From f2c2c469aac4757f2f87ac1b631746afde58bcb2 Mon Sep 17 00:00:00 2001 From: Jan200101 Date: Wed, 22 Jul 2020 16:20:37 +0200 Subject: kernel 5.7.9 --- SOURCES/filter-aarch64.sh | 18 ++ SOURCES/filter-armv7hl.sh | 18 ++ SOURCES/filter-i686.sh | 14 ++ SOURCES/filter-modules.sh | 170 ++++++++++++++++++ SOURCES/filter-ppc64le.sh | 14 ++ SOURCES/filter-s390x.sh | 12 ++ SOURCES/filter-x86_64.sh | 12 ++ ...-killer-wireless-ac-1550-cards-work-again.patch | 46 +++++ SOURCES/mod-extra.list | 196 +++++++++++++++++++++ SOURCES/redhatsecureboot301.cer | Bin 0 -> 899 bytes SOURCES/redhatsecureboot501.cer | Bin 0 -> 964 bytes SOURCES/redhatsecurebootca1.cer | Bin 0 -> 977 bytes SOURCES/redhatsecurebootca5.cer | Bin 0 -> 920 bytes ...ow_reading_labels_before_policy_is_loaded.patch | 48 +++++ SOURCES/x509.genkey | 16 ++ 15 files changed, 564 insertions(+) create mode 100644 SOURCES/filter-aarch64.sh create mode 100644 SOURCES/filter-armv7hl.sh create mode 100644 SOURCES/filter-i686.sh create mode 100755 SOURCES/filter-modules.sh create mode 100644 SOURCES/filter-ppc64le.sh create mode 100644 SOURCES/filter-s390x.sh create mode 100644 SOURCES/filter-x86_64.sh create mode 100644 SOURCES/iwlwifi-make-some-killer-wireless-ac-1550-cards-work-again.patch create mode 100644 SOURCES/mod-extra.list create mode 100644 SOURCES/redhatsecureboot301.cer create mode 100644 SOURCES/redhatsecureboot501.cer create mode 100644 SOURCES/redhatsecurebootca1.cer create mode 100644 SOURCES/redhatsecurebootca5.cer create mode 100644 SOURCES/selinux_allow_reading_labels_before_policy_is_loaded.patch create mode 100644 SOURCES/x509.genkey (limited to 'SOURCES') diff --git a/SOURCES/filter-aarch64.sh b/SOURCES/filter-aarch64.sh new file mode 100644 index 0000000..7c3441b --- /dev/null +++ b/SOURCES/filter-aarch64.sh @@ -0,0 +1,18 @@ +#! /bin/bash + +# This is the aarch64 override file for the core/drivers package split. The +# module directories listed here and in the generic list in filter-modules.sh +# will be moved to the resulting kernel-modules package for this arch. +# Anything not listed in those files will be in the kernel-core package. +# +# Please review the default list in filter-modules.sh before making +# modifications to the overrides below. If something should be removed across +# all arches, remove it in the default instead of per-arch. + +driverdirs="atm auxdisplay bcma bluetooth firewire fmc fpga infiniband isdn leds media memstick message mmc mtd nfc ntb pcmcia power ssb soundwire staging tty uio uwb w1" + +ethdrvs="3com adaptec arc alteon atheros broadcom cadence calxeda chelsio cisco dec dlink emulex icplus marvell micrel myricom neterion nvidia oki-semi packetengines qlogic rdc renesas sfc silan sis smsc stmicro sun tehuti ti via wiznet xircom" + +drmdrvs="amd arm bridge ast exynos hisilicon i2c imx mgag200 meson msm nouveau panel pl111 radeon rockchip tegra sun4i sun4i-drm-hdmi tinydrm vc4" + +singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwa-hc hwpoison-inject target_core_user sbp_target cxgbit iw_cxgb3 iw_cxgb4 cxgb3i cxgb3i cxgb3i_ddp cxgb4i chcr chtls" diff --git a/SOURCES/filter-armv7hl.sh b/SOURCES/filter-armv7hl.sh new file mode 100644 index 0000000..566083c --- /dev/null +++ b/SOURCES/filter-armv7hl.sh @@ -0,0 +1,18 @@ +#! /bin/bash + +# This is the armv7hl override file for the core/drivers package split. The +# module directories listed here and in the generic list in filter-modules.sh +# will be moved to the resulting kernel-modules package for this arch. +# Anything not listed in those files will be in the kernel-core