From 89e3b03b151ac6bc972f4777ce4db00224609f44 Mon Sep 17 00:00:00 2001 From: David P Date: Mon, 4 Nov 2019 19:15:10 -0300 Subject: updpkg: libre/linux-libre-lts 4.19.81_gnu-3 Signed-off-by: David P --- ...ctl-and-CONFIG-to-disallow-unprivileged-C.patch | 132 ++++++ ...to-disallow-unprivileged-CLONE_NEWUSER-by.patch | 102 ----- ...-Add-CONFIG-for-unprivileged_userns_clone.patch | 57 --- libre/linux-libre-lts/60-linux.hook | 12 - libre/linux-libre-lts/90-linux.hook | 11 - libre/linux-libre-lts/PKGBUILD | 493 ++++++++++----------- libre/linux-libre-lts/config.armv7h | 10 +- libre/linux-libre-lts/config.i686 | 10 +- libre/linux-libre-lts/config.x86_64 | 75 ++-- libre/linux-libre-lts/linux-armv7h.preset | 14 + libre/linux-libre-lts/linux-lts.install | 12 - libre/linux-libre-lts/linux-lts.preset | 14 - 12 files changed, 434 insertions(+), 508 deletions(-) create mode 100644 libre/linux-libre-lts/0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch delete mode 100644 libre/linux-libre-lts/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch delete mode 100644 libre/linux-libre-lts/0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch delete mode 100644 libre/linux-libre-lts/60-linux.hook delete mode 100644 libre/linux-libre-lts/90-linux.hook create mode 100644 libre/linux-libre-lts/linux-armv7h.preset delete mode 100644 libre/linux-libre-lts/linux-lts.install delete mode 100644 libre/linux-libre-lts/linux-lts.preset (limited to 'libre/linux-libre-lts') diff --git a/libre/linux-libre-lts/0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch b/libre/linux-libre-lts/0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch new file mode 100644 index 000000000..f93022e50 --- /dev/null +++ b/libre/linux-libre-lts/0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch @@ -0,0 +1,132 @@ +From 6136ffb3d88e9f044260f8288d2d0a1edd64379e Mon Sep 17 00:00:00 2001 +From: "Jan Alexander Steffens (heftig)" +Date: Mon, 16 Sep 2019 04:53:20 +0200 +Subject: [PATCH] ZEN: Add sysctl and CONFIG to disallow unprivileged + CLONE_NEWUSER + +Our default behavior continues to match the vanilla kernel. +--- + init/Kconfig | 16 ++++++++++++++++ + kernel/fork.c | 15 +++++++++++++++ + kernel/sysctl.c | 12 ++++++++++++ + kernel/user_namespace.c | 7 +++++++ + 4 files changed, 50 insertions(+) + +diff --git a/init/Kconfig b/init/Kconfig +index bd7d650d4a99..658f9c052151 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1091,6 +1091,22 @@ config USER_NS + + If unsure, say N. + ++config USER_NS_UNPRIVILEGED ++ bool "Allow unprivileged users to create namespaces" ++ default y ++ depends on USER_NS ++ help ++ When disabled, unprivileged users will not be able to create ++ new namespaces. Allowing users to create their own namespaces ++ has been part of several recent local privilege escalation ++ exploits, so if you need user namespaces but are ++ paranoid^Wsecurity-conscious you want to disable this. ++ ++ This setting can be overridden at runtime via the ++ kernel.unprivileged_userns_clone sysctl. ++ ++ If unsure, say Y. ++ + config PID_NS + bool "PID Namespaces" + default y +diff --git a/kernel/fork.c b/kernel/fork.c +index 541fd805fb88..ffd57c812153 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -106,6 +106,11 @@ + + #define CREATE_TRACE_POINTS + #include ++#ifdef CONFIG_USER_NS ++extern int unprivileged_userns_clone; ++#else ++#define unprivileged_userns_clone 0 ++#endif + + /* + * Minimum number of threads to boot the kernel +@@ -1788,6 +1793,10 @@ static __latent_entropy struct task_struct *copy_process( + if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS)) + return ERR_PTR(-EINVAL); + ++ if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) ++ if (!capable(CAP_SYS_ADMIN)) ++ return ERR_PTR(-EPERM); ++ + /* + * Thread groups must share signals as well, and detached threads + * can only be started up within the thread group. +@@ -2819,6 +2828,12 @@ int ksys_unshare(unsigned long unshare_flags) + if (unshare_flags & CLONE_NEWNS) + unshare_flags |= CLONE_FS; + ++ if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) { ++ err = -EPERM; ++ if (!capable(CAP_SYS_ADMIN)) ++ goto bad_unshare_out; ++ } ++ + err = check_unshare_flags(unshare_flags); + if (err) + goto bad_unshare_out; +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 078950d9605b..baead3605bbe 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -110,6 +110,9 @@ extern int core_uses_pid; + extern char core_pattern[]; + extern unsigned int core_pipe_limit; + #endif ++#ifdef CONFIG_USER_NS ++extern int unprivileged_userns_clone; ++#endif + extern int pid_max; + extern int pid_max_min, pid_max_max; + extern int percpu_pagelist_fraction; +@@ -545,6 +548,15 @@ static struct ctl_table kern_table[] = { + .proc_handler = proc_dointvec, + }, + #endif ++#ifdef CONFIG_USER_NS ++ { ++ .procname = "unprivileged_userns_clone", ++ .data = &unprivileged_userns_clone, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec, ++ }, ++#endif + #ifdef CONFIG_PROC_SYSCTL + { + .procname = "tainted", +diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c +index 8eadadc478f9..c36ecd19562c 100644 +--- a/kernel/user_namespace.c ++++ b/kernel/user_namespace.c +@@ -21,6 +21,13 @@ + #include + #include + ++/* sysctl */ ++#ifdef CONFIG_USER_NS_UNPRIVILEGED ++int unprivileged_userns_clone = 1; ++#else ++int unprivileged_userns_clone; ++#endif ++ + static struct kmem_cache *user_ns_cachep __read_mostly; + static DEFINE_MUTEX(userns_state_mutex); + +-- +2.23.0 + diff --git a/libre/linux-libre-lts/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch b/libre/linux-libre-lts/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch deleted file mode 100644 index d78d38ade..000000000 --- a/libre/linux-libre-lts/0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch +++ /dev/null @@ -1,102 +0,0 @@ -From 96161597803746c97c43e0703ca2a059bdd7a8f7 Mon Sep 17 00:00:00 2001 -From: Serge Hallyn -Date: Fri, 31 May 2013 19:12:12 +0100 -Subject: [PATCH 1/2] add sysctl to disallow unprivileged CLONE_NEWUSER by - default - -Signed-off-by: Serge Hallyn -[bwh: Remove unneeded binary sysctl bits] -Signed-off-by: Daniel Micay ---- - kernel/fork.c | 15 +++++++++++++++ - kernel/sysctl.c | 12 ++++++++++++ - kernel/user_namespace.c | 3 +++ - 3 files changed, 30 insertions(+) - -diff --git a/kernel/fork.c b/kernel/fork.c -index 2628f3773ca8..a2da35b446a6 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -103,6 +103,11 @@ - - #define CREATE_TRACE_POINTS - #include -+#ifdef CONFIG_USER_NS -+extern int unprivileged_userns_clone; -+#else -+#define unprivileged_userns_clone 0 -+#endif - - /* - * Minimum number of threads to boot the kernel -@@ -1719,6 +1724,10 @@ static __latent_entropy struct task_struct *copy_process( - if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS)) - return ERR_PTR(-EINVAL); - -+ if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) -+ if (!capable(CAP_SYS_ADMIN)) -+ return ERR_PTR(-EPERM); -+ - /* - * Thread groups must share signals as well, and detached threads - * can only be started up within the thread group. -@@ -2554,6 +2563,12 @@ int ksys_unshare(unsigned long unshare_flags) - if (unshare_flags & CLONE_NEWNS) - unshare_flags |= CLONE_FS; - -+ if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) { -+ err = -EPERM; -+ if (!capable(CAP_SYS_ADMIN)) -+ goto bad_unshare_out; -+ } -+ - err = check_unshare_flags(unshare_flags); - if (err) - goto bad_unshare_out; -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index 