%global security_hardening none Summary: Kernel Name: linux-esx Version: 4.19.1 Release: 3%{?dist} License: GPLv2 URL: http://www.kernel.org/ Group: System Environment/Kernel Vendor: VMware, Inc. Distribution: Photon Source0: http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz %define sha1 linux=5ece7a7149eeef06bba906eeabbc2f29a8ac3952 Source1: config-esx Source2: initramfs.trigger # common Patch0: linux-4.14-Log-kmsg-dump-on-panic.patch Patch1: double-tcp_mem-limits.patch # TODO: disable this patch, check for regressions #Patch2: linux-4.9-watchdog-Disable-watchdog-on-virtual-machines.patch Patch3: SUNRPC-Do-not-reuse-srcport-for-TIME_WAIT-socket.patch Patch4: SUNRPC-xs_bind-uses-ip_local_reserved_ports.patch Patch5: vsock-transport-for-9p.patch Patch6: 4.18-x86-vmware-STA-support.patch # -esx Patch13: serial-8250-do-not-probe-U6-16550A-fifo-size.patch Patch14: 01-clear-linux.patch Patch15: 02-pci-probe.patch Patch16: 03-poweroff.patch Patch17: 04-quiet-boot.patch Patch18: 05-pv-ops-clocksource.patch Patch19: 06-pv-ops-boot_clock.patch Patch20: 07-vmware-only.patch Patch22: 4.18-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch # Fix CVE-2017-1000252 Patch24: kvm-dont-accept-wrong-gsi-values.patch Patch25: 4.18-0001-hwrng-rdrand-Add-RNG-driver-based-on-x86-rdrand-inst.patch BuildArch: x86_64 BuildRequires: bc BuildRequires: kbd BuildRequires: kmod-devel BuildRequires: glib-devel BuildRequires: xerces-c-devel BuildRequires: xml-security-c-devel BuildRequires: libdnet-devel BuildRequires: libmspack-devel BuildRequires: Linux-PAM-devel BuildRequires: openssl-devel BuildRequires: procps-ng-devel Requires: filesystem kmod Requires(post):(coreutils or toybox) %define uname_r %{version}-%{release}-esx %description The Linux kernel build for GOS for VMware hypervisor. %package devel Summary: Kernel Dev Group: System Environment/Kernel Requires: python2 gawk Requires: %{name} = %{version}-%{release} %description devel The Linux package contains the Linux kernel dev files %package docs Summary: Kernel docs Group: System Environment/Kernel Requires: python2 Requires: %{name} = %{version}-%{release} %description docs The Linux package contains the Linux kernel doc files %prep %setup -q -n linux-%{version} %patch0 -p1 %patch1 -p1 %patch3 -p1 %patch4 -p1 %patch5 -p1 %patch6 -p1 %patch13 -p1 %patch14 -p1 %patch15 -p1 %patch16 -p1 %patch17 -p1 %patch18 -p1 %patch19 -p1 %patch20 -p1 %patch22 -p1 %patch24 -p1 %patch25 -p1 %build # patch vmw_balloon driver sed -i 's/module_init/late_initcall/' drivers/misc/vmw_balloon.c make mrproper cp %{SOURCE1} .config sed -i 's/CONFIG_LOCALVERSION="-esx"/CONFIG_LOCALVERSION="-%{release}-esx"/' .config make LC_ALL= oldconfig make VERBOSE=1 KBUILD_BUILD_VERSION="1-photon" KBUILD_BUILD_HOST="photon" ARCH="x86_64" %{?_smp_mflags} # Do not compress modules which will be loaded at boot time # to speed up boot process %define __modules_install_post \ find %{buildroot}/lib/modules/%{uname_r} -name *.ko | \ grep -v "evdev\|mousedev\|sr_mod\|cdrom\|vmwgfx\|drm_kms_helper\|ttm\|psmouse\|drm\|apa_piix\|vmxnet3\|i2c_core\|libata\|processor\|ipv6" | xargs xz \ %{nil} # We want to compress modules after stripping. Extra step is added to # the default __spec_install_post. %define __spec_install_post\ %{?