Add linux-aufs-lts
This commit is contained in:
parent
83607694d2
commit
1b542f423f
|
|
@ -0,0 +1,103 @@
|
|||
From 4e54373158caa50df5402fdd3db1794c5394026b Mon Sep 17 00:00:00 2001
|
||||
Message-Id: <4e54373158caa50df5402fdd3db1794c5394026b.1516188238.git.jan.steffens@gmail.com>
|
||||
From: Serge Hallyn <serge.hallyn@canonical.com>
|
||||
Date: Fri, 31 May 2013 19:12:12 +0100
|
||||
Subject: [PATCH 1/4] add sysctl to disallow unprivileged CLONE_NEWUSER by
|
||||
default
|
||||
|
||||
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
|
||||
[bwh: Remove unneeded binary sysctl bits]
|
||||
Signed-off-by: Daniel Micay <danielmicay@gmail.com>
|
||||
---
|
||||
kernel/fork.c | 15 +++++++++++++++
|
||||
kernel/sysctl.c | 12 ++++++++++++
|
||||
kernel/user_namespace.c | 3 +++
|
||||
3 files changed, 30 insertions(+)
|
||||
|
||||
diff --git a/kernel/fork.c b/kernel/fork.c
|
||||
index 500ce64517d9..35f5860958b4 100644
|
||||
--- a/kernel/fork.c
|
||||
+++ b/kernel/fork.c
|
||||
@@ -102,6 +102,11 @@
|
||||
|
||||
#define CREATE_TRACE_POINTS
|
||||
#include <trace/events/task.h>
|
||||
+#ifdef CONFIG_USER_NS
|
||||
+extern int unprivileged_userns_clone;
|
||||
+#else
|
||||
+#define unprivileged_userns_clone 0
|
||||
+#endif
|
||||
|
||||
/*
|
||||
* Minimum number of threads to boot the kernel
|
||||
@@ -1554,6 +1559,10 @@ static __latent_entropy struct task_struct *copy_process(
|
||||
if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
|
||||
return ERR_PTR(-EINVAL);
|
||||
|
||||
+ if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone)
|
||||
+ if (!capable(CAP_SYS_ADMIN))
|
||||
+ return ERR_PTR(-EPERM);
|
||||
+
|
||||
/*
|
||||
* Thread groups must share signals as well, and detached threads
|
||||
* can only be started up within the thread group.
|
||||
@@ -2347,6 +2356,12 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
|
||||
if (unshare_flags & CLONE_NEWNS)
|
||||
unshare_flags |= CLONE_FS;
|
||||
|
||||
+ if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) {
|
||||
+ err = -EPERM;
|
||||
+ if (!capable(CAP_SYS_ADMIN))
|
||||
+ goto bad_unshare_out;
|
||||
+ }
|
||||
+
|
||||
err = check_unshare_flags(unshare_flags);
|
||||
if (err)
|
||||
goto bad_unshare_out;
|
||||
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
|
||||
index 56aca862c4f5..e8402ba393c1 100644
|
||||
--- a/kernel/sysctl.c
|
||||
+++ b/kernel/sysctl.c
|
||||
@@ -105,6 +105,9 @@ extern int core_uses_pid;
|
||||
extern char core_pattern[];
|
||||
extern unsigned int core_pipe_limit;
|
||||
#endif
|
||||
+#ifdef CONFIG_USER_NS
|
||||
+extern int unprivileged_userns_clone;
|
||||
+#endif
|
||||
extern int pid_max;
|
||||
extern int pid_max_min, pid_max_max;
|
||||
extern int percpu_pagelist_fraction;
|
||||
@@ -513,6 +516,15 @@ static struct ctl_table kern_table[] = {
|
||||
.proc_handler = proc_dointvec,
|
||||
},
|
||||
#endif
|
||||
+#ifdef CONFIG_USER_NS
|
||||
+ {
|
||||
+ .procname = "unprivileged_userns_clone",
|
||||
+ .data = &unprivileged_userns_clone,
|
||||
+ .maxlen = sizeof(int),
|
||||
+ .mode = 0644,
|
||||
+ .proc_handler = proc_dointvec,
|
||||
+ },
|
||||
+#endif
|
||||
#ifdef CONFIG_PROC_SYSCTL
|
||||
{
|
||||
.procname = "tainted",
|
||||
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
|
||||
index c490f1e4313b..dd03bd39d7bf 100644
|
||||
--- a/kernel/user_namespace.c
|
||||
+++ b/kernel/user_namespace.c
|
||||
@@ -24,6 +24,9 @@
|
||||
#include <linux/projid.h>
|
||||
#include <linux/fs_struct.h>
|
||||
|
||||
+/* sysctl */
|
||||
+int unprivileged_userns_clone;
|
||||
+
|
||||
static struct kmem_cache *user_ns_cachep __read_mostly;
|
||||
static DEFINE_MUTEX(userns_state_mutex);
|
||||
|
||||
--
|
||||
2.15.1
|
||||
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
[Trigger]
|
||||
Type = File
|
||||
Operation = Install
|
||||
Operation = Upgrade
|
||||
Operation = Remove
|
||||
Target = usr/lib/modules/%KERNVER%/*
|
||||
Target = usr/lib/modules/%EXTRAMODULES%/*
|
||||
|
||||
[Action]
|
||||
Description = Updating %PKGBASE% module dependencies...