387efbaf464a..b393beb76f34 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -108,6 +108,9 @@ extern int core_uses_pid; - extern char core_pattern[]; - extern unsigned int core_pipe_limit; - #endif -+#ifdef CONFIG_USER_NS -+extern int unprivileged_userns_clone; -+#endif - extern int pid_max; - extern int pid_max_min, pid_max_max; - extern int percpu_pagelist_fraction; -@@ -535,6 +538,15 @@ static struct ctl_table kern_table[] = { - .proc_handler = proc_dointvec, - }, - #endif -+#ifdef CONFIG_USER_NS -+ { -+ .procname = "unprivileged_userns_clone", -+ .data = &unprivileged_userns_clone, -+ .maxlen = sizeof(int), -+ .mode = 0644, -+ .proc_handler = proc_dointvec, -+ }, -+#endif - #ifdef CONFIG_PROC_SYSCTL - { - .procname = "tainted", -diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c -index 923414a246e9..6b9dbc257e34 100644 ---- a/kernel/user_namespace.c -+++ b/kernel/user_namespace.c -@@ -26,6 +26,9 @@ - #include - #include - -+/* sysctl */ -+int unprivileged_userns_clone; -+ - static struct kmem_cache *user_ns_cachep __read_mostly; - static DEFINE_MUTEX(userns_state_mutex); - --- -2.22.0 - diff --git a/libre/linux-libre-lts/0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch b/libre/linux-libre-lts/0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch deleted file mode 100644 index 7fa619f1c..000000000 --- a/libre/linux-libre-lts/0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 1f89ffcbd1b6b6639eb49c521ac0d308a723cd3c Mon Sep 17 00:00:00 2001 -From: "Jan Alexander Steffens (heftig)" -Date: Thu, 7 Dec 2017 13:50:48 +0100 -Subject: [PATCH 2/2] ZEN: Add CONFIG for unprivileged_userns_clone - -This way our default behavior continues to match the vanilla kernel. ---- - init/Kconfig | 16 ++++++++++++++++ - kernel/user_namespace.c | 4 ++++ - 2 files changed, 20 insertions(+) - -diff --git a/init/Kconfig b/init/Kconfig -index 4592bf7997c0..f3df02990aff 100644 ---- a/init/Kconfig -+++ b/init/Kconfig -@@ -1004,6 +1004,22 @@ config USER_NS - - If unsure, say N. - -+config USER_NS_UNPRIVILEGED -+ bool "Allow unprivileged users to create namespaces" -+ default y -+ depends on USER_NS -+ help -+ When disabled, unprivileged users will not be able to create -+ new namespaces. Allowing users to create their own namespaces -+ has been part of several recent local privilege escalation -+ exploits, so if you need user namespaces but are -+ paranoid^Wsecurity-conscious you want to disable this. -+ -+ This setting can be overridden at runtime via the -+ kernel.unprivileged_userns_clone sysctl. -+ -+ If unsure, say Y. -+ - config PID_NS - bool "PID Namespaces" - default y -diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c -index 6b9dbc257e34..107b17f0d528 100644 ---- a/kernel/user_namespace.c -+++ b/kernel/user_namespace.c -@@ -27,7 +27,11 @@ - #include - - /* sysctl */ -+#ifdef CONFIG_USER_NS_UNPRIVILEGED -+int unprivileged_userns_clone = 1; -+#else - int unprivileged_userns_clone; -+#endif - - static struct kmem_cache *user_ns_cachep __read_mostly; - static DEFINE_MUTEX(userns_state_mutex); --- -2.22.0 - diff --git a/libre/linux-libre-lts/60-linux.hook b/libre/linux-libre-lts/60-linux.hook deleted file mode 100644 index b33873c85..000000000 --- a/libre/linux-libre-lts/60-linux.hook +++ /dev/null @@ -1,12 +0,0 @@ -[Trigger] -Type = File -Operation = Install -Operation = Upgrade -Operation = Remove -Target = usr/lib/modules/%KERNVER%/* -Target = usr/lib/modules/%EXTRAMODULES%/* - -[Action] -Description = Updating %PKGBASE% module dependencies... -When = PostTransaction -Exec = /usr/bin/depmod %KERNVER% diff --git a/libre/linux-libre-lts/90-linux.hook b/libre/linux-libre-lts/90-linux.hook deleted file mode 100644 index