This commit is contained in:
Rachel Menge 2024-11-07 03:08:54 +00:00
Родитель 6034504dbb
Коммит 57218f2459
7 изменённых файлов: 28 добавлений и 8616 удалений

Просмотреть файл

@ -1,71 +1,31 @@
%global debug_package %{nil}
%global sha512hmac bash %{_sourcedir}/sha512hmac-openssl.sh
%ifarch x86_64
%global buildarch x86_64
%endif
%ifarch aarch64
%global buildarch aarch64
%endif
%define uname_r %{version}-%{release}
Summary: Signed Linux Kernel for %{buildarch} systems
Name: kernel-signed-%{buildarch}
Version: 6.6.57.1
Name: kernel-64k-signed-%{buildarch}
Version: 6.6.57.1.64k1
Release: 2%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Group: System Environment/Kernel
URL: https://github.com/microsoft/CBL-Mariner-Linux-Kernel
# This spec purpose is to take an input kernel rpm and input secure-boot-signed
# kernel binary from the same build and generate a new "kernel" rpm with the
# signed kernel binary + all of the other original kernel files, triggers,
# scriptlets, requires, provides, etc.
# This package's "version" and "release" must reflect the unsigned version that
# was signed.
# An important consequence is that when making a change to this package, the
# unsigned version/release must be increased to keep the two versions consistent.
# Ideally though, this spec will not change much or at all, so the version will
# just track the unsigned package's version/release.
#
# We need to ensure the kernel modules and kernel binary used are from the exact
# same build because at build time the kernel modules are signed with an
# ephemeral key that the kernel enrolls in its keyring. We enforce kernel
# module signature checking when we enable security features like kernel
# lockdown so our kernel can only load those specific kernel modules at runtime.
#
# Additionally, to complete the UEFI Secure Boot chain, we must PE-sign the
# kernel binary. Ideally we would enable secure-boot signing tools like pesign
# or sbsign to be callable from inside the rpmbuild environment, that way we can
# secure-boot sign the kernel binary during the kernel's rpmbuild. It is best
# practice to sign as soon as possible. However there are issues getting that
# secure boot signing infrastructure in place today. Hence we sign the
# resulting kernel binary and "repackage" the kernel RPM (something rpm itself
# actively tries to make sure you never do...generally for good reasons).
#
# To achive this repackaging, this spec creates a new subpackage named
# "kernel". To retain all of the initial kernel package behaviors, we make sure
# the subpackage has the same requires, provides, triggers, post steps, and
# files as the original kernel package.
#
# This specific repackaging implementation leaves room for us to enable the
# more ideal secure-boot signing flow in the future without introducing any
# sort of breaking change or new packaging. Users still install a "kernel"
# package like they normally would.
#
# Maintenance Notes:
# - This spec's "version" and "release" must reflect the unsigned version that
# was signed. An important consequence is that when making a change to this
# spec or the normal kernel spec, the other spec's version version/release must
# be increased to keep the two versions consistent.
#
# - Make sure the kernel subpackage's Requires, Provides, triggers, post/postun
# scriptlets, and files match the normal kernel spec's. The kernel subpackage
# should contain the same content as the input kernel package but replace the
# kernel binary with our signed kernel binary. Since all the requires, provides,
# etc are the same, this new kernel package can be a direct replacement for the
# normal kernel package and RPM will resolve packages with kernel dependencies
# correctly.
#
# To populate the input sources:
# To populate these sources:
# 1. Build the unsigned packages as normal
# 2. Sign the desired binary
# 3. Place the unsigned package and signed binary in this spec's folder
# 4. Build this spec
Source0: kernel-%{version}-%{release}.%{buildarch}.rpm
Source0: kernel-64k-%{version}-%{release}.%{buildarch}.rpm
Source1: vmlinuz-%{uname_r}
Source2: sha512hmac-openssl.sh
BuildRequires: cpio
@ -77,7 +37,7 @@ BuildRequires: sed
%description
This package contains the Linux kernel package with kernel signed with the production key
%package -n kernel
%package -n kernel-64k
Summary: Linux Kernel
Group: System Environment/Kernel
Requires: filesystem
@ -85,7 +45,7 @@ Requires: kmod
Requires(post): coreutils
Requires(postun): coreutils
%description -n kernel
%description -n kernel-64k
The kernel package contains the signed Linux kernel.
%prep
@ -112,20 +72,20 @@ popd
%{sha512hmac} %{buildroot}/boot/vmlinuz-%{uname_r} | sed -e "s,$RPM_BUILD_ROOT,," > %{buildroot}/boot/.vmlinuz-%{uname_r}.hmac
cp %{buildroot}/boot/.vmlinuz-%{uname_r}.hmac %{buildroot}/lib/modules/%{uname_r}/.vmlinuz.hmac
%triggerin -n kernel -- initramfs
%triggerin -n kernel-64k -- initramfs
mkdir -p %{_localstatedir}/lib/rpm-state/initramfs/pending
touch %{_localstatedir}/lib/rpm-state/initramfs/pending/%{uname_r}
echo "initrd generation of kernel %{uname_r} will be triggered later" >&2
%triggerun -n kernel -- initramfs
%triggerun -n kernel-64k -- initramfs
rm -rf %{_localstatedir}/lib/rpm-state/initramfs/pending/%{uname_r}
rm -rf /boot/initramfs-%{uname_r}.img
echo "initrd of kernel %{uname_r} removed" >&2
%postun -n kernel
%postun -n kernel-64k
%grub2_postun
%post -n kernel
%post -n kernel-64k
/sbin/depmod -a %{uname_r}
%grub2_post