__debug_package:%{__debug_install_post}}\ %{__arch_install_post}\ %{__os_install_post}\ %{__modules_install_post}\ %{nil} %install install -vdm 755 %{buildroot}/etc install -vdm 755 %{buildroot}/boot install -vdm 755 %{buildroot}%{_defaultdocdir}/linux-%{uname_r} install -vdm 755 %{buildroot}/etc/modprobe.d install -vdm 755 %{buildroot}/usr/src/linux-headers-%{uname_r} make INSTALL_MOD_PATH=%{buildroot} modules_install cp -v arch/x86/boot/bzImage %{buildroot}/boot/vmlinuz-%{uname_r} cp -v System.map %{buildroot}/boot/System.map-%{uname_r} cp -v .config %{buildroot}/boot/config-%{uname_r} cp -r Documentation/* %{buildroot}%{_defaultdocdir}/linux-%{uname_r} install -vdm 755 %{buildroot}/usr/lib/debug/lib/modules/%{uname_r} cp -v vmlinux %{buildroot}/usr/lib/debug/lib/modules/%{uname_r}/vmlinux-%{uname_r} # TODO: noacpi acpi=off noapic pci=conf1,nodomains pcie_acpm=off pnpacpi=off cat > %{buildroot}/boot/linux-%{uname_r}.cfg << "EOF" # GRUB Environment Block photon_cmdline=init=/lib/systemd/systemd rcupdate.rcu_expedited=1 rw systemd.show_status=0 quiet noreplace-smp cpu_init_udelay=0 photon_linux=vmlinuz-%{uname_r} #photon_initrd=initrd.img-%{uname_r} EOF # Register myself to initramfs mkdir -p %{buildroot}/%{_localstatedir}/lib/initramfs/kernel touch %{buildroot}/%{_localstatedir}/lib/initramfs/kernel/%{uname_r} # cleanup dangling symlinks rm -f %{buildroot}/lib/modules/%{uname_r}/source rm -f %{buildroot}/lib/modules/%{uname_r}/build # create /use/src/linux-headers-*/ content find . -name Makefile* -o -name Kconfig* -o -name *.pl | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/linux-headers-%{uname_r}' copy find arch/x86/include include scripts -type f | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/linux-headers-%{uname_r}' copy find $(find arch/x86 -name include -o -name scripts -type d) -type f | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/linux-headers-%{uname_r}' copy find arch/x86/include Module.symvers include scripts -type f | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/linux-headers-%{uname_r}' copy # copy .config manually to be where it's expected to be cp .config %{buildroot}/usr/src/linux-headers-%{uname_r} # symling to the build folder ln -sf /usr/src/linux-headers-%{uname_r} %{buildroot}/lib/modules/%{uname_r}/build find %{buildroot}/lib/modules -name '*.ko' -print0 | xargs -0 chmod u+x %include %{SOURCE2} %post /sbin/depmod -a %{uname_r} ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %files %defattr(-,root,root) /boot/System.map-%{uname_r} /boot/config-%{uname_r} /boot/vmlinuz-%{uname_r} %config(noreplace) /boot/linux-%{uname_r}.cfg %config %{_localstatedir}/lib/initramfs/kernel/%{uname_r} /lib/modules/* %exclude /lib/modules/%{uname_r}/build %exclude /usr/src %files docs %defattr(-,root,root) %{_defaultdocdir}/linux-%{uname_r}/* %files devel %defattr(-,root,root) /lib/modules/%{uname_r}/build /usr/src/linux-headers-%{uname_r} %changelog * Thu Nov 29 2018 Alexey Makhalov 4.19.1-3 - Fix BAR4 is zero issue for IDE devices * Thu Nov 15 2018 Ajay Kaher 4.19.1-2 - Adding BuildArch * Thu Nov 08 2018 Him Kalyan Bordoloi 4.19.1-1 - Update to version 4.19.1 * Mon Sep 24 2018 Srivatsa S. Bhat 4.18.9-1 - Update to version 4.18.9 * Wed Sep 19 2018 Srivatsa S. Bhat 4.14.67-1 - Update to version 4.14.67 * Tue Sep 18 2018 Srivatsa S. Bhat 4.14.54-3 - Add rdrand-based RNG driver to