|
||||
When = PostTransaction
|
||||
Exec = /usr/bin/depmod %KERNVER%
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
[Trigger]
|
||||
Type = File
|
||||
Operation = Install
|
||||
Operation = Upgrade
|
||||
Target = boot/vmlinuz-%PKGBASE%
|
||||
Target = usr/lib/initcpio/*
|
||||
|
||||
[Action]
|
||||
Description = Updating %PKGBASE% initcpios...
|
||||
When = PostTransaction
|
||||
Exec = /usr/bin/mkinitcpio -p %PKGBASE%
|
||||
|
|
@ -0,0 +1,262 @@
|
|||
# Maintainer: Andreas Radke <andyrtr@archlinux.org>
|
||||
|
||||
pkgbase=linux-aufs-lts
|
||||
#pkgbase=linux-lts-custom
|
||||
_srcname=linux-4.19
|
||||
pkgver=4.19.13
|
||||
pkgrel=1
|
||||
arch=('x86_64')
|
||||
url="https://www.kernel.org/"
|
||||
license=('GPL2')
|
||||
makedepends=('xmlto' 'kmod' 'inetutils' 'bc' 'libelf' 'git')
|
||||
options=('!strip')
|
||||
source=(https://www.kernel.org/pub/linux/kernel/v4.x/${_srcname}.tar.{xz,sign}
|
||||
https://www.kernel.org/pub/linux/kernel/v4.x/patch-${pkgver}.xz
|
||||
'config' # the main kernel config file
|
||||
'60-linux.hook' # pacman hook for depmod
|
||||
'90-linux.hook' # pacman hook for initramfs regeneration
|
||||
'linux-lts.preset' # standard config files for mkinitcpio ramdisk
|
||||
0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch)
|
||||
validpgpkeys=('ABAF11C65A2970B130ABE3C479BE3E4300411886' # Linus Torvalds <torvalds@linux-foundation.org>
|
||||
'647F28654894E3BD457199BE38DBBDC86092693E' # Greg Kroah-Hartman (Linux kernel stable release signing key) <greg@kroah.com>
|
||||
)
|
||||
# https://www.kernel.org/pub/linux/kernel/v4.x/sha256sums.asc
|
||||
sha256sums=('0c68f5655528aed4f99dae71a5b259edc93239fa899e2df79c055275c21749a1'
|
||||
'SKIP'
|
||||
'6b9be1fe9446535e1fcdd50ec9be4aec538466e4b9121b3434a6c29669834610'
|
||||
'3afefd12869c13a1b57de1ae7db54c7c6a00487fc935df18f15f434c7e8c173d'
|
||||
'ae2e95db94ef7176207c690224169594d49445e04249d2499e9d2fbc117a0b21'
|
||||
'75f99f5239e03238f88d1a834c50043ec32b1dc568f2cc291b07d04718483919'
|
||||
'ad6344badc91ad0630caacde83f7f9b97276f80d26a20619a87952be65492c65'
|
||||
'36b1118c8dedadc4851150ddd4eb07b1c58ac5bbf3022cc2501a27c2b476da98')
|
||||
|
||||
_kernelname=${pkgbase#linux}
|
||||
|
||||
_basekernel=4.19
|
||||
_aufs4git="https://github.com/sfjro/aufs4-standalone.git"
|
||||
_aufs4name=aufs4-standalone
|
||||
|
||||
prepare() {
|
||||
cd ${_srcname}
|
||||
|
||||
# add upstream patch
|
||||
patch -p1 -i ../patch-${pkgver}
|
||||
chmod +x tools/objtool/sync-check.sh # GNU patch doesn't support git-style file mode
|
||||
|
||||
msg "Fetching and applying aufs4 patches"
|
||||
git clone ${_aufs4git} ${_aufs4name}
|
||||
cd ${_aufs4name}
|
||||
git checkout origin/aufs${_basekernel} || _aufs4checkout=KRAKRA
|
||||
if [[ ${_aufs4checkout} = "KRAKRA" ]]; then
|
||||
echo
|
||||
msg "AUFS4 not yet ported to version ${_basekernel}! Aborting build."