Разница между файлами не показана из-за своего большого размера Загрузить разницу

Просмотреть файл

@ -1,7 +1,6 @@
{
"Signatures": {
"cbl-mariner-ca-20211013.pem": "5ef124b0924cb1047c111a0ecff1ae11e6ad7cac8d1d9b40f98f99334121f0b0",
"config": "5636a263f1802641e806b6971303eb28f77167ef42ece09782b4638c75bf03b5",
"config_aarch64": "bac4a99b57ce11f25ef8bce844ed6285932aa29139b85ccde850acaabafdcffd",
"cpupower": "d7518767bf2b1110d146a49c7d42e76b803f45eb8bd14d931aa6d0d346fae985",
"cpupower.service": "b057fe9e5d0e8c36f485818286b80e3eba8ff66ff44797940e99b1fd5361bb98",

Просмотреть файл

@ -14,22 +14,16 @@
%global _missing_build_ids_terminate_build 1
%global _no_recompute_build_ids 1
%ifarch x86_64
%define arch x86_64
%define archdir x86
%define config_source %{SOURCE1}
%endif
%ifarch aarch64
%global __provides_exclude_from %{_libdir}/debug/.build-id/
%define arch arm64
%define archdir arm64
%define config_source %{SOURCE2}
%define config_source %{SOURCE1}
%endif
Summary: Linux Kernel
Name: kernel
Version: 6.6.57.1
Name: kernel-64k
Version: 6.6.57.1.64k1
Release: 2%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
@ -37,13 +31,13 @@ Distribution: Azure Linux
Group: System Environment/Kernel
URL: https://github.com/microsoft/CBL-Mariner-Linux-Kernel
Source0: https://github.com/microsoft/CBL-Mariner-Linux-Kernel/archive/rolling-lts/mariner-%{mariner_version}/%{version}.tar.gz#/%{name}-%{version}.tar.gz
Source1: config
Source2: config_aarch64
Source3: sha512hmac-openssl.sh
Source4: cbl-mariner-ca-20211013.pem
Source5: cpupower
Source6: cpupower.service
Source1: config_aarch64
Source2: sha512hmac-openssl.sh
Source3: cbl-mariner-ca-20211013.pem
Source4: cpupower
Source5: cpupower.service
Patch0: 0001-add-mstflint-kernel-%{mstflintver}.patch
ExclusiveArch: aarch64
BuildRequires: audit-devel
BuildRequires: bash
BuildRequires: bc
@ -69,9 +63,6 @@ BuildRequires: procps-ng-devel
BuildRequires: python3-devel
BuildRequires: sed
BuildRequires: systemd-bootstrap-rpm-macros
%ifarch x86_64
BuildRequires: pciutils-devel
%endif
Requires: filesystem
Requires: kmod
Requires(post): coreutils
@ -168,7 +159,7 @@ make mrproper
cp %{config_source} .config
# Add CBL-Mariner cert into kernel's trusted keyring
cp %{SOURCE4} certs/mariner.pem
cp %{SOURCE3} certs/mariner.pem
sed -i 's#CONFIG_SYSTEM_TRUSTED_KEYS=""#CONFIG_SYSTEM_TRUSTED_KEYS="certs/mariner.pem"#' .config
cp .config current_config
@ -196,10 +187,6 @@ make VERBOSE=1 KBUILD_BUILD_VERSION="1" KBUILD_BUILD_HOST="CBL-Mariner" ARCH=%{a
# Compile perf, python3-perf
make -C tools/perf PYTHON=%{python3} all
%ifarch x86_64
make -C tools turbostat cpupower
%endif
#Compile bpftool
make -C tools/bpf/bpftool
@ -228,16 +215,12 @@ install -vdm 755 %{buildroot}%{_prefix}/src/linux-headers-%{uname_r}
install -vdm 755 %{buildroot}%{_libdir}/debug/lib/modules/%{uname_r}
