direction-value.patch # NSX requirements (should be removed) Patch99: LKCM.patch BuildRequires: bc BuildRequires: kbd BuildRequires: kmod-devel BuildRequires: glib-devel BuildRequires: xerces-c-devel BuildRequires: xml-security-c-devel BuildRequires: libdnet-devel BuildRequires: libmspack-devel BuildRequires: Linux-PAM-devel BuildRequires: openssl-devel BuildRequires: procps-ng-devel Requires: filesystem kmod Requires(post):(coreutils or toybox) %define uname_r %{version}-%{release}-secure %description Security hardened Linux kernel. %package devel Summary: Kernel Dev Group: System Environment/Kernel Requires: python2 gawk Requires: %{name} = %{version}-%{release} %description devel The Linux package contains the Linux kernel dev files %package docs Summary: Kernel docs Group: System Environment/Kernel Requires: python2 Requires: %{name} = %{version}-%{release} %description docs The Linux package contains the Linux kernel doc files %prep %setup -q -n linux-%{version} %setup -D -b 2 -n linux-%{version} # apply aufs patch patch -p1 < ../aufs4-standalone-aufs4.9/aufs4-kbuild.patch patch -p1 < ../aufs4-standalone-aufs4.9/aufs4-base.patch patch -p1 < ../aufs4-standalone-aufs4.9/aufs4-mmap.patch patch -p1 < ../aufs4-standalone-aufs4.9/aufs4-standalone.patch cp -a ../aufs4-standalone-aufs4.9/Documentation/ . cp -a ../aufs4-standalone-aufs4.9/fs/ . cp ../aufs4-standalone-aufs4.9/include/uapi/linux/aufs_type.h include/uapi/linux/ cat >> %{SOURCE1} << "EOF" CONFIG_AUFS_FS=m CONFIG_AUFS_BRANCH_MAX_127=y # CONFIG_AUFS_BRANCH_MAX_511 is not set # CONFIG_AUFS_BRANCH_MAX_1023 is not set # CONFIG_AUFS_BRANCH_MAX_32767 is not set CONFIG_AUFS_SBILIST=y # CONFIG_AUFS_HNOTIFY is not set # CONFIG_AUFS_EXPORT is not set # CONFIG_AUFS_XATTR is not set # CONFIG_AUFS_FHSM is not set # CONFIG_AUFS_RDU is not set # CONFIG_AUFS_SHWH is not set # CONFIG_AUFS_BR_RAMFS is not set # CONFIG_AUFS_BR_FUSE is not set CONFIG_AUFS_BDEV_LOOP=y # CONFIG_AUFS_DEBUG is not set EOF %patch0 -p1 %patch1 -p1 %patch2 -p1 %patch3 -p1 %patch4 -p1 %patch5 -p1 %patch6 -p1 %patch7 -p1 %patch9 -p1 %patch10 -p1 %patch11 -p1 %patch12 -p1 %patch13 -p1 %patch14 -p1 %patch15 -p1 %patch16 -p1 %patch17 -p1 %patch19 -p1 %patch20 -p1 %patch21 -p1 %patch22 -p1 %patch23 -p1 %patch24 -p1 %patch25 -p1 %patch26 -p1 %patch27 -p1 %patch28 -p1 %patch29 -p1 %patch30 -p1 pushd .. %patch99 -p0 popd %build # patch vmw_balloon driver sed -i 's/module_init/late_initcall/' drivers/misc/vmw_balloon.c make mrproper cp %{SOURCE1} .config sed -i 's/CONFIG_LOCALVERSION="-secure"/CONFIG_LOCALVERSION="-%{release}-secure"/' .config make LC_ALL= oldconfig make VERBOSE=1 KBUILD_BUILD_VERSION="1-photon" KBUILD_BUILD_HOST="photon" ARCH="x86_64" %{?_smp_mflags} # build LKCM module bldroot=`pwd` pushd ../LKCM make -C $bldroot M=`pwd` modules popd %define __modules_install_post \ for MODULE in `find %{buildroot}/lib/modules/%{uname_r} -name *.ko` ; do \ ./scripts/sign-file sha512 certs/signing_key.pem certs/signing_key.x509 $MODULE \ rm -f $MODULE.{sig,dig} \ xz $MODULE \ done \ %{nil} # __os_install_post strips signature from modules. We need to resign it again # and then compress. Extra step is added to the default __spec_install_post. %define __spec_install_post\ %{?