|
||||
exit 1
|
||||
echo
|
||||
cd ..
|
||||
else
|
||||
# mkdir -p "${pkgdir}/usr/src/linux-${_kernver}/include"
|
||||
# mv include/linux/Kbuild "${pkgdir}/usr/src/linux-${_kernver}/include/"
|
||||
rm include/uapi/linux/Kbuild
|
||||
cd ..
|
||||
cp -a ${_aufs4name}/{Documentation,fs,include} ${srcdir}/linux-${_basekernel}/
|
||||
msg "Patching aufs4"
|
||||
for _patch in ${_aufs4name}/*.patch; do
|
||||
patch -Np1 -i ${_patch} || _aufs4fail=KRAKRA
|
||||
done
|
||||
if [[ ${_aufs4fail} = "KRAKRA" ]]; then
|
||||
msg "Not all aufs4 patches applied correctly. Aborting build."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# security patches
|
||||
|
||||
# add latest fixes from stable queue, if needed
|
||||
# http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git
|
||||
|
||||
# disable USER_NS for non-root users by default
|
||||
patch -Np1 -i ../0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch
|
||||
|
||||
cp -Tf ../config .config
|
||||
|
||||
if [ "${_kernelname}" != "" ]; then
|
||||
sed -i "s|CONFIG_LOCALVERSION=.*|CONFIG_LOCALVERSION=\"${_kernelname}\"|g" ./.config
|
||||
sed -i "s|CONFIG_LOCALVERSION_AUTO=.*|CONFIG_LOCALVERSION_AUTO=n|" ./.config
|
||||
fi
|
||||
|
||||
# set extraversion to pkgrel
|
||||
sed -ri "s|^(EXTRAVERSION =).*|\1 -${pkgrel}|" Makefile
|
||||
|
||||
# don't run depmod on 'make install'. We'll do this ourselves in packaging
|
||||
sed -i '2iexit 0' scripts/depmod.sh
|
||||
|
||||
# get kernel version
|
||||
make prepare
|
||||
|
||||
# load configuration
|
||||
# Configure the kernel. Replace the line below with one of your choice.
|
||||
#make menuconfig # CLI menu for configuration
|
||||
#make nconfig # new CLI menu for configuration
|
||||
#make xconfig # X-based configuration
|
||||
#make oldconfig # using old config from previous kernel version
|
||||
# ... or manually edit .config
|
||||
|
||||
# rewrite configuration
|
||||
yes "" | make config >/dev/null
|
||||
}
|
||||
|
||||
build() {
|
||||
cd ${_srcname}
|
||||
|
||||
make ${MAKEFLAGS} LOCALVERSION= bzImage modules
|
||||
}
|
||||
|
||||
_package() {
|
||||
pkgdesc="The ${pkgbase/linux/Linux} kernel and modules"
|
||||
[ "${pkgbase}" = "linux" ] && groups=('base')
|
||||
depends=('coreutils' 'linux-firmware' 'kmod' 'mkinitcpio>=0.7')
|
||||
optdepends=('crda: to set the correct wireless channels of your country')
|
||||
backup=("etc/mkinitcpio.d/${pkgbase}.preset")
|
||||
install=linux-lts.install
|
||||
|
||||
cd ${_srcname}
|
||||
|
||||
# get kernel version
|
||||
_kernver="$(make LOCALVERSION= kernelrelease)"
|
||||
_basekernel=${_kernver%%-*}
|
||||
_basekernel=${_basekernel%.*}
|
||||
|
||||
mkdir -p "${pkgdir}"/{boot,usr/lib/modules}
|
||||
make LOCALVERSION= INSTALL_MOD_PATH="${pkgdir}/usr" modules_install
|
||||
cp arch/x86/boot/bzImage "${pkgdir}/boot/vmlinuz-${pkgbase}"
|
||||
|
||||
# systemd expects to find the kernel here to allow hibernation
|
||||
# https://github.com/systemd/systemd/commit/edda44605f06a41fb86b7ab8128dcf99161d2344
|
||||
ln -sr "${pkgdir}/boot/vmlinuz-${pkgbase}" "${pkgdir}/usr/lib/modules/${_kernver}/vmlinuz"
|
||||
|
||||
# make room for external modules
|
||||
local _extramodules="extramodules-${_basekernel}${_kernelname:--lts}"
|
||||
ln -s "../${_extramodules}" "${pkgdir}/usr/lib/modules/${_kernver}/extramodules"
|
||||
|
||||
# add real version for building modules and running depmod from hook
|
||||
echo "${_kernver}" |
|
||||
install -Dm644 /dev/stdin "${pkgdir}/usr/lib/modules/${_extramodules}/version"
