%global security_hardening none Summary: Kernel Name: linux-secure Version: 4.9.34 Release: 2%{?dist} License: GPLv2 URL: http://www.kernel.org/ Group: System Environment/Kernel Vendor: VMware, Inc. Distribution: Photon Source0: http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz %define sha1 linux=d02dc269e67eae329043c9aa7d6c2d6182950c2f Source1: config-secure Source2: aufs4.9.tar.gz Source3: initramfs.trigger # common Patch0: x86-vmware-read-tsc_khz-only-once-at-boot-time.patch Patch1: x86-vmware-use-tsc_khz-value-for-calibrate_cpu.patch Patch2: x86-vmware-add-basic-paravirt-ops-support.patch Patch3: x86-vmware-add-paravirt-sched-clock.patch Patch4: x86-vmware-log-kmsg-dump-on-panic.patch Patch5: double-tcp_mem-limits.patch Patch6: linux-4.9-sysctl-sched_weighted_cpuload_uses_rla.patch Patch7: linux-4.9-watchdog-Disable-watchdog-on-virtual-machines.patch Patch8: linux-4.9-REVERT-sched-fair-Beef-up-wake_wide.patch Patch9: SUNRPC-Do-not-reuse-srcport-for-TIME_WAIT-socket.patch Patch10: SUNRPC-xs_bind-uses-ip_local_reserved_ports.patch Patch11: net-9p-vsock.patch Patch12: x86-vmware-sta.patch # secure Patch13: 0001-NOWRITEEXEC-and-PAX-features-MPROTECT-EMUTRAMP.patch Patch14: 0002-Added-rap_plugin.patch Patch15: 0003-Added-PAX_RANDKSTACK.patch # NSX requirements Patch16: LKCM.patch BuildRequires: bc BuildRequires: kbd BuildRequires: kmod-devel BuildRequires: glib-devel BuildRequires: xerces-c-devel BuildRequires: xml-security-c-devel BuildRequires: libdnet-devel BuildRequires: libmspack-devel BuildRequires: Linux-PAM-devel BuildRequires: openssl-devel BuildRequires: procps-ng-devel Requires: filesystem kmod coreutils %define uname_r %{version}-%{release}-secure %description Security hardened Linux kernel. %package devel Summary: Kernel Dev Group: System Environment/Kernel Requires: python2 gawk Requires: %{name} = %{version}-%{release} %description devel The Linux package contains the Linux kernel dev files %package docs Summary: Kernel docs Group: System Environment/Kernel Requires: python2 Requires: %{name} = %{version}-%{release} %description docs The Linux package contains the Linux kernel doc files %prep %setup -q -n linux-%{version} %setup -D -b 2 -n linux-%{version} # apply aufs patch patch -p1 < ../aufs4-standalone-aufs4.9/aufs4-kbuild.patch patch -p1 < ../aufs4-standalone-aufs4.9/aufs4-base.patch patch -p1 < ../aufs4-standalone-aufs4.9/aufs4-mmap.patch patch -p1 < ../aufs4-standalone-aufs4.9/aufs4-standalone.patch cp -a ../aufs4-standalone-aufs4.9/Documentation/ . cp -a ../aufs4-standalone-aufs4.9/fs/ . cp ../aufs4-standalone-aufs4.9/include/uapi/linux/aufs_type.h include/uapi/linux/ cat >> %{SOURCE1} << "EOF" CONFIG_AUFS_FS=m CONFIG_AUFS_BRANCH_MAX_127=y # CONFIG_AUFS_BRANCH_MAX_511 is not set # CONFIG_AUFS_BRANCH_MAX_1023 is not set # CONFIG_AUFS_BRANCH_MAX_32767 is not set CONFIG_AUFS_SBILIST=y # CONFIG_AUFS_HNOTIFY is not set # CONFIG_AUFS_EXPORT is not set # CONFIG_AUFS_XATTR is not set # CONFIG_AUFS_FHSM is not set # CONFIG_AUFS_RDU is not set # CONFIG_AUFS_SHWH is not set # CONFIG_AUFS_BR_RAMFS is not set # CONFIG_AUFS_BR_FUSE is not set CONFIG_AUFS_BDEV_LOOP=y # CONFIG_AUFS_DEBUG is not set EOF %patch0 -p1 %patch1 -p1 %patch2 -p1 %patch3 -p1 %patch4 -p1 %patch5 -p1 %patch6 -p1 %patch7 -p1 %patch8 -p1 %patch9 -p1 %patch10 -p1 %patch11 -p1 %patch12 -p1 %patch13 -p1 %patch14 -p1 %patch15 -p1 pushd .. %patch16 -p0 popd %build # patch vmw_balloon driver sed -i 's/module_init/late_initcall/' drivers/misc/vmw_balloon.c make mrproper cp %{SOURCE1} .config sed -i 's/CONFIG_LOCALVERSION="-secure"/CONFIG_LOCALVERSION="-%{release}-secure"/' .config make LC_ALL= oldconfig make VERBOSE=1 KBUILD_BUILD_VERSION="1-photon" KBUILD_BUILD_HOST="photon" ARCH="x86_64" %{?