install -d -m 755 %{buildroot}%{_sysconfdir}/sysconfig
install -c -m 644 %{SOURCE5} %{buildroot}/%{_sysconfdir}/sysconfig/cpupower
install -c -m 644 %{SOURCE4} %{buildroot}/%{_sysconfdir}/sysconfig/cpupower
install -d -m 755 %{buildroot}%{_unitdir}
install -c -m 644 %{SOURCE6} %{buildroot}%{_unitdir}/cpupower.service
install -c -m 644 %{SOURCE5} %{buildroot}%{_unitdir}/cpupower.service
make INSTALL_MOD_PATH=%{buildroot} modules_install
%ifarch x86_64
install -vm 600 arch/x86/boot/bzImage %{buildroot}/boot/vmlinuz-%{uname_r}
%endif
%ifarch aarch64
install -vm 600 arch/arm64/boot/Image %{buildroot}/boot/vmlinuz-%{uname_r}
%endif
@ -265,11 +248,6 @@ find . -name Makefile* -o -name Kconfig* -o -name *.pl | xargs sh -c 'cp --pare
find arch/%{archdir}/include include scripts -type f | xargs sh -c 'cp --parents "$@" %{buildroot}%{_prefix}/src/linux-headers-%{uname_r}' copy
find $(find arch/%{archdir} -name include -o -name scripts -type d) -type f | xargs sh -c 'cp --parents "$@" %{buildroot}%{_prefix}/src/linux-headers-%{uname_r}' copy
find arch/%{archdir}/include Module.symvers include scripts -type f | xargs sh -c 'cp --parents "$@" %{buildroot}%{_prefix}/src/linux-headers-%{uname_r}' copy
%ifarch x86_64
# CONFIG_STACK_VALIDATION=y requires objtool to build external modules
install -vsm 755 tools/objtool/objtool %{buildroot}%{_prefix}/src/linux-headers-%{uname_r}/tools/objtool/
install -vsm 755 tools/objtool/fixdep %{buildroot}%{_prefix}/src/linux-headers-%{uname_r}/tools/objtool/
%endif
cp .config %{buildroot}%{_prefix}/src/linux-headers-%{uname_r} # copy .config manually to be where it's expected to be
ln -sf "%{_prefix}/src/linux-headers-%{uname_r}" "%{buildroot}/lib/modules/%{uname_r}/build"
@ -290,11 +268,6 @@ make -C tools/perf DESTDIR=%{buildroot} prefix=%{_prefix} install-python_ext
# Install bpftool
make -C tools/bpf/bpftool DESTDIR=%{buildroot} prefix=%{_prefix} bash_compdir=%{_sysconfdir}/bash_completion.d/ mandir=%{_mandir} install
%ifarch x86_64
# Install turbostat cpupower
make -C tools DESTDIR=%{buildroot} prefix=%{_prefix} bash_compdir=%{_sysconfdir}/bash_completion.d/ mandir=%{_mandir} turbostat_install cpupower_install
%endif
# Remove trace (symlink to perf). This file causes duplicate identical debug symbols
rm -vf %{buildroot}%{_bindir}/trace
@ -374,19 +347,6 @@ echo "initrd of kernel %{uname_r} removed" >&2
%defattr(-,root,root)
%{_libexecdir}
%exclude %dir %{_libdir}/debug
%ifarch x86_64
%{_sbindir}/cpufreq-bench
%{_lib64dir}/libperf-jvmti.so
%{_lib64dir}/libcpupower.so*
%{_sysconfdir}/cpufreq-bench.conf
%{_includedir}/cpuidle.h
%{_includedir}/cpufreq.h
%{_includedir}/powercap.h
%{_mandir}/man1/cpupower*.gz
%{_mandir}/man8/turbostat*.gz
%{_datadir}/locale/*/LC_MESSAGES/cpupower.mo
%{_datadir}/bash-completion/completions/cpupower
%endif
%ifarch aarch64
%{_libdir}/libperf-jvmti.so
%endif