enhance kernel entropy. * Sun Sep 02 2018 Srivatsa S. Bhat 4.14.54-2 - Add full retpoline support by building with retpoline-enabled gcc. * Mon Jul 09 2018 Him Kalyan Bordoloi 4.14.54-1 - Update to version 4.14.54 * Fri Feb 02 2018 Alexey Makhalov 4.14.8-1 - Version update * Tue Dec 19 2017 Srivatsa S. Bhat 4.9.66-2 - Enable audit support (CONFIG_AUDIT=y) * Mon Dec 04 2017 Srivatsa S. Bhat 4.9.66-1 - Version update * Tue Nov 21 2017 Srivatsa S. Bhat 4.9.64-1 - Version update * Mon Nov 06 2017 Srivatsa S. Bhat 4.9.60-1 - Version update * Wed Oct 25 2017 Anish Swaminathan 4.9.53-5 - Enable x86 vsyscall emulation * Tue Oct 17 2017 Alexey Makhalov 4.9.53-4 - Enable vsyscall emulation - Do not use deprecated -q depmod option * Wed Oct 11 2017 Srivatsa S. Bhat 4.9.53-3 - Add patch "KVM: Don't accept obviously wrong gsi values via KVM_IRQFD" to fix CVE-2017-1000252. * Tue Oct 10 2017 Alexey Makhalov 4.9.53-2 - Build hang (at make oldconfig) fix. * Thu Oct 05 2017 Srivatsa S. Bhat 4.9.53-1 - Version update * Mon Oct 02 2017 Srivatsa S. Bhat 4.9.52-3 - Allow privileged CLONE_NEWUSER from nested user namespaces. * Mon Oct 02 2017 Srivatsa S. Bhat 4.9.52-2 - Fix CVE-2017-11472 (ACPICA: Namespace: fix operand cache leak) * Mon Oct 02 2017 Srivatsa S. Bhat 4.9.52-1 - Version update * Mon Sep 18 2017 Alexey Makhalov 4.9.47-2 - Requires coreutils or toybox * Mon Sep 04 2017 Alexey Makhalov 4.9.47-1 - Fix CVE-2017-11600 * Mon Aug 14 2017 Alexey Makhalov 4.9.43-1 - Version update - [feature] new sysctl option unprivileged_userns_clone * Wed Aug 09 2017 Alexey Makhalov 4.9.41-2 - [bugfix] Do not fallback to syscall from VDSO on clock_gettime(MONOTONIC) - Fix CVE-2017-7542 * Mon Aug 07 2017 Alexey Makhalov 4.9.41-1 - Version update * Wed Jul 26 2017 Bo Gan 4.9.38-3 - Fix initramfs triggers * Thu Jul 20 2017 Alexey Makhalov 4.9.38-2 - Disable scheduler beef up patch * Tue Jul 18 2017 Alexey Makhalov 4.9.38-1 - [feature] IP tunneling support (CONFIG_NET_IPIP=m) - Fix CVE-2017-11176 and CVE-2017-10911 * Mon Jul 03 2017 Xiaolin Li 4.9.34-2 - Add libdnet-devel, kmod-devel and libmspack-devel to BuildRequires * Wed Jun 28 2017 Alexey Makhalov 4.9.34-1 - [feature] DM Delay target support - Fix CVE-2017-1000364 ("stack clash") and CVE-2017-9605 * Thu Jun 8 2017 Alexey Makhalov 4.9.31-1 - Fix CVE-2017-8890, CVE-2017-9074, CVE-2017-9075, CVE-2017-9076 CVE-2017-9077 and CVE-2017-9242 * Thu Jun 1 2017 Alexey Makhalov 4.9.30-2 - [feature] ACPI NFIT support (for PMEM type 7) * Fri May 26 2017 Alexey Makhalov 4.9.30-1 - Fix CVE-2017-7487 and CVE-2017-9059 * Wed May 17 2017 Vinay Kulkarni 4.9.28-2 - Enable IPVLAN module. * Tue May 16 2017 Alexey Makhalov 4.9.28-1 - .config: built ATA drivers in a kernel * Wed May 10 2017 Alexey Makhalov 4.9.27-1 - New pci=scan_all cmdline parameter to verify hardcoded pci-probe values - pci-probe added more known values - vmw_balloon late initcall * Sun May 7 2017 Alexey Makhalov 4.9.26-1 - Version update - Use ordered rdtsc in clocksource_vmware - .config: added debug info - Removed version suffix from config file name * Thu Apr 27 2017 Bo Gan 4.9.24-2 - Support dynamic initrd generation * Tue Apr 25 2017 Alexey Makhalov 4.9.24-1 - Fix CVE-2017-6874 and CVE-2017-7618. - .config: build nvme and nvme-core in kernel. * Tue Feb 28 2017 Alexey Makhalov 4.9.13-1 - Update to