package. +# +# Please review the default list in filter-modules.sh before making +# modifications to the overrides below. If something should be removed across +# all arches, remove it in the default instead of per-arch. + +driverdirs="atm auxdisplay bcma bluetooth firewire fmc fpga infiniband isdn media memstick message nfc ntb pcmcia ssb soundwire staging tty uio uwb w1" + +ethdrvs="3com adaptec alteon altera amd atheros broadcom cadence chelsio cisco dec dlink emulex icplus mellanox micrel myricom natsemi neterion nvidia oki-semi packetengines qlogic rdc renesas sfc silan sis sun tehuti via wiznet xircom" + +drmdrvs="amd arm armada bridge ast exynos etnaviv hisilicon i2c imx meson mgag200 msm nouveau omapdrm panel pl111 radeon rockchip sti stm sun4i sun4i-drm-hdmi tegra tilcdc tinydrm vc4" + +singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwa-hc hwpoison-inject target_core_user sbp_target cxgbit iw_cxgb3 iw_cxgb4 cxgb3i cxgb3i cxgb3i_ddp cxgb4i chcr chtls bq27xxx_battery_hdq" diff --git a/SOURCES/filter-i686.sh b/SOURCES/filter-i686.sh new file mode 100644 index 0000000..1a13ddf --- /dev/null +++ b/SOURCES/filter-i686.sh @@ -0,0 +1,14 @@ +#! /bin/bash + +# This is the i686 override file for the core/drivers package split. The +# module directories listed here and in the generic list in filter-modules.sh +# will be moved to the resulting kernel-modules package for this arch. +# Anything not listed in those files will be in the kernel-core package. +# +# Please review the default list in filter-modules.sh before making +# modifications to the overrides below. If something should be removed across +# all arches, remove it in the default instead of per-arch. + +driverdirs="atm auxdisplay bcma bluetooth firewire fmc fpga infiniband isdn leds media memstick mfd mmc mtd nfc ntb pcmcia platform power ssb soundwire staging tty uio uwb w1" + +singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwa-hc hwpoison-inject hid-sensor-hub hid-sensor-magn-3d hid-sensor-incl-3d hid-sensor-gyro-3d hid-sensor-iio-common hid-sensor-accel-3d hid-sensor-trigger hid-sensor-als hid-sensor-rotation hid-sensor-temperature hid-sensor-humidity target_core_user sbp_target cxgbit iw_cxgb3 iw_cxgb4 cxgb3i cxgb3i cxgb3i_ddp cxgb4i chcr chtls parport_serial regmap-sdw hid-asus" diff --git a/SOURCES/filter-modules.sh b/SOURCES/filter-modules.sh new file mode 100755 index 0000000..436dcc5 --- /dev/null +++ b/SOURCES/filter-modules.sh @@ -0,0 +1,170 @@ +#! /bin/bash +# +# Called as filter-modules.sh list-of-modules Arch + +# This script filters the modules into the kernel-core and kernel-modules +# subpackages. We list out subsystems/subdirs to prune from the installed +# module directory. What is left is put into the kernel-core package. What is +# pruned is contained in the kernel-modules package. +# +# This file contains the default subsys/subdirs to prune from all architectures. +# If an architecture needs to differ, we source a per-arch filter-.sh file +# that contains the set of override lists to be used instead. If a module or +# subsys should be in kernel-modules on all arches, please change the defaults +# listed here. + +# Overrides is individual modules which need to remain in kernel-core due to deps. +overrides="cec" + +# Set the default dirs/modules to filter out +driverdirs="atm auxdisplay bcma bluetooth firewire fmc fpga infiniband isdn leds media memstick mfd mmc mtd nfc ntb pcmcia platform power ssb soundwire staging tty uio uwb w1" + +chardrvs="mwave pcmcia" + +netdrvs="appletalk can dsa hamradio ieee802154 irda ppp slip usb