__debug_package:%{__debug_install_post}}\ %{__arch_install_post}\ %{__os_install_post}\ %{__modules_install_post}\ %{nil} %install install -vdm 755 %{buildroot}/etc install -vdm 755 %{buildroot}/boot install -vdm 755 %{buildroot}%{_defaultdocdir}/linux-%{uname_r} install -vdm 755 %{buildroot}/etc/modprobe.d install -vdm 755 %{buildroot}/usr/src/linux-headers-%{uname_r} make INSTALL_MOD_PATH=%{buildroot} modules_install # install LKCM module bldroot=`pwd` pushd ../LKCM make -C $bldroot M=`pwd` INSTALL_MOD_PATH=%{buildroot} modules_install popd cp -v arch/x86/boot/bzImage %{buildroot}/boot/vmlinuz-%{uname_r} cp -v System.map %{buildroot}/boot/System.map-%{uname_r} cp -v .config %{buildroot}/boot/config-%{uname_r} cp -r Documentation/* %{buildroot}%{_defaultdocdir}/linux-%{uname_r} install -vdm 755 %{buildroot}/usr/lib/debug/lib/modules/%{uname_r} cp -v vmlinux %{buildroot}/usr/lib/debug/lib/modules/%{uname_r}/vmlinux-%{uname_r} # Since we use compressed modules we cann't use load pinning, # because .ko files will be loaded from the memory (LoadPin: obj=) cat > %{buildroot}/boot/linux-%{uname_r}.cfg << "EOF" # GRUB Environment Block photon_cmdline=init=/lib/systemd/systemd ro loglevel=3 quiet no-vmw-sta loadpin.enabled=0 slub_debug=P page_poison=1 photon_linux=vmlinuz-%{uname_r} photon_initrd=initrd.img-%{uname_r} EOF # Register myself to initramfs mkdir -p %{buildroot}/%{_localstatedir}/lib/initramfs/kernel cat > %{buildroot}/%{_localstatedir}/lib/initramfs/kernel/%{uname_r} << "EOF" --add-drivers "tmem xen-scsifront xen-blkfront xen-acpi-processor xen-evtchn xen-gntalloc xen-gntdev xen-privcmd xen-pciback xenfs hv_utils hv_vmbus hv_storvsc hv_netvsc hv_sock hv_balloon cn" EOF # cleanup dangling symlinks rm -f %{buildroot}/lib/modules/%{uname_r}/source rm -f %{buildroot}/lib/modules/%{uname_r}/build # create /use/src/linux-headers-*/ content find . -name Makefile* -o -name Kconfig* -o -name *.pl | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/linux-headers-%{uname_r}' copy find arch/x86/include include scripts -type f | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/linux-headers-%{uname_r}' copy find $(find arch/x86 -name include -o -name scripts -type d) -type f | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/linux-headers-%{uname_r}' copy find arch/x86/include Module.symvers include scripts -type f | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/linux-headers-%{uname_r}' copy # copy .config manually to be where it's expected to be cp .config %{buildroot}/usr/src/linux-headers-%{uname_r} # symling to the build folder ln -sf /usr/src/linux-headers-%{uname_r} %{buildroot}/lib/modules/%{uname_r}/build %include %{SOURCE3} %post /sbin/depmod -aq %{uname_r} ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %files %defattr(-,root,root) /boot/System.map-%{uname_r} /boot/config-%{uname_r} /boot/vmlinuz-%{uname_r} %config(noreplace) /boot/linux-%{uname_r}.cfg %config %{_localstatedir}/lib/initramfs/kernel/%{uname_r} /lib/firmware/* /lib/modules/* %exclude /lib/modules/%{uname_r}/build %exclude /usr/src %files docs %defattr(-,root,root) %{_defaultdocdir}/linux-%{uname_r}/* %files devel %defattr(-,root,root) /lib/modules/%{uname_r}/build /usr/src/linux-headers-%{uname_r} %changelog * Mon Sep 18 2017 Alexey Makhalov 4.9.47-2 - Requires coreutils or toybox * Mon Sep 04 2017 Alexey Makhalov 4.9.47-1 - Fix CVE-2017-11600 * Tue Aug 22 2017 Anish Swaminathan 4.9.43-2 - Add missing xen block drivers * Mon Aug 14 2017 Alexey Makhalov 4.9.43-1 - Version update - [feature] new sysctl option unprivileged_userns_clone * Wed Aug 09 2017 Alexey Makhalov 4.9.41-2 - Fix CVE-2017-7542 - [bugfix] Added ccm,gcm,ghash,lzo crypto modules to avoid panic on modprobe tcrypt * Mon Aug 07 2017 