Просмотреть файл

@ -1,38 +0,0 @@
# generic + compressed please
hostonly="no"
compress="xz"
# VMs can't update microcode anyway
early_microcode="no"
# modules: basics
dracutmodules+=" base systemd systemd-initrd dracut-systemd shutdown i18n "
# modules: storage support
dracutmodules+=" dm rootfs-block fs-lib "
# modules: tpm and crypto
dracutmodules+=" crypt crypt-loop tpm2-tss systemd-cryptsetup "
# modules: support root on virtiofs
dracutmodules+=" virtiofs "
# modules: use sysext images (see 'man systemd-sysext')
dracutmodules+=" systemd-sysext "
# drivers: virtual buses, pci
drivers+=" virtio-pci virtio-mmio " # qemu-kvm
drivers+=" hv-vmbus pci-hyperv " # hyperv
drivers+=" xen-pcifront " # xen
# drivers: storage
drivers+=" ahci nvme sd_mod sr_mod " # generic
drivers+=" virtio-blk virtio-scsi " # qemu-kvm
drivers+=" hv-storvsc " # hyperv
drivers+=" xen-blkfront " # xen
# root encryption
drivers+=" dm_crypt "
# filesystems
filesystems+=" vfat ext4 xfs overlay "

Просмотреть файл

@ -1,5 +0,0 @@
{
"Signatures": {
"kernel-uki-dracut.conf": "83b8db11c5066b275f8d982bbae69305750f94f7e96ab215104ed050a682de4e"
}
}