wireless" + +ethdrvs="3com adaptec alteon amd aquantia atheros broadcom cadence calxeda chelsio cisco dec dlink emulex icplus marvell mellanox neterion nvidia oki-semi packetengines qlogic rdc renesas sfc silan sis smsc stmicro sun tehuti ti wiznet xircom" + +inputdrvs="gameport tablet touchscreen" + +scsidrvs="aacraid advansys aic7xxx aic94xx be2iscsi bfa bnx2i bnx2fc csiostor cxgbi esas2r fcoe fnic isci libsas lpfc megaraid mpt2sas mpt3sas mvsas pm8001 qla2xxx qla4xxx sym53c8xx_2 ufs qedf wd719x" + +usbdrvs="atm image misc serial wusbcore" + +fsdrvs="affs befs coda cramfs dlm ecryptfs hfs hfsplus jfs jffs2 minix ncpfs nilfs2 ocfs2 reiserfs romfs squashfs sysv ubifs ufs" + +netprots="6lowpan appletalk atm ax25 batman-adv bluetooth can dccp dsa ieee802154 irda l2tp mac80211 mac802154 mpls netrom nfc rds rfkill rose sctp smc wireless" + +drmdrvs="amd ast bridge gma500 i2c i915 mgag200 nouveau panel radeon" + +iiodrvs="accel adc afe common dac gyro health humidity light magnetometer multiplexer orientation potentiometer potentiostat pressure temperature" + +singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwa-hc hwpoison-inject target_core_user sbp_target cxgbit iw_cxgb3 iw_cxgb4 cxgb3i cxgb3i cxgb3i_ddp cxgb4i chcr chtls parport_serial regmap-sdw hid-asus" + +# Grab the arch-specific filter list overrides +source ./filter-$2.sh + +filter_dir() { + filelist=$1 + dir=$2 + + grep -v -e "${dir}/" ${filelist} > ${filelist}.tmp + + if [ $? -ne 0 ] + then + echo "Couldn't remove ${dir}. Skipping." + else + grep -e "${dir}/" ${filelist} >> k-d.list + mv ${filelist}.tmp $filelist + fi + + return 0 +} + +filter_ko() { + filelist=$1 + mod=$2 + + grep -v -e "${mod}.ko" ${filelist} > ${filelist}.tmp + + if [ $? -ne 0 ] + then + echo "Couldn't remove ${mod}.ko Skipping." + else + grep -e "${mod}.ko" ${filelist} >> k-d.list + mv ${filelist}.tmp $filelist + fi + + return 0 +} + +# Filter the drivers/ subsystems +for subsys in ${driverdirs} +do + filter_dir $1 drivers/${subsys} +done + +# Filter the networking drivers +for netdrv in ${netdrvs} +do + filter_dir $1 drivers/net/${netdrv} +done + +# Filter the char drivers +for char in ${chardrvs} +do + filter_dir $1 drivers/char/${input} +done + +# Filter the ethernet drivers +for eth in ${ethdrvs} +do + filter_dir $1 drivers/net/ethernet/${eth} +done + +# SCSI +for scsi in ${scsidrvs} +do + filter_dir $1 drivers/scsi/${scsi} +done + +# Input +for input in ${inputdrvs} +do + filter_dir $1 drivers/input/${input} +done + +# USB +for usb in ${usbdrvs} +do + filter_dir $1 drivers/usb/${usb} +done + +# Filesystems +for fs in ${fsdrvs} +do + filter_dir $1 fs/${fs} +done + +# Network protocols +for prot in ${netprots} +do + filter_dir $1 kernel/net/${prot} +done + +# DRM +for drm in ${drmdrvs} +do + filter_dir $1 drivers/gpu/drm/${drm} +done + +# Just kill sound. +filter_dir $1 kernel/sound + +# Now go through and filter any single .ko files that might have deps on the +# things we filtered above +for mod in ${singlemods} +do + filter_ko $1 ${mod} +done + +# Now process the override list to bring those modules back into core +for mod in ${overrides} +do + grep -v -e "/${mod}.ko" k-d.list > k-d.list.tmp + if [ $? -ne 0 ] + then + echo "Couldn't save ${mod}.ko Skipping." + else + grep -e "/${mod}.ko" k-d.list >> $filelist + mv k-d.list.tmp k-d.list + fi + +done + +# Go through our generated drivers list and remove the .ko files. We'll +# restore them later. +for mod in `cat k-d.list` +do + rm -rf $mod +done diff --git a/SOURCES/filter-ppc64le.sh b/SOURCES/filter-ppc64le.sh new file mode 100644 