Alexey Makhalov 4.9.41-1 - Version update * Fri Aug 04 2017 Bo Gan 4.9.38-6 - Fix initramfs triggers * Tue Aug 01 2017 Anish Swaminathan 4.9.38-5 - Allow some algorithms in FIPS mode - Reverts 284a0f6e87b0721e1be8bca419893902d9cf577a and backports - bcf741cb779283081db47853264cc94854e7ad83 in the kernel tree - Enable additional NF features * Fri Jul 21 2017 Anish Swaminathan 4.9.38-4 - Add patches in Hyperv codebase * Fri Jul 21 2017 Anish Swaminathan 4.9.38-3 - Add missing hyperv drivers * Thu Jul 20 2017 Alexey Makhalov 4.9.38-2 - Disable scheduler beef up patch * Tue Jul 18 2017 Alexey Makhalov 4.9.38-1 - Fix CVE-2017-11176 and CVE-2017-10911 * Fri Jul 14 2017 Alexey Makhalov 4.9.34-3 - Remove aufs source tarballs from git repo * Mon Jul 03 2017 Xiaolin Li 4.9.34-2 - Add libdnet-devel, kmod-devel and libmspack-devel to BuildRequires * Wed Jun 28 2017 Alexey Makhalov 4.9.34-1 - [feature] 9P FS security support - [feature] DM Delay target support - Fix CVE-2017-1000364 ("stack clash") and CVE-2017-9605 * Thu Jun 8 2017 Alexey Makhalov 4.9.31-1 - Fix CVE-2017-8890, CVE-2017-9074, CVE-2017-9075, CVE-2017-9076 CVE-2017-9077 and CVE-2017-9242 - [feature] IPV6 netfilter NAT table support * Fri May 26 2017 Alexey Makhalov 4.9.30-1 - Fix CVE-2017-7487 and CVE-2017-9059 * Wed May 17 2017 Vinay Kulkarni 4.9.28-2 - Enable IPVLAN module. * Tue May 16 2017 Alexey Makhalov 4.9.28-1 - Version update * Wed May 10 2017 Alexey Makhalov 4.9.27-1 - Version update * Sun May 7 2017 Alexey Makhalov 4.9.26-1 - Version update - Removed version suffix from config file name * Thu Apr 27 2017 Bo Gan 4.9.24-2 - Support dynamic initrd generation * Tue Apr 25 2017 Alexey Makhalov 4.9.24-1 - Fix CVE-2017-6874 and CVE-2017-7618. - .config: build nvme and nvme-core in kernel. * Tue Mar 21 2017 Alexey Makhalov 4.9.13-3 - Added LKCM module * Mon Mar 6 2017 Alexey Makhalov 4.9.13-2 - .config: NSX requirements for crypto and netfilter * Tue Feb 28 2017 Alexey Makhalov 4.9.13-1 - Update to linux-4.9.13 to fix CVE-2017-5986 and CVE-2017-6074 - .config: disable XEN guest (needs rap_plugin verification) * Wed Feb 22 2017 Alexey Makhalov 4.9.9-2 - rap_plugin improvement: throw error on function type casting function signatures were cleaned up using this feature. - Added RAP_ENTRY for asm functions. * Thu Feb 09 2017 Alexey Makhalov 4.9.9-1 - Update to linux-4.9.9 to fix CVE-2016-10153, CVE-2017-5546, CVE-2017-5547, CVE-2017-5548 and CVE-2017-5576. - Added aufs support. - Added PAX_RANDKSTACK feature. - Extra func signatures cleanup to fix 1809717 and 1809722. - .config: added CRYPTO_FIPS support. * Tue Jan 10 2017 Alexey Makhalov 4.9.2-1 - Update to linux-4.9.2 to fix CVE-2016-10088 - Rename package to linux-secure. - Added KSPP cmdline params: slub_debug=P page_poison=1 * Mon Dec 19 2016 Xiaolin Li 4.9.0-2 - BuildRequires Linux-PAM-devel * Mon Dec 12 2016 Alexey Makhalov 4.9.0-1 - Update to linux-4.9.0 - Add paravirt stolen time accounting feature (from linux-esx), but disable it by default (no-vmw-sta cmdline parameter) - Use vmware_io_delay() to keep "void fn(void)" signature * Wed Nov 30 2016 Alexey Makhalov 4.8.0-2 - Expand `uname -r` with release number - Resign and compress modules after stripping - .config: add syscalls tracing support - .config: add cgrup_hugetlb support - .config: add netfilter_xt_{set,target_ct} support - .config: add netfilter_xt_match_{cgroup,ipvs} support - .config: disable /dev/mem * Mon Oct 17 2016 Alexey Makhalov 4.8.0-1 Initial commit.