linux-4.9.13 to fix CVE-2017-5986 and CVE-2017-6074 - .config: enable PMEM support - .config: disable vsyscall * Thu Feb 09 2017 Alexey Makhalov 4.9.9-1 - Update to linux-4.9.9 to fix CVE-2016-10153, CVE-2017-5546, CVE-2017-5547, CVE-2017-5548 and CVE-2017-5576. - .config: added CRYPTO_FIPS and SYN_COOKIES support. * Tue Jan 10 2017 Alexey Makhalov 4.9.2-1 - Update to linux-4.9.2 to fix CVE-2016-10088 * Wed Dec 21 2016 Alexey Makhalov 4.9.0-3 - .config: CONFIG_IPV6_MULTIPLE_TABLES=y * Mon Dec 19 2016 Xiaolin Li 4.9.0-2 - BuildRequires Linux-PAM-devel * Mon Dec 12 2016 Alexey Makhalov 4.9.0-1 - Update to linux-4.9.0 * Thu Dec 8 2016 Alexey Makhalov 4.4.35-4 - net-packet-fix-race-condition-in-packet_set_ring.patch to fix CVE-2016-8655 * Wed Nov 30 2016 Alexey Makhalov 4.4.35-3 - Expand `uname -r` with release number - Compress modules * Tue Nov 29 2016 Alexey Makhalov 4.4.35-2 - Added btrfs module * Mon Nov 28 2016 Alexey Makhalov 4.4.35-1 - Update to linux-4.4.35 - vfio-pci-fix-integer-overflows-bitmask-check.patch to fix CVE-2016-9083 * Tue Nov 22 2016 Alexey Makhalov 4.4.31-4 - net-9p-vsock.patch * Thu Nov 17 2016 Alexey Makhalov 4.4.31-3 - tty-prevent-ldisc-drivers-from-re-using-stale-tty-fields.patch to fix CVE-2015-8964 * Tue Nov 15 2016 Alexey Makhalov 4.4.31-2 - .config: add ip set support - .config: add ipvs_{tcp,udp} support - .config: add cgrup_{hugetlb,net_prio} support * Thu Nov 10 2016 Alexey Makhalov 4.4.31-1 - Update to linux-4.4.31 * Thu Nov 10 2016 Alexey Makhalov 4.4.26-2 - .config: add ipvs modules for docker swarm - .config: serial driver built in kernel - serial-8250-do-not-probe-U6-16550A-fifo-size.patch - faster boot * Fri Oct 21 2016 Alexey Makhalov 4.4.26-1 - Update to linux-4.4.26 * Wed Oct 19 2016 Alexey Makhalov 4.4.20-7 - net-add-recursion-limit-to-GRO.patch * Tue Oct 18 2016 Alexey Makhalov 4.4.20-6 - ipip-properly-mark-ipip-GRO-packets-as-encapsulated.patch - tunnels-dont-apply-GRO-to-multiple-layers-of-encapsulation.patch * Thu Oct 6 2016 Alexey Makhalov 4.4.20-5 - .config: added ADM PCnet32 support - vmci-1.1.4.0-use-32bit-atomics-for-queue-headers.patch - vmci-1.1.5.0-doorbell-create-and-destroy-fixes.patch - late_initcall for vmw_balloon driver - Minor fixed in pv-ops patchset * Mon Oct 3 2016 Alexey Makhalov 4.4.20-4 - Package vmlinux with PROGBITS sections in -debuginfo subpackage * Wed Sep 21 2016 Alexey Makhalov 4.4.20-3 - Add PCIE hotplug support - Switch processor type to generic * Tue Sep 20 2016 Alexey Makhalov 4.4.20-2 - Add -release number for /boot/* files - Fixed generation of debug symbols for kernel modules & vmlinux * Wed Sep 7 2016 Alexey Makhalov 4.4.20-1 - Update to linux-4.4.20 - keys-fix-asn.1-indefinite-length-object-parsing.patch * Thu Aug 25 2016 Alexey Makhalov 4.4.8-11 - vmxnet3 patches to bumpup a version to 1.4.8.0 * Wed Aug 24 2016 Alexey Makhalov 4.4.8-10 - .config: added NVME blk dev support * Wed Aug 10 2016 Alexey Makhalov 4.4.8-9 - Added VSOCK-Detach-QP-check-should-filter-out-non-matching-QPs.patch * Wed Jul 20 2016 Alexey Makhalov 4.4.8-8 - .config: added cgroups for pids,mem and blkio * Mon Jul 11 2016 Alexey Makhalov 4.4.8-7 - .config: added ip multible tables support * Fri Jun 17 2016 Alexey Makhalov 4.4.8-6 - patch: e1000e-prevent-div-by-zero-if-TIMINCA-is-zero.patch - .config: disable rt group