|
||||
|
||||
# remove build and source links
|
||||
rm "${pkgdir}"/usr/lib/modules/${_kernver}/{source,build}
|
||||
|
||||
# now we call depmod...
|
||||
depmod -b "${pkgdir}/usr" -F System.map "${_kernver}"
|
||||
|
||||
# add vmlinux
|
||||
install -Dt "${pkgdir}/usr/lib/modules/${_kernver}/build" -m644 vmlinux
|
||||
|
||||
# sed expression for following substitutions
|
||||
local _subst="
|
||||
s|%PKGBASE%|${pkgbase}|g
|
||||
s|%KERNVER%|${_kernver}|g
|
||||
s|%EXTRAMODULES%|${_extramodules}|g
|
||||
"
|
||||
|
||||
# hack to allow specifying an initially nonexisting install file
|
||||
sed "${_subst}" "${startdir}/${install}" > "${startdir}/${install}.pkg"
|
||||
true && install=${install}.pkg
|
||||
|
||||
# install mkinitcpio preset file
|
||||
sed "${_subst}" ../linux-lts.preset |
|
||||
install -Dm644 /dev/stdin "${pkgdir}/etc/mkinitcpio.d/${pkgbase}.preset"
|
||||
|
||||
# install pacman hooks
|
||||
sed "${_subst}" ../60-linux.hook |
|
||||
install -Dm644 /dev/stdin "${pkgdir}/usr/share/libalpm/hooks/60-${pkgbase}.hook"
|
||||
sed "${_subst}" ../90-linux.hook |
|
||||
install -Dm644 /dev/stdin "${pkgdir}/usr/share/libalpm/hooks/90-${pkgbase}.hook"
|
||||
}
|
||||
|
||||
_package-headers() {
|
||||
pkgdesc="Header files and scripts for building modules for ${pkgbase/linux/Linux} kernel"
|
||||
|
||||
cd ${_srcname}
|
||||
local _builddir="${pkgdir}/usr/lib/modules/${_kernver}/build"
|
||||
|
||||
install -Dt "${_builddir}" -m644 Makefile .config Module.symvers
|
||||
install -Dt "${_builddir}/kernel" -m644 kernel/Makefile
|
||||
|
||||
mkdir "${_builddir}/.tmp_versions"
|
||||
|
||||
cp -t "${_builddir}" -a include scripts
|
||||
|
||||
install -Dt "${_builddir}/arch/x86" -m644 arch/x86/Makefile
|
||||
install -Dt "${_builddir}/arch/x86/kernel" -m644 arch/x86/kernel/asm-offsets.s
|
||||
|
||||
cp -t "${_builddir}/arch/x86" -a arch/x86/include
|
||||
|
||||
install -Dt "${_builddir}/drivers/md" -m644 drivers/md/*.h
|
||||
install -Dt "${_builddir}/net/mac80211" -m644 net/mac80211/*.h
|
||||
|
||||
# http://bugs.archlinux.org/task/13146
|
||||
install -Dt "${_builddir}/drivers/media/i2c" -m644 drivers/media/i2c/msp3400-driver.h
|
||||
|
||||
# http://bugs.archlinux.org/task/20402
|
||||
install -Dt "${_builddir}/drivers/media/usb/dvb-usb" -m644 drivers/media/usb/dvb-usb/*.h
|
||||
install -Dt "${_builddir}/drivers/media/dvb-frontends" -m644 drivers/media/dvb-frontends/*.h
|
||||
install -Dt "${_builddir}/drivers/media/tuners" -m644 drivers/media/tuners/*.h
|
||||
|
||||
# add xfs and shmem for aufs building
|
||||
mkdir -p "${_builddir}"/{fs/xfs,mm}
|
||||
|
||||
# copy in Kconfig files
|
||||
find . -name Kconfig\* -exec install -Dm644 {} "${_builddir}/{}" \;
|
||||
|
||||