index 0000000..24d3f13 --- /dev/null +++ b/SOURCES/filter-ppc64le.sh @@ -0,0 +1,14 @@ +#! /bin/bash + +# This is the ppc64le override file for the core/drivers package split. The +# module directories listed here and in the generic list in filter-modules.sh +# will be moved to the resulting kernel-modules package for this arch. +# Anything not listed in those files will be in the kernel-core package. +# +# Please review the default list in filter-modules.sh before making +# modifications to the overrides below. If something should be removed across +# all arches, remove it in the default instead of per-arch. + +driverdirs="atm auxdisplay bcma bluetooth firewire fmc fpga infiniband isdn leds media memstick message mmc mtd nfc ntb pcmcia platform power ssb staging tty uio uwb w1" + +singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs megaraid pmcraid qedi qla1280 9pnet_rdma rpcrdma nvmet-rdma nvme-rdma hid-picolcd hid-prodikeys hwa-hc hwpoison-inject target_core_user sbp_target cxgbit iw_cxgb3 iw_cxgb4 cxgb3i cxgb3i cxgb3i_ddp cxgb4i chcr chtls" diff --git a/SOURCES/filter-s390x.sh b/SOURCES/filter-s390x.sh new file mode 100644 index 0000000..04f7110 --- /dev/null +++ b/SOURCES/filter-s390x.sh @@ -0,0 +1,12 @@ +#! /bin/bash + +# This is the s390x override file for the core/drivers package split. The +# module directories listed here and in the generic list in filter-modules.sh +# will be moved to the resulting kernel-modules package for this arch. +# Anything not listed in those files will be in the kernel-core package. +# +# Please review the default list in filter-modules.sh before making +# modifications to the overrides below. If something should be removed across +# all arches, remove it in the default instead of per-arch. + +# Defaults work so no need to override diff --git a/SOURCES/filter-x86_64.sh b/SOURCES/filter-x86_64.sh new file mode 100644 index 0000000..1aa80f2 --- /dev/null +++ b/SOURCES/filter-x86_64.sh @@ -0,0 +1,12 @@ +#! /bin/bash + +# This is the x86_64 override file for the core/drivers package split. The +# module directories listed here and in the generic list in filter-modules.sh +# will be moved to the resulting kernel-modules package for this arch. +# Anything not listed in those files will be in the kernel-core package. +# +# Please review the default list in filter-modules.sh before making +# modifications to the overrides below. If something should be removed across +# all arches, remove it in the default instead of per-arch. + +# Defaults work so no need to override diff --git a/SOURCES/iwlwifi-make-some-killer-wireless-ac-1550-cards-work-again.patch b/SOURCES/iwlwifi-make-some-killer-wireless-ac-1550-cards-work-again.patch new file mode 100644 index 0000000..8bbbd79 --- /dev/null +++ b/SOURCES/iwlwifi-make-some-killer-wireless-ac-1550-cards-work-again.patch @@ -0,0 +1,46 @@ +From MAILER-DAEMON Wed Jul 15 12:54:09 2020 +From: Alessio Bonfiglio +To: linux-wireless@vger.kernel.org +Cc: Alessio Bonfiglio , Johannes Berg , Emmanuel Grumbach , Luca Coelho , Intel Linux Wireless +Subject: [PATCH v2] iwlwifi: Make some Killer Wireless-AC 1550 cards work again +Date: Tue, 14 Jul 2020 11:19:11 +0200 +Message-Id: <20200714091911.4442-1-alessio.bonfiglio@mail.polimi.it> +In-Reply-To: <87imeqcwbt.fsf@tynnyri.adurom.net> +References: <87imeqcwbt.fsf@tynnyri.adurom.net> +Sender: linux-wireless-owner@vger.kernel.org +List-ID: +X-Mailing-List: linux-wireless@vger.kernel.org +MIME-Version: 1.0 +Content-Type: text/plain; charset="utf-8" +Content-Transfer-Encoding: 7bit + +Fix the regression introduced by