Просмотреть файл

@ -1,187 +0,0 @@
%global debug_package %{nil}
# This should be a subpackage of the kernel package, but due to
# "circular dependencies" that is not possible, so this is instead a
# separate source package
# Note - while Fedora's kernel version includes the %%_target_cpu as a
# suffix, our kernel version does not.
%define kernelver %{version}-%{release}
%define cmdline console=ttyS0
Summary: Unified Kernel Image
Name: kernel-uki
Version: 6.6.57.1
Release: 2%{?dist}
License: GPLv2
Vendor: Microsoft Corporation
Distribution: Azure Linux
Group: System Environment/Kernel
URL: https://github.com/microsoft/CBL-Mariner-Linux-Kernel
Source0: kernel-uki-dracut.conf
BuildRequires: kernel = %{version}-%{release}
BuildRequires: systemd-ukify
BuildRequires: dracut
BuildRequires: binutils
BuildRequires: systemd-boot
BuildRequires: systemd-udev
BuildRequires: system-release
BuildRequires: tpm2-tools
BuildRequires: cryptsetup
BuildRequires: device-mapper
BuildRequires: kbd
ExclusiveArch: x86_64
%description
The kernel-uki package contains the Linux kernel packaged as a Unified
Kernel Image (UKI).
%prep
%setup -c -T
%build
dracut --conf=%{SOURCE0} --confdir=$(mktemp -d) --logfile=$(mktemp) \
--verbose \
--kver %{kernelver} \
--kernel-image /lib/modules/%{kernelver}/vmlinuz \
--kernel-cmdline "%{cmdline}" initrd
ukify build \
--uname %{kernelver} \
--linux /lib/modules/%{kernelver}/vmlinuz \
--initrd initrd \
--cmdline "%{cmdline}" \
--output vmlinuz-uki.efi
%install
install -vdm 700 %{buildroot}/boot
install -vdm 700 %{buildroot}/lib/modules/%{kernelver}
install -vm 600 vmlinuz-uki.efi %{buildroot}/boot/vmlinuz-uki-%{kernelver}.efi
ln -s /boot/vmlinuz-uki-%{kernelver}.efi %{buildroot}/lib/modules/%{kernelver}/vmlinuz-uki.efi
# install to ESP
install -vdm 700 %{buildroot}/boot/efi/EFI/Linux
cp %{buildroot}/boot/vmlinuz-uki-%{kernelver}.efi %{buildroot}/boot/efi/EFI/Linux/vmlinuz-uki-%{kernelver}.efi
%files
/boot/vmlinuz-uki-%{kernelver}.efi
/lib/modules/%{kernelver}/vmlinuz-uki.efi
/boot/efi/EFI/Linux/vmlinuz-uki-%{kernelver}.efi
%changelog
* Wed Oct 30 2024 Thien Trung Vuong <tvuong@microsoft.com> - 6.6.57.1-2
- Remove noxsaves parameter from cmdline
* Tue Oct 29 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.57.1-1
- Auto-upgrade to 6.6.57.1
* Thu Oct 24 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.56.1-5
- Bump release to match kernel
* Wed Oct 23 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.56.1-4
- Bump release to match kernel
* Wed Oct 23 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.56.1-3
- Bump release to match kernel
* Tue Oct 22 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.56.1-2
- Bump release to match kernel
* Thu Oct 17 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.56.1-1
- Auto-upgrade to 6.6.56.1
* Thu Oct 03 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.51.1-5
- Bump release to match kernel
* Wed Oct 02 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.51.1-4
- Bump release to match kernel
* Tue Sep 24 2024 Jo Zzsi <jozzsicsataban@gmail.com> - 6.6.51.1-3
- Remove dbus from initrd
* Fri Sep 20 2024 Chris Co <chrco@microsoft.com> - 6.6.51.1-2
- Bump release to match kernel
* Wed Sep 18 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.51.1-1
- Auto-upgrade to 6.6.51.1
* Fri Sep 13 2024 Thien Trung Vuong <tvuong@microsoft.com> - 6.6.47.1-7
- Install binary to ESP
* Fri Sep 13 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.47.1-6
- Bump release to match kernel
* Thu Sep 12 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.47.1-5
- Bump release to match kernel
* Thu Sep 12 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.47.1-4
- Bump release to match kernel
* Wed Sep 04 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.47.1-3
- Bump release to match kernel
* Thu Aug 29 2024 Jo Zzsi <jozzsicsataban@gmail.com> - 6.6.47.1-2
- Remove usrmount from initrd
* Thu Aug 22 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.47.1-1
- Auto-upgrade to 6.6.47.1
* Wed Aug 14 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.44.1-1
- Auto-upgrade to 6.6.44.1
* Sat Aug 10 2024 Thien Trung Vuong <tvuong@microsoft.com> - 6.6.43.1-7
- Include systemd-cryptsetup in UKI
* Wed Aug 07 2024 Thien Trung Vuong <tvuong@microsoft.com> - 6.6.43.1-6
- Rebuild UKI with new initrd
* Tue Aug 06 2024 Chris Co <chrco@microsoft.com> - 6.6.43.1-5
- Bump release to match kernel
* Sat Aug 03 2024 Chris Co <chrco@microsoft.com> - 6.6.43.1-4
- Bump release to match kernel
* Thu Aug 01 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.43.1-3
- Bump release to match kernel
* Wed Jul 31 2024 Chris Co <chrco@microsoft.com> - 6.6.43.1-2
- Bump release to match kernel
* Tue Jul 30 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.43.1-1
- Auto-upgrade to 6.6.43.1
* Tue Jul 30 2024 Chris Co <chrco@microsoft.com> - 6.6.39.1-2
- Bump release to match kernel
* Fri Jul 26 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.39.1-1
- Auto-upgrade to 6.6.39.1
* Tue Jul 16 2024 Kelsey Steele <kelseysteele@microsoft.com> - 6.6.35.1-6
- Bump release to match kernel
* Wed Jul 10 2024 Thien Trung Vuong <tvuong@microsoft.com> - 6.6.35.1-5
- Add tag to build exclusively on x86_64
* Fri Jul 05 2024 Gary Swalling <gaswal@microsoft.com> - 6.6.35.1-4
- Bump release to match kernel
* Mon Jul 01 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.35.1-3
- Bump release to match kernel
* Fri Jun 28 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.35.1-2
- Bump release to match kernel
* Tue Jun 25 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 6.6.35.1-1
- Auto-upgrade to 6.6.35.1
* Wed Jun 12 2024 Dan Streetman <ddstreet@microsoft.com> - 6.6.29.1-6
- include i18n (kbd package) in UKI, to provide loadkeys binary so
systemd-vconsole-setup works
* Tue Jun 11 2024 Juan Camposeco <juanarturoc@microsoft.com> - 6.6.29.1-5
- Bump release to match kernel
* Thu Apr 25 2024 Dan Streetman <ddstreet@microsoft.com> - 6.6.29.1-4
- Original version for Azure Linux.
- License verified.