be0d88653..000000000 --- a/libre/linux-libre-lts/90-linux.hook +++ /dev/null @@ -1,11 +0,0 @@ -[Trigger] -Type = File -Operation = Install -Operation = Upgrade -Target = boot/vmlinuz-%PKGBASE% -Target = usr/lib/initcpio/* - -[Action] -Description = Updating %PKGBASE% initcpios... -When = PostTransaction -Exec = /usr/bin/mkinitcpio -p %PKGBASE% diff --git a/libre/linux-libre-lts/PKGBUILD b/libre/linux-libre-lts/PKGBUILD index bca37259b..4e167f537 100644 --- a/libre/linux-libre-lts/PKGBUILD +++ b/libre/linux-libre-lts/PKGBUILD @@ -9,35 +9,54 @@ # Based on linux-lts package +_replacesarchkernel=('linux%') # '%' gets replaced with kernel suffix +_replacesoldkernels=() # '%' gets replaced with kernel suffix +_replacesoldmodules=() # '%' gets replaced with kernel suffix + pkgbase=linux-libre-lts _srcbasever=4.19-gnu -_srcver=4.19.75-gnu - -_replacesarchkernel=('linux%') # '%' gets replaced with _kernelname -_replacesoldkernels=() # '%' gets replaced with _kernelname -_replacesoldmodules=() # '%' gets replaced with _kernelname - +_srcver=4.19.81-gnu _srcname=linux-${_srcbasever%-*} -_archpkgver=${_srcver%-*} pkgver=${_srcver//-/_} -pkgrel=1 +pkgrel=3 rcnver=4.19.72 rcnrel=armv7-x39 -arch=('x86_64' 'i686' 'armv7h') url='https://linux-libre.fsfla.org/' -license=('GPL2') -makedepends=('xmlto' 'kmod' 'inetutils' 'bc' 'libelf') +arch=(i686 x86_64 armv7h) +license=(GPL2) +makedepends=( + xmlto kmod inetutils bc libelf + python-sphinx python-sphinx_rtd_theme graphviz imagemagick +) options=('!strip') source=( - "https://linux-libre.fsfla.org/pub/linux-libre/releases/${_srcbasever}/linux-libre-${_srcbasever}.tar.xz"{,.sign} - "https://linux-libre.fsfla.org/pub/linux-libre/releases/${_srcver}/patch-${_srcbasever}-${_srcver}.xz"{,.sign} + "https://linux-libre.fsfla.org/pub/linux-libre/releases/$_srcbasever/linux-libre-$_srcbasever.tar.xz"{,.sign} + "https://linux-libre.fsfla.org/pub/linux-libre/releases/$_srcver/patch-$_srcbasever-$_srcver.xz"{,.sign} "https://repo.parabola.nu/other/linux-libre/logos/logo_linux_"{clut224.ppm,vga16.ppm,mono.pbm}{,.sig} config.i686 config.x86_64 config.armv7h # the main kernel config files - 60-linux.hook # pacman hook for depmod - 90-linux.hook # pacman hook for initramfs regeneration - linux-lts.preset # standard config files for mkinitcpio ramdisk - # armv7h patches - "https://repo.parabola.nu/other/rcn-libre/patches/${rcnver}/rcn-libre-${rcnver}-${rcnrel}.patch"{,.sig} + linux-armv7h.preset # armv7h preset file for mkinitcpio ramdisk + + # maintain the TTY over USB disconnects + # http://www.coreboot.org/EHCI_Gadget_Debug + 0001-usb-serial-gadget-no-TTY-hangup-on-USB-disconnect-WI.patch + # fix Atmel maXTouch touchscreen support + # https://labs.parabola.nu/issues/877 + # http://www.fsfla.org/pipermail/linux-libre/2015-November/003202.html + 0002-fix-Atmel-maXTouch-touchscreen-support.patch + + # Arch's custom linux patches + 0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch +) +source_armv7h=( + # armv7h patches, put in the source_armv7h variable just for a more comfortable loop patching + + # RCN patch (CM3 firmware deblobbed and AUFS/WireGuard removed) + # Note: For stability reasons, AUFS has been removed in the RCN patch. + # We are supporting AUFS in linux-libre-pck through PCK patch. + # See https://wiki.parabola.nu/PCK for further details. + "https://repo.parabola.nu/other/rcn-libre/patches/${rcnver}/rcn-libre-${rcnver}-$rcnrel.patch"{,.sig} + + # Arch Linux ARM patches 0001-ARM-atags-add-support-for-Marvell-s-u-boot.patch 0002-ARM-atags-fdt-retrieve-MAC-addresses-from-Marvell-bo.patch 0003-SMILE-Plug-device-tree-file.patch @@ -47,11 +66,6 @@ source=( 0007-exynos4412-odroid-set-higher-minimum-buck2-regulator.patch 0008-ARM-dove-enable-ethernet-on-D3Plug.patch 