commit c8685937d07f ("iwlwifi: move +pu devices to new table") by adding the ids and the configurations of +two missing Killer 1550 cards in order to configure and let them work +correctly again (following the new table convention). +Resolve bug 208141 ("Wireless ac 9560 not working kernel 5.7.2", +https://bugzilla.kernel.org/show_bug.cgi?id=208141). + +Fixes: c8685937d07f ("iwlwifi: move pu devices to new table") +Signed-off-by: Alessio Bonfiglio +--- + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 65d65c6baf4c..e02bafb8921f 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -582,6 +582,8 @@ static const struct iwl_dev_info iwl_dev_info_table[] = { + IWL_DEV_INFO(0x30DC, 0x1552, iwl9560_2ac_cfg_soc, iwl9560_killer_1550i_name), + IWL_DEV_INFO(0x31DC, 0x1551, iwl9560_2ac_cfg_soc, iwl9560_killer_1550s_name), + IWL_DEV_INFO(0x31DC, 0x1552, iwl9560_2ac_cfg_soc, iwl9560_killer_1550i_name), ++ IWL_DEV_INFO(0xA370, 0x1551, iwl9560_2ac_cfg_soc, iwl9560_killer_1550s_name), ++ IWL_DEV_INFO(0xA370, 0x1552, iwl9560_2ac_cfg_soc, iwl9560_killer_1550i_name), + + IWL_DEV_INFO(0x271C, 0x0214, iwl9260_2ac_cfg, iwl9260_1_name), + +-- +2.27.0 + + diff --git a/SOURCES/mod-extra.list b/SOURCES/mod-extra.list new file mode 100644 index 0000000..8140f5c --- /dev/null +++ b/SOURCES/mod-extra.list @@ -0,0 +1,196 @@ +6pack.ko +a3d.ko +act200l-sir.ko +actisys-sir.ko +adi.ko +aer_inject.ko +af_802154.ko +affs.ko +ali-ircc.ko +analog.ko +appletalk.ko +atm.ko +avma1_cs.ko +avm_cs.ko +avmfritz.ko +ax25.ko +b1.ko +bas_gigaset.ko +batman-adv.ko +baycom_par.ko +baycom_ser_fdx.ko +baycom_ser_hdx.ko +befs.ko +bpqether.ko +br2684.ko +capi.ko +c_can.ko +c_can_platform.ko +clip.ko +cobra.ko +coda.ko +cuse.ko +db9.ko +dccp_diag.ko +dccp_ipv4.ko +dccp_ipv6.ko +dccp.ko +dccp_probe.ko +diva_idi.ko +divas.ko +dlm.ko +ds1wm.ko +ds2482.ko +ds2490.ko +dss1_divert.ko +elsa_cs.ko +ems_pci.ko +ems_usb.ko +esd_usb2.ko +esi-sir.ko +floppy.ko +gamecon.ko +gf2k.ko +gfs2.ko +gigaset.ko +girbil-sir.ko +grip.ko +grip_mp.ko +guillemot.ko +hdlcdrv.ko +hfc4s8s_l1.ko +hfcmulti.ko +hfcpci.ko +hisax.ko +hwa-rc.ko +hysdn.ko +i2400m.ko +i2400m-sdio.ko +i2400m-usb.ko +ieee802154.ko +iforce.ko +interact.ko +ipddp.ko +ipx.ko +isdn.ko +joydump.ko +kingsun-sir.ko +ks959-sir.ko +ksdazzle-sir.ko +kvaser_pci.ko +l2tp_core.ko +l2tp_debugfs.ko +l2tp_eth.ko +l2tp_ip.ko +l2tp_netlink.ko +l2tp_ppp.ko +lec.ko +ma600-sir.ko +magellan.ko +mcp2120-sir.ko +mISDN_core.ko +mISDN_dsp.ko +mkiss.ko +mptbase.ko +mptctl.ko +mptfc.ko +nci.ko +ncpfs.ko +netjet.ko +netrom.ko +nfc.ko +nilfs2.ko +ocfs2_dlmfs.ko +ocfs2_dlm.ko +ocfs2.ko +ocfs2_nodemanager.ko +ocfs2_stackglue.ko +ocfs2_stack_o2cb.ko +ocfs2_stack_user.ko +old_belkin-sir.ko +orinoco_cs.ko +orinoco.ko +orinoco_nortel.ko +orinoco_pci.ko +orinoco_plx.ko +orinoco_usb.ko +pcspkr.ko +plx_pci.ko +pn_pep.ko +pppoatm.ko +rds.ko +rds_rdma.ko +rds_tcp.ko +rose.ko +sch_atm.ko +sch_cbq.ko +sch_choke.ko +sch_drr.ko +sch_dsmark.ko +sch_etf.ko +sch_gred.ko +sch_mqprio.ko +sch_multiq.ko +sch_netem.ko +sch_qfq.ko +sch_red.ko +sch_sfb.ko +sch_teql.ko +sctp.ko +sctp_probe.ko +sidewinder.ko +sja1000.ko +sja1000_platform.ko +slcan.ko +slip.ko +softing_cs.ko +softing.ko +spaceball.ko +spaceorb.ko +stinger.ko +sysv.ko +tcp_bic.ko +tcp_highspeed.ko +tcp_htcp.ko +tcp_hybla.ko +tcp_illinois.ko +tcp_lp.ko +tcp_scalable.ko +tcp_vegas.ko +tcp_veno.ko +tcp_westwood.ko +tcp_yeah.ko +tekram-sir.ko +tmdc.ko +toim3232-sir.ko +trancevibrator.ko +turbografx.ko +twidjoy.ko +ubifs.ko +ufs.ko +umc.ko +usbip-core.ko +usbip-host.ko +uwb.ko +vcan.ko +vhci-hcd.ko +w1_bq27000.ko +w1_ds2408.ko +w1_ds2423.ko +w1_ds2431.ko +w1_ds2433.ko +w1_ds2760.ko +w1_ds2780.ko +w1_ds2781.ko +w1_ds28e04.ko +w1_smem.ko +w1_therm.ko +w6692.ko +walkera0701.ko +wanrouter.ko +warrior.ko +whci.ko +wire.ko +xpad.ko +yam.ko +zhenhua.ko diff --git a/SOURCES/redhatsecureboot301.cer b/SOURCES/redhatsecureboot301.cer new file mode 100644 index 0000000..20e6604 Binary files /dev/null and b/SOURCES/redhatsecureboot301.cer differ diff --git a/SOURCES/redhatsecureboot501.cer b/SOURCES/redhatsecureboot501.cer new file mode 100644 index 0000000..dfa7afb Binary files /dev/null and b/SOURCES/redhatsecureboot501.cer differ diff --git a/SOURCES/redhatsecurebootca1.cer b/SOURCES/redhatsecurebootca1.cer new file mode 100644 index 0000000..b235400 Binary files /dev/null and b/SOURCES/redhatsecurebootca1.cer differ diff --git a/SOURCES/redhatsecurebootca5.cer b/SOURCES/redhatsecurebootca5.cer new file mode 100644 index 0000000..dfb0284 Binary files /dev/null and b/SOURCES/redhatsecurebootca5.cer differ diff --git a/SOURCES/selinux_allow_reading_labels_before_policy_is_loaded.patch b/SOURCES/selinux_allow_reading_labels_before_policy_is_loaded.patch new file mode 100644 index 0000000..5335915 --- /dev/null +++ b/SOURCES/selinux_allow_reading_labels_before_policy_is_loaded.patch @@ -0,0 +1,48 @@ +From c8e222616c7e98305bdc861db3ccac520bc29921 Mon Sep 17 00:00:00 2001 +From: Jonathan Lebon +Date: Thu, 28 May 2020 10:39:40 -0400 +Subject: selinux: allow reading labels before policy is loaded + +This patch does for `getxattr` what commit 3e3e24b42043 ("selinux: allow +labeling before policy is loaded") did for `setxattr`; it allows +querying the current SELinux label on disk before the policy is loaded. + +One of the motivations described in that commit message also drives this +patch: for Fedora CoreOS (and eventually RHEL CoreOS), we want to be +able to move the root filesystem for example, from xfs to ext4 on RAID, +on first boot, at initrd time.[1] + +Because such an operation works at the filesystem level, we need to be +able to read the SELinux labels first from the original root, and apply +them to the files of the new root. The previous commit enabled the +second part of this process; this commit enables the first part. + +[1] https://github.com/coreos/fedora-coreos-tracker/issues/94 + +Acked-by: Stephen Smalley +Signed-off-by: Jonathan Lebon +Signed-off-by: Paul Moore +--- + security/selinux/hooks.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index efa6108b1ce9..ca901025802a 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -3332,7 +3332,12 @@ static int selinux_inode_getsecurity(struct inode *inode, const char *name, void + char *context = NULL; + struct inode_security_struct *isec; + +- if (strcmp(name, XATTR_SELINUX_SUFFIX)) ++ /* ++ * If we're not initialized yet, then we can't validate contexts, so ++ * just let vfs_getxattr fall back to using the on-disk xattr. ++ */ ++ if (!selinux_initialized(&selinux_state) || ++ strcmp(name, XATTR_SELINUX_SUFFIX)) + return -EOPNOTSUPP; + + /* +-- +cgit 1.2.3-1.el7 diff --git a/SOURCES/x509.genkey b/SOURCES/x509.genkey new file mode 100644 index 0000000..2f90e1b --- /dev/null +++ b/SOURCES/x509.genkey @@ -0,0 +1,16 @@ +[ req ] +default_bits = 4096 +distinguished_name = req_distinguished_name +prompt = no +x509_extensions = myexts + +[ req_distinguished_name ] +O = Fedora +CN = Fedora kernel signing key +emailAddress = kernel-team@fedoraproject.org + +[ myexts ] +basicConstraints=critical,CA:FALSE +keyUsage=digitalSignature +subjectKeyIdentifier=hash +authorityKeyIdentifier=keyid -- cgit v1.2.3