scheduling - not supported by systemd * Fri May 27 2016 Alexey Makhalov 4.4.8-5 - patch: REVERT-sched-fair-Beef-up-wake_wide.patch * Wed May 25 2016 Alexey Makhalov 4.4.8-4 - .config: added net_9p and 9p_fs * Tue May 24 2016 Priyesh Padmavilasom 4.4.8-3 - GA - Bump release of all rpms * Mon May 23 2016 Divya Thaluru 4.4.8-2 - Added patches to fix CVE-2016-3134, CVE-2016-3135 * Fri May 13 2016 Alexey Makhalov 4.4.8-1 - Update to linux-4.4.8 - Added net-Drivers-Vmxnet3-set-... patch - Added e1000e module * Tue Mar 29 2016 Alexey Makhalov 4.2.0-19 - Support kmsg dumping to vmware.log on panic - sunrpc: xs_bind uses ip_local_reserved_ports * Thu Mar 24 2016 Alexey Makhalov 4.2.0-18 - Apply photon8 config (+stack protector regular) - pv-ops patch: added STA support - Added patches from generic kernel * Wed Mar 09 2016 Harish Udaiya Kumar 4.2.0-17 - Enable ACPI hotplug support in kernel config * Sun Feb 14 2016 Alexey Makhalov 4.2.0-16 - veth patch: don’t modify ip_summed * Mon Feb 08 2016 Alexey Makhalov 4.2.0-15 - Double tcp_mem limits, patch is added. * Wed Feb 03 2016 Anish Swaminathan 4.2.0-14 - Fixes for CVE-2015-7990/6937 and CVE-2015-8660. * Fri Jan 22 2016 Alexey Makhalov 4.2.0-13 - Fix for CVE-2016-0728 * Wed Jan 13 2016 Alexey Makhalov 4.2.0-12 - CONFIG_HZ=250 - Disable sched autogroup. * Tue Jan 12 2016 Mahmoud Bassiouny 4.2.0-11 - Remove rootfstype from the kernel parameter. * Tue Dec 15 2015 Alexey Makhalov 4.2.0-10 - Skip rdrand reseed to improve boot time. - .config changes: jolietfs(m), default THP=always, hotplug_cpu(m) * Tue Nov 17 2015 Alexey Makhalov 4.2.0-9 - nordrand cmdline param is removed. - .config: + serial 8250 driver (M). * Fri Nov 13 2015 Mahmoud Bassiouny 4.2.0-8 - Change the linux image directory. * Tue Nov 10 2015 Alexey Makhalov 4.2.0-7 - Get LAPIC timer frequency from HV, skip boot time calibration. - .config: + dummy net driver (M). * Mon Nov 09 2015 Alexey Makhalov 4.2.0-6 - Rename subpackage dev -> devel. - Added the build essential files in the devel subpackage. - .config: added genede driver module. * Wed Oct 28 2015 Alexey Makhalov 4.2.0-5 - Import patches from kernel2 repo. - Added pv-ops patch (timekeeping related improvements). - Removed unnecessary cmdline params. - .config changes: elevator=noop by default, paravirt clock enable, initrd support, openvswitch module, x2apic enable. * Mon Sep 21 2015 Alexey Makhalov 4.2.0-4 - CDROM modules are added. * Thu Sep 17 2015 Alexey Makhalov 4.2.0-3 - Fix for 05- patch (SVGA mem size) - Compile out: pci hotplug, sched smt. - Compile in kernel: vmware balloon & vmci. - Module for efi vars. * Fri Sep 4 2015 Alexey Makhalov 4.2.0-2 - Hardcoded poweroff (direct write to piix4), no ACPI is required. - sd.c: Lower log level for "Assuming drive cache..." message. * Tue Sep 1 2015 Alexey Makhalov 4.2.0-1 - Update to linux-4.2.0. Enable CONFIG_EFI * Fri Aug 28 2015 Alexey Makhalov 4.1.3-5 - Added MD/LVM/DM modules. - Pci probe improvements. * Fri Aug 14 2015 Alexey Makhalov 4.1.3-4 - Use photon.cfg as a symlink. * Thu Aug 13 2015 Alexey Makhalov 4.1.3-3 - Added environment file(photon.cfg) for a grub. * Tue Aug 11 2015 Alexey Makhalov 4.1.3-2 Added pci-probe-vmware.patch. Removed unused modules. Decreased boot time. * Tue Jul 28 2015 Alexey Makhalov 4.1.3-1 Initial commit. Use patchset from Clear Linux.