# add objtool for external module building and enabled VALIDATION_STACK option
|
||||
install -Dt "${_builddir}/tools/objtool" tools/objtool/objtool
|
||||
|
||||
# remove unneeded architectures
|
||||
local _arch
|
||||
for _arch in "${_builddir}"/arch/*/; do
|
||||
[[ ${_arch} == */x86/ ]] && continue
|
||||
rm -r "${_arch}"
|
||||
done
|
||||
|
||||
# remove files already in linux-docs package
|
||||
rm -r "${_builddir}/Documentation"
|
||||
|
||||
# remove now broken symlinks
|
||||
find -L "${_builddir}" -type l -printf 'Removing %P\n' -delete
|
||||
|
||||
# Fix permissions
|
||||
chmod -R u=rwX,go=rX "${_builddir}"
|
||||
|
||||
# strip scripts directory
|
||||
local _binary _strip
|
||||
while read -rd '' _binary; do
|
||||
case "$(file -bi "${_binary}")" in
|
||||
*application/x-sharedlib*) _strip="${STRIP_SHARED}" ;; # Libraries (.so)
|
||||
*application/x-archive*) _strip="${STRIP_STATIC}" ;; # Libraries (.a)
|
||||
*application/x-executable*) _strip="${STRIP_BINARIES}" ;; # Binaries
|
||||
*) continue ;;
|
||||
esac
|
||||
/usr/bin/strip ${_strip} "${_binary}"
|
||||
done < <(find "${_builddir}/scripts" -type f -perm -u+w -print0 2>/dev/null)
|
||||
}
|
||||
|
||||
_package-docs() {
|
||||
pkgdesc="Kernel hackers manual - HTML documentation that comes with the ${pkgbase/linux/Linux} kernel"
|
||||
|
||||
cd ${_srcname}
|
||||
local _builddir="${pkgdir}/usr/lib/modules/${_kernver}/build"
|
||||
|
||||
mkdir -p "${_builddir}"
|
||||
cp -t "${_builddir}" -a Documentation
|
||||
|
||||
# Fix permissions
|
||||
chmod -R u=rwX,go=rX "${_builddir}"
|
||||
}
|
||||
|
||||
pkgname=("${pkgbase}" "${pkgbase}-headers" "${pkgbase}-docs")
|
||||
for _p in ${pkgname[@]}; do
|
||||
eval "package_${_p}() {
|
||||
$(declare -f "_package${_p#${pkgbase}}")
|
||||
_package${_p#${pkgbase}}
|
||||
}"
|
||||
done
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,10 @@
|
|||
post_upgrade() {
|
||||
if findmnt --fstab -uno SOURCE /boot &>/dev/null && ! mountpoint -q /boot; then
|
||||
echo "WARNING: /boot appears to be a separate partition but is not mounted."
|
||||
fi
|
||||
}
|
||||
|
||||
post_remove() {
|
||||
rm -f boot/initramfs-%PKGBASE%.img
|
||||
rm -f boot/initramfs-%PKGBASE%-fallback.img
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
# mkinitcpio preset file for the '%PKGBASE%' package
|
||||
|
||||
ALL_config="/etc/mkinitcpio.conf"
|
||||
ALL_kver="/boot/vmlinuz-%PKGBASE%"
|
||||
|
||||
PRESETS=('default' 'fallback')
|
||||
|
||||
#default_config="/etc/mkinitcpio.conf"
|
||||
default_image="/boot/initramfs-%PKGBASE%.img"
|
||||
#default_options=""
|
||||
|
||||
#fallback_config="/etc/mkinitcpio.conf"
|
||||
fallback_image="/boot/initramfs-%PKGBASE%-fallback.img"
|
||||
fallback_options="-S autodetect"
|
||||
Loading…
Reference in New Issue