0009-usb-dwc2-disable-power_down-on-rockchip-devices.patch - # other patches - 0001-usb-serial-gadget-no-TTY-hangup-on-USB-disconnect-WI.patch - 0002-fix-Atmel-maXTouch-touchscreen-support.patch - 0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch - 0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch ) validpgpkeys=( '474402C8C582DAFBE389C427BCB7CF877E7D47A7' # Alexandre Oliva @@ -59,7 +73,7 @@ validpgpkeys=( ) sha512sums=('5bc800b3beff43a8c15bd5515f4e0babe2beb5fa600491b7b37110e22d9b739d293f1e38753ed681be289c51390e0e64b3e60ce0db0a3bfe1f94ee5c014579a3' 'SKIP' - '10ba20a102b6238b818755685cc6492c30d77177f7eaa8d949e6ab564c5c1905ce1049d65c2a66f4d97ac823cf3469556b38ec7c7d24232ecfff8713c6bc68e4' + '93b5702c07394ccaa31b055fe24c0888a34bf09e7921fc0e8acad0bd3f5b49d0fdb73277a7a9b0abc6b54d14b7c61461a214c575517adf5f272907640d595eaf' 'SKIP' '13cb5bc42542e7b8bb104d5f68253f6609e463b6799800418af33eb0272cc269aaa36163c3e6f0aacbdaaa1d05e2827a4a7c4a08a029238439ed08b89c564bb3' 'SKIP' @@ -67,316 +81,279 @@ sha512sums=('5bc800b3beff43a8c15bd5515f4e0babe2beb5fa600491b7b37110e22d9b739d293 'SKIP' '267295aa0cea65684968420c68b32f1a66a22d018b9d2b2c1ef14267bcf4cb68aaf7099d073cbfefe6c25c8608bdcbbd45f7ac8893fdcecbf1e621abdfe9ecc1' 'SKIP' - '32fddeab0ef9934fbbb2bbbfb416c40ae515b0bb3228655904edfd719e9a094044769938c33c8283c2f043a7b557737ce0a7910b2fd13fc6333d0c028a81f42b' - 'ecaeb192c11efe9e61c49bb7eb163980c01a9ba5bfc2c8ccacdc007dc2a04e7776a71f2195c022b6a8fb4d3ac47c3058f748097b8c43f64ebbf1dc1b2d7f8052' - '309fead206abf03dd4832f720108974ecc935b376fab6fca0c1d9197aea44bf074348768ae469c82d30b388678b72017db5e4aebac0f2a85f8691bbf13fd00e7' - '7ad5be75ee422dda3b80edd2eb614d8a9181e2c8228cd68b3881e2fb95953bf2dea6cbe7900ce1013c9de89b2802574b7b24869fc5d7a95d3cc3112c4d27063a' - '4a8b324aee4cccf3a512ad04ce1a272d14e5b05c8de90feb82075f55ea3845948d817e1b0c6f298f5816834ddd3e5ce0a0e2619866289f3c1ab8fd2f35f04f44' - '2dc6b0ba8f7dbf19d2446c5c5f1823587de89f4e28e9595937dd51a87755099656f2acec50e3e2546ea633ad1bfd1c722e0c2b91eef1d609103d8abdc0a7cbaf' - 'c08532b4246ef2f4c25a5b3358ceb5dbf294fadd7ede5711de92d6f9d8fae5ab0238e0d902c821c7cdcee39332db229f6df943b27fe63e66a96bac296808c174' - 'SKIP' - '60aa432465eb3ac10f565799d3dfecea21aaf08e83909c1161d9359e932626edbd1353e712d616c3d785c65a0f699e9c45df35bd9e86365c25399c6b2d45b9e4' - '86809feb5ae2759b449ec0cb7a6b3fb457874ed82a72dfda00607e8819c804a0714b5d6a17cbbba44996a36872224af42d1b85f1b3932f43bccb419041d25dc7' - '746acff348d62b3ed4e62cd9976ddf0af47f87bd3cffda90cbb00a6b57d589ccb681fcd9541ee5bdd179d95dad71d57c77cb1a60faee1c6cef518e4055c3456f' - 'c945e871fa456b521ced77cae9081bcdc47d836ecdabe6766e373681fe11fda3e5a7a3c16f70c586be64a1eb5c9136c43b0a44df897298940fd8703b50b0a543' - '054e98a2d1ea83cece1fe55ae087b282f25593022f252c74612d4aeb2a547f84ea626e3d982098ca798271af55f3b733ac2aea2fc0d9cad031802d2901dfe4ca' - '4433f9e780a72347313916c8a9cbcbce3a8c40e1b299e887dc748d257879fb5fab8f1683936339f73a4d4b4ef668b1ed6cc0d9a19ed4bd99039a1613ac08610e' - 'd1361d23ae79599e3fa94cba206bd40764f9eee0c584e639af13828dabb7f0dfa361792c098b5afae0bb350407b2dc47a1d67580daeade7a4f3e3e55e42c8470' - 'c1653f91067d31801a23450175e47968add147477caf20aec6092831739641312f4ad995af43c7e55545007279016b5f62a0720d31e4591b4421a65b8bd5b398' - 'a123747792417d3760ca40d7f913c2cdd194da2ea5778352eedebc80097b7b8dce4428a8fe8bd75cab92972f599c25bcf18a740856fc2990351234b0d7ebf9f5' + 'f96a654f5f3988cadad28f9849900fe1c6e76d52ffefc3cf71253468d5fca07ffd7ffa18fa5054e88787114026b8ae15f035fee7b39b1dc8534d5fff3ae25128' + '78ce426957dfe14d3f0e58ad736489647b1930e8ad43eda27fbbae33bf53cda082295e3e33d6ddb9e58824a29fc069fcafeb8d9f8cd9aa32f3550e9e747f4a7d' + '861a83cb9746b6d981e07d18b0293298c0e7a5d10ad592bb8defbd235a0efac30ce6c2328f34a162943aa33fa05f2b4367adf394aa815875eda0103bdf4e172c' + 