_smp_mflags} # build LKCM module bldroot=`pwd` pushd ../LKCM make -C $bldroot M=`pwd` modules popd %define __modules_install_post \ for MODULE in `find %{buildroot}/lib/modules/%{uname_r} -name *.ko` ; do \ ./scripts/sign-file sha512 certs/signing_key.pem certs/signing_key.x509 $MODULE \ rm -f $MODULE.{sig,dig} \ xz $MODULE \ done \ %{nil} # __os_install_post strips signature from modules. We need to resign it again # and then compress. Extra step is added to the default __spec_install_post. %define __spec_install_post\ %{?__debug_package:%{__debug_install_post}}\ %{__arch_install_post}\ %{__os_install_post}\ %{__modules_install_post}\ %{nil} %install install -vdm 755 %{buildroot}/etc install -vdm 755 %{buildroot}/boot install -vdm 755 %{buildroot}%{_defaultdocdir}/linux-%{uname_r} install -vdm 755 %{buildroot}/etc/modprobe.d install -vdm 755 %{buildroot}/usr/src/linux-headers-%{uname_r} make INSTALL_MOD_PATH=%{buildroot} modules_install # install LKCM module bldroot=`pwd` pushd ../LKCM make -C $bldroot M=`pwd` INSTALL_MOD_PATH=%{buildroot} modules_install popd cp -v arch/x86/boot/bzImage %{buildroot}/boot/vmlinuz-%{uname_r} cp -v System.map %{buildroot}/boot/System.map-%{uname_r} cp -v .config %{buildroot}/boot/config-%{uname_r} cp -r Documentation/* %{buildroot}%{_defaultdocdir}/linux-%{uname_r} install -vdm 755 %{buildroot}/usr/lib/debug/lib/modules/%{uname_r} cp -v vmlinux %{buildroot}/usr/lib/debug/lib/modules/%{uname_r}/vmlinux-%{uname_r} # Since we use compressed modules we cann't use load pinning, # because .ko files will be loaded from the memory (LoadPin: obj=) cat > %{buildroot}/boot/linux-%{uname_r}.cfg << "EOF" # GRUB Environment Block photon_cmdline=init=/lib/systemd/systemd ro loglevel=3 quiet no-vmw-sta loadpin.enabled=0 slub_debug=P page_poison=1 photon_linux=vmlinuz-%{uname_r} photon_initrd=initrd.img-%{uname_r} EOF # Register myself to initramfs mkdir -p %{buildroot}/%{_localstatedir}/lib/initramfs/kernel cat > %{buildroot}/%{_localstatedir}/lib/initramfs/kernel/%{uname_r} << "EOF" --add-drivers "tmem xen-acpi-processor xen-evtchn xen-gntalloc xen-gntdev xen-privcmd xen-pciback xenfs hv_utils hv_vmbus hv_balloon cn" EOF # cleanup dangling symlinks rm -f %{buildroot}/lib/modules/%{uname_r}/source rm -f %{buildroot}/lib/modules/%{uname_r}/build # create /use/src/linux-headers-*/ content find . -name Makefile* -o -name Kconfig* -o -name *.pl | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/linux-headers-%{uname_r}' copy find arch/x86/include include scripts -type f | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/linux-headers-%{uname_r}' copy find $(find arch/x86 -name include -o -name scripts -type d) -type f | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/linux-headers-%{uname_r}' copy find arch/x86/include Module.symvers include scripts -type f | xargs sh -c 'cp --parents "$@" %{buildroot}/usr/src/linux-headers-%{uname_r}' copy # copy .config manually to be where it's expected to be cp .config %{buildroot}/usr/src/linux-headers-%{uname_r} # symling to the build folder ln -sf /usr/src/linux-headers-%{uname_r} %{buildroot}/lib/modules/%{uname_r}/build %include %{SOURCE3} %post /sbin/depmod -aq %{uname_r} ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %files %defattr(-,root,root) /boot/System.map-%{uname_r} /boot/config-%{uname_r} /boot/vmlinuz-%{uname_r} %config(noreplace) /boot/linux-%{uname_r}.cfg %config %{_localstatedir}/lib/initramfs/kernel/%{uname_r} /lib/firmware/* /lib/modules/* %exclude /lib/modules/%{uname_r}/build %exclude /usr/src %files docs %defattr(-,root,root) %{_defaultdocdir}/linux-%{uname_r}/* %files devel %defattr(-,root,root) /lib/modules/%{uname_r}/build /usr/src/linux-headers-%{uname_r} %changelog * Mon Jul 03 2017 Xiaolin Li 4.9.34-2 - Add libdnet-devel, kmod-devel and libmspack-devel to BuildRequires * Wed Jun 28 2017 Alexey Makhalov 4.9.34-1 - [feature] 9P FS security support - [feature] DM Delay target support - Fix CVE-2017-1000364 ("stack clash") and CVE-2017-9605 * Thu Jun 8 2017 Alexey Makhalov 4.9.31-1 - Fix CVE-2017-8890, CVE-2017-9074, CVE-2017-9075, CVE-2017-9076 CVE-2017-9077 and CVE-2017-9242 - [feature] IPV6 netfilter NAT table support * Fri May 26 2017 Alexey Makhalov 4.9.30-1 - Fix CVE-2017-7487 and CVE-2017-9059 * Wed May 17 2017 Vinay Kulkarni 4.9.28-2 - Enable IPVLAN module. * Tue May 16 2017 Alexey Makhalov 4.9.28-1 - Version update * Wed May 10 2017 Alexey Makhalov 4.9.27-1 - Version update * Sun May 7 2017 Alexey Makhalov 4.9.26-1 - Version update - Removed version suffix from config file name * Thu Apr 27 2017 Bo Gan 4.9.24-2 - Support dynamic initrd generation * Tue Apr 25 2017 Alexey Makhalov 4.9.24-1 - Fix CVE-2017-6874 and CVE-2017-7618. - .config: build nvme and nvme-core in kernel. * Tue Mar 21 2017 Alexey Makhalov 4.9.13-3 - Added LKCM module * Mon Mar 6 2017 Alexey Makhalov 4.9.13-2 - .config: NSX requirements for crypto and netfilter * Tue Feb 28 2017 Alexey Makhalov 4.9.13-1 - Update to linux-4.9.13 to fix CVE-2017-5986 and CVE-2017-6074 - .config: disable XEN guest (needs rap_plugin verification) * Wed Feb 22 2017 Alexey Makhalov 4.9.9-2 - rap_plugin improvement: throw error on function type casting function signatures were cleaned up using this feature. - Added RAP_ENTRY for asm functions. * Thu Feb 09 2017 Alexey Makhalov 4.9.9-1 - Update to linux-4.9.9 to fix CVE-2016-10153, CVE-2017-5546, CVE-2017-5547, CVE-2017-5548 and CVE-2017-5576. - Added aufs support. - Added PAX_RANDKSTACK feature. - Extra func signatures cleanup to fix 1809717 and 1809722. - .config: added CRYPTO_FIPS support. * Tue Jan 10 2017 Alexey Makhalov 4.9.2-1 - Update to linux-4.9.2 to fix CVE-2016-10088 - Rename package to linux-secure. - Added KSPP cmdline params: slub_debug=P page_poison=1 * Mon Dec 19 2016 Xiaolin Li 4.9.0-2 - BuildRequires Linux-PAM-devel * Mon Dec 12 2016 Alexey Makhalov 4.9.0-1 - Update to linux-4.9.0 - Add paravirt stolen time accounting feature (from linux-esx), but disable it by default (no-vmw-sta cmdline parameter) - Use vmware_io_delay() to keep "void fn(void)" signature * Wed Nov 30 2016 Alexey Makhalov 4.8.0-2 - Expand `uname -r` with release number - Resign and compress modules after stripping - .config: add syscalls tracing support - .config: add cgrup_hugetlb support - .config: add netfilter_xt_{set,target_ct} support - .config: add netfilter_xt_match_{cgroup,ipvs} support - .config: disable /dev/mem * Mon Oct 17 2016 Alexey Makhalov 4.8.0-1 Initial commit.