'aca591b5a2e838754e3c5fd2c0e50098ad54c2d0f990de5bf9cff8608e881daf0e37132294ed1a0e0a7b9e1c194c0b89f95da001d94febdb25a01c409060e3ac' '02af4dd2a007e41db0c63822c8ab3b80b5d25646af1906dc85d0ad9bb8bbf5236f8e381d7f91cf99ed4b0978c50aee37cb9567cdeef65b7ec3d91b882852b1af' 'b8fe56e14006ab866970ddbd501c054ae37186ddc065bb869cf7d18db8c0d455118d5bda3255fb66a0dde38b544655cfe9040ffe46e41d19830b47959b2fb168' - 'ded54d11289f9080995c81446d377052b528e99ff119c163031153c5af2e3bb92c3879c225d1b7ecb76d2c9ea45e002b21eae304f0f702facd6f9f75941fcbcb' - '9b0fb3d51b4c1ef576eb1bae59d1508c483aa0e46ecfeb7b55028b0c7ce6b3a309f377decfd3a94ac68b944c7b8724a4b3927e396bc5c7f16b3624c103194bd7') - -_kernelname=${pkgbase#linux-libre} -_replacesarchkernel=("${_replacesarchkernel[@]/\%/${_kernelname}}") -_replacesoldkernels=("${_replacesoldkernels[@]/\%/${_kernelname}}") -_replacesoldmodules=("${_replacesoldmodules[@]/\%/${_kernelname}}") - -case "${CARCH}" in + '5f196378d50dd737d727e424d8f31b7fa8a6b92ba88f0a1467ef79bc37a097160da1fc1fd5cfb4b8983f36f2afdf27eb229ec61b35a15ac2343d660eb416a230') +sha512sums_armv7h=('c08532b4246ef2f4c25a5b3358ceb5dbf294fadd7ede5711de92d6f9d8fae5ab0238e0d902c821c7cdcee39332db229f6df943b27fe63e66a96bac296808c174' + 'SKIP' + '60aa432465eb3ac10f565799d3dfecea21aaf08e83909c1161d9359e932626edbd1353e712d616c3d785c65a0f699e9c45df35bd9e86365c25399c6b2d45b9e4' + '86809feb5ae2759b449ec0cb7a6b3fb457874ed82a72dfda00607e8819c804a0714b5d6a17cbbba44996a36872224af42d1b85f1b3932f43bccb419041d25dc7' + '746acff348d62b3ed4e62cd9976ddf0af47f87bd3cffda90cbb00a6b57d589ccb681fcd9541ee5bdd179d95dad71d57c77cb1a60faee1c6cef518e4055c3456f' + 'c945e871fa456b521ced77cae9081bcdc47d836ecdabe6766e373681fe11fda3e5a7a3c16f70c586be64a1eb5c9136c43b0a44df897298940fd8703b50b0a543' + '054e98a2d1ea83cece1fe55ae087b282f25593022f252c74612d4aeb2a547f84ea626e3d982098ca798271af55f3b733ac2aea2fc0d9cad031802d2901dfe4ca' + '4433f9e780a72347313916c8a9cbcbce3a8c40e1b299e887dc748d257879fb5fab8f1683936339f73a4d4b4ef668b1ed6cc0d9a19ed4bd99039a1613ac08610e' + 'd1361d23ae79599e3fa94cba206bd40764f9eee0c584e639af13828dabb7f0dfa361792c098b5afae0bb350407b2dc47a1d67580daeade7a4f3e3e55e42c8470' + 'c1653f91067d31801a23450175e47968add147477caf20aec6092831739641312f4ad995af43c7e55545007279016b5f62a0720d31e4591b4421a65b8bd5b398' + 'a123747792417d3760ca40d7f913c2cdd194da2ea5778352eedebc80097b7b8dce4428a8fe8bd75cab92972f599c25bcf18a740856fc2990351234b0d7ebf9f5') + +_replacesarchkernel=("${_replacesarchkernel[@]/\%/${pkgbase#linux-libre}}") +_replacesoldkernels=("${_replacesoldkernels[@]/\%/${pkgbase#linux-libre}}") +_replacesoldmodules=("${_replacesoldmodules[@]/\%/${pkgbase#linux-libre}}") + +case "$CARCH" in i686|x86_64) KARCH=x86;; armv7h) KARCH=arm;; esac +export KBUILD_BUILD_HOST=parabola +export KBUILD_BUILD_USER=$pkgbase +export KBUILD_BUILD_TIMESTAMP="@${SOURCE_DATE_EPOCH:-$(date +%s)}" + prepare() { - cd ${_srcname} + cd $_srcname # add upstream patch - if [ "${_srcbasever}" != "${_srcver}" ]; then - patch -p1 -i ../patch-${_srcbasever}-${_srcver} - fi - chmod +x tools/objtool/sync-check.sh # GNU patch doesn't support git-style file mode - - if [ "${CARCH}" = "armv7h" ]; then - # RCN patch (CM3 firmware deblobbed and AUFS/WireGuard removed) - # Note: For stability reasons, AUFS has been removed in the RCN patch. - # We are supporting AUFS in linux-libre-pck through PCK patch. - # See https://wiki.parabola.nu/PCK for further details. - patch -p1 -i ../rcn-libre-${rcnver}-${rcnrel}.patch - - # ALARM patches - patch -p1 -i ../0001-ARM-atags-add-support-for-Marvell-s-u-boot.patch - patch -p1 -i ../0002-ARM-atags-fdt-retrieve-MAC-addresses-from-Marvell-bo.patch - patch -p1 -i ../0003-SMILE-Plug-device-tree-file.patch - patch -p1 -i ../0004-fix-mvsdio-eMMC-timing.patch - patch -p1 -i ../0005-net-smsc95xx-Allow-mac-address-to-be-set-as-a-parame.patch - patch -p1 -i ../0006-set-default-cubietruck-led-triggers.patch - patch -p1 -i ../0007-exynos4412-odroid-set-higher-minimum-buck2-regulator.patch - patch -p1 -i ../0008-ARM-dove-enable-ethernet-on-D3Plug.patch - patch -p1 -i ../0009-usb-dwc2-disable-power_down-on-rockchip-devices.patch + if [ "$_srcbasever" != "$_srcver" ]; then + patch -p1 -i ../patch-$_srcbasever-$_srcver fi # add freedo as boot logo install -m644 -t drivers/video/logo \ ../logo_linux_{clut224.ppm,vga16.ppm,mono.pbm} - # security patches - - # add latest fixes from stable queue, if needed - # http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git - - # allow disabling USER_NS via sysctl - patch -Np1 -i ../0001-add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by.patch - patch -Np1 -i ../0002-ZEN-Add-CONFIG-for-unprivileged_userns_clone.patch - - # maintain the TTY over USB disconnects - # http://www.coreboot.org/EHCI_Gadget_Debug - patch -p1 -i ../0001-usb-serial-gadget-no-TTY-hangup-on-USB-disconnect-WI.patch - - # fix Atmel maXTouch touchscreen support - # https://labs.parabola.nu/issues/877 - # http://www.fsfla.org/pipermail/linux-libre/2015-November/003202.html - patch -p1 -i ../0002-fix-Atmel-maXTouch-touchscreen-support.patch - - cp -Tf ../config.$CARCH .config - - if [ "${_kernelname}" != "" ]; then - sed -i "s|CONFIG_LOCALVERSION=.*|CONFIG_LOCALVERSION=\"${_kernelname}\"|g" ./.config - sed -i "s|CONFIG_LOCALVERSION_AUTO=.*|CONFIG_LOCALVERSION_AUTO=n|" ./.config + msg2 "Setting version..." + scripts/setlocalversion --save-scmversion + echo "-$pkgrel" > localversion.10-pkgrel + echo "${pkgbase#linux-libre}" > localversion.20-pkgname + + if [ "$CARCH" = "armv7h" ]; then + local src_armv7h + for src_armv7h in "${source_armv7h[@]}"; do + src_armv7h="${src_armv7h%%::*}" + src_armv7h="${src_armv7h##*/}" + [[ $src_armv7h = *.patch ]] || continue + msg2 "Applying patch $src_armv7h..." + patch -Np1 < "../$src_armv7h" + done fi - # append pkgrel to extraversion - sed -ri "s|^(EXTRAVERSION =.*\S).*|\1-${pkgrel}|" Makefile - - # don't run depmod on 'make install'. We'll do this ourselves in packaging - sed -i '2iexit 0' scripts/depmod.sh - - # get kernel version - make prepare + local src + for src in "${source[@]}"; do + src="${src%%::*}" + src="${src##*/}" + [[ $src = *.patch ]] || continue + msg2 "Applying patch $src..." + patch -Np1 < "../$src" + done - # load configuration - # Configure the kernel. Replace the line below with one of your choice. - #make menuconfig # CLI menu for configuration - #make nconfig # new CLI menu for configuration - #make xconfig # X-based configuration - #make oldconfig # using old config from previous kernel version - # ... or manually edit .config + msg2 "Setting config..." + cp ../config.$CARCH .config + make olddefconfig - # rewrite configuration - yes "" | make config >/dev/null + make -s kernelrelease > version + msg2 "Prepared %s version %s" "$pkgbase" "$(=0.7') - optdepends=('crda: to set the correct wireless channels of your country') - provides=("${_replacesarchkernel[@]/%/=${_archpkgver}}" "LINUX-ABI_VERSION=${_srcver%%-*}") + pkgdesc="The ${pkgbase^} kernel and modules" + depends=(coreutils kmod initramfs) + optdepends=('crda: to set the correct wireless channels of your country' + 'linux-libre-firmware: firmware images needed for some devices') + provides=("${_replacesarchkernel[@]/%/=${_srcver%%-*}}" "LINUX-ABI_VERSION=${_srcver%%-*}") conflicts=("${_replacesarchkernel[@]}" "${_replacesoldkernels[@]}" "${_replacesoldmodules[@]}") replaces=("${_replacesarchkernel[@]}" "${_replacesoldkernels[@]}" "${_replacesoldmodules[@]}") - backup=("etc/mkinitcpio.d/${pkgbase}.preset") - install=linux-lts.install - - cd ${_srcname} - - # get kernel version - _kernver="$(make LOCALVERSION= kernelrelease)" - _basekernel=${_kernver%%-*} - _basekernel=${_basekernel%.*} - - mkdir -p "${pkgdir}"/{boot,usr/lib/modules} - make LOCALVERSION= INSTALL_MOD_PATH="${pkgdir}/usr" modules_install - if [ "${CARCH}" = "armv7h" ]; then - make LOCALVERSION= INSTALL_DTBS_PATH="${pkgdir}/boot/dtbs/${pkgbase}" dtbs_install - cp arch/$KARCH/boot/zImage "${pkgdir}/boot/vmlinuz-${pkgbase}" - elif [ "${CARCH}" = "x86_64" ] || [ "${CARCH}" = "i686" ]; then - cp arch/$KARCH/boot/bzImage "${pkgdir}/boot/vmlinuz-${pkgbase}" - fi + cd $_srcname + local kernver="$( "${startdir}/${install}.pkg" - true && install=${install}.pkg + msg2 "Installing mkinitcpio preset..." + sed "s|%PKGBASE%|$pkgbase|g;s|%KERNVER%|$kernver|g" ../linux-armv7h.preset \ + | install -Dm644 /dev/stdin "$pkgdir/etc/mkinitcpio.d/$pkgbase.preset" + fi - # install mkinitcpio preset file - sed "${_subst}" ../linux-lts.preset | - install -Dm644 /dev/stdin "${pkgdir}/etc/mkinitcpio.d/${pkgbase}.preset" + # remove build and source links + rm "$modulesdir"/{source,build} - # install pacman hooks - sed "${_subst}" ../60-linux.hook | - install -Dm644 /dev/stdin "${pkgdir}/usr/share/libalpm/hooks/60-${pkgbase}.hook" - sed "${_subst}" ../90-linux.hook | - install -Dm644 /dev/stdin "${pkgdir}/usr/share/libalpm/hooks/90-${pkgbase}.hook" + msg2 "Fixing permissions..." + chmod -Rc u=rwX,go=rX "$pkgdir" } _package-headers() { pkgdesc="Header files and scripts for building modules for ${pkgbase^} kernel" - provides=("${_replacesarchkernel[@]/%/-headers=${_archpkgver}}") + provides=("${_replacesarchkernel[@]/%/-headers=${_srcver%%-*}}") conflicts=("${_replacesarchkernel[@]/%/-headers}" "${_replacesoldkernels[@]/%/-headers}") replaces=("${_replacesarchkernel[@]/%/-headers}" "${_replacesoldkernels[@]/%/-headers}") - cd ${_srcname} - local _builddir="${pkgdir}/usr/lib/modules/${_kernver}/build" + cd $_srcname + local builddir="$pkgdir/usr/lib/modules/$(/dev/null) + msg2 "Fixing permissions..." + chmod -Rc u=rwX,go=rX "$pkgdir" } _package-docs() { pkgdesc="Kernel hackers manual - HTML documentation that comes with the ${pkgbase^} kernel" - provides=("${_replacesarchkernel[@]/%/-docs=${_archpkgver}}") + provides=("${_replacesarchkernel[@]/%/-docs=${_srcver%%-*}}") conflicts=("${_replacesarchkernel[@]/%/-docs}" "${_replacesoldkernels[@]/%/-docs}") replaces=("${_replacesarchkernel[@]/%/-docs}" "${_replacesoldkernels[@]/%/-docs}") - - cd ${_srcname} - local _builddir="${pkgdir}/usr/lib/modules/${_kernver}/build" - - mkdir -p "${_builddir}" - cp -t "${_builddir}" -a Documentation - - # Fix permissions - chmod -R u=rwX,go=rX "${_builddir}" + + cd $_srcname + local builddir="$pkgdir/usr/lib/modules/$(/dev/null && ! mountpoint -q /boot; then - echo "WARNING: /boot appears to be a separate partition but is not mounted." - fi - fi -} - -post_remove() { - rm -f boot/initramfs-%PKGBASE%.img - rm -f boot/initramfs-%PKGBASE%-fallback.img -} diff --git a/libre/linux-libre-lts/linux-lts.preset b/libre/linux-libre-lts/linux-lts.preset deleted file mode 100644 index 66709a8c1..000000000 --- a/libre/linux-libre-lts/linux-lts.preset +++ /dev/null @@ -1,14 +0,0 @@ -# mkinitcpio preset file for the '%PKGBASE%' package - -ALL_config="/etc/mkinitcpio.conf" -ALL_kver="/boot/vmlinuz-%PKGBASE%" - -PRESETS=('default' 'fallback') - -#default_config="/etc/mkinitcpio.conf" -default_image="/boot/initramfs-%PKGBASE%.img" -#default_options="" - -#fallback_config="/etc/mkinitcpio.conf" -fallback_image="/boot/initramfs-%PKGBASE%-fallback.img" -fallback_options="-S autodetect" -- cgit v1.2.3