diff options
author | jc_gargma <jc_gargma@iserlohn-fortress.net> | 2022-06-06 19:12:38 -0700 |
---|---|---|
committer | jc_gargma <jc_gargma@iserlohn-fortress.net> | 2022-06-06 19:12:38 -0700 |
commit | 875f6c6f5e26a0f7cef74876185897b8d58e4280 (patch) | |
tree | 8828a90602065fa4e7411b71e1cb7ccf37640ced | |
parent | Updated to 5.17.11 (diff) | |
download | linux-875f6c6f5e26a0f7cef74876185897b8d58e4280.tar.xz |
Updated to 5.17.13
-rw-r--r-- | 0002-random-treat-bootloader-trust-toggle-the-same-way-as.patch | 94 | ||||
-rw-r--r-- | PKGBUILD | 10 |
2 files changed, 3 insertions, 101 deletions
diff --git a/0002-random-treat-bootloader-trust-toggle-the-same-way-as.patch b/0002-random-treat-bootloader-trust-toggle-the-same-way-as.patch deleted file mode 100644 index 6686266..0000000 --- a/0002-random-treat-bootloader-trust-toggle-the-same-way-as.patch +++ /dev/null @@ -1,94 +0,0 @@ -From 5e79fc7d70e5c6e409254060066e7ab1b1d1a768 Mon Sep 17 00:00:00 2001 -From: "Jason A. Donenfeld" <Jason@zx2c4.com> -Date: Wed, 23 Mar 2022 23:09:30 -0600 -Subject: [PATCH 2/8] random: treat bootloader trust toggle the same way as cpu - trust toggle - -If CONFIG_RANDOM_TRUST_CPU is set, the RNG initializes using RDRAND. -But, the user can disable (or enable) this behavior by setting -`random.trust_cpu=0/1` on the kernel command line. This allows system -builders to do reasonable things while avoiding howls from tinfoil -hatters. (Or vice versa.) - -CONFIG_RANDOM_TRUST_BOOTLOADER is basically the same thing, but regards -the seed passed via EFI or device tree, which might come from RDRAND or -a TPM or somewhere else. In order to allow distros to more easily enable -this while avoiding those same howls (or vice versa), this commit adds -the corresponding `random.trust_bootloader=0/1` toggle. - -Cc: Theodore Ts'o <tytso@mit.edu> -Cc: Graham Christensen <graham@grahamc.com> -Reviewed-by: Ard Biesheuvel <ardb@kernel.org> -Reviewed-by: Dominik Brodowski <linux@dominikbrodowski.net> -Link: https://github.com/NixOS/nixpkgs/pull/165355 -Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> ---- - Documentation/admin-guide/kernel-parameters.txt | 6 ++++++ - drivers/char/Kconfig | 3 ++- - drivers/char/random.c | 8 +++++++- - 3 files changed, 15 insertions(+), 2 deletions(-) - -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index 59f881f36779..bdc733c2561d 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -4355,6 +4355,12 @@ - fully seed the kernel's CRNG. Default is controlled - by CONFIG_RANDOM_TRUST_CPU. - -+ random.trust_bootloader={on,off} -+ [KNL] Enable or disable trusting the use of the -+ a seed passed by the bootloader (if available) to -+ fully seed the kernel's CRNG. Default is controlled -+ by CONFIG_RANDOM_TRUST_BOOTLOADER. -+ - randomize_kstack_offset= - [KNL] Enable or disable kernel stack offset - randomization, which provides roughly 5 bits of -diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig -index 740811893c57..55f48375e3fe 100644 ---- a/drivers/char/Kconfig -+++ b/drivers/char/Kconfig -@@ -449,6 +449,7 @@ config RANDOM_TRUST_BOOTLOADER - device randomness. Say Y here to assume the entropy provided by the - booloader is trustworthy so it will be added to the kernel's entropy - pool. Otherwise, say N here so it will be regarded as device input that -- only mixes the entropy pool. -+ only mixes the entropy pool. This can also be configured at boot with -+ "random.trust_bootloader=on/off". - - endmenu -diff --git a/drivers/char/random.c b/drivers/char/random.c -index 3404a91edf29..19bf14e253f7 100644 ---- a/drivers/char/random.c -+++ b/drivers/char/random.c -@@ -738,11 +738,17 @@ static void invalidate_batched_entropy(void); - static void numa_crng_init(void); - - static bool trust_cpu __ro_after_init = IS_ENABLED(CONFIG_RANDOM_TRUST_CPU); -+static bool trust_bootloader __ro_after_init = IS_ENABLED(CONFIG_RANDOM_TRUST_BOOTLOADER); - static int __init parse_trust_cpu(char *arg) - { - return kstrtobool(arg, &trust_cpu); - } -+static int __init parse_trust_bootloader(char *arg) -+{ -+ return kstrtobool(arg, &trust_bootloader); -+} - early_param("random.trust_cpu", parse_trust_cpu); -+early_param("random.trust_bootloader", parse_trust_bootloader); - - static bool crng_init_try_arch(struct crng_state *crng) - { -@@ -2229,7 +2235,7 @@ EXPORT_SYMBOL_GPL(add_hwgenerator_randomness); - */ - void add_bootloader_randomness(const void *buf, unsigned int size) - { -- if (IS_ENABLED(CONFIG_RANDOM_TRUST_BOOTLOADER)) -+ if (trust_bootloader) - add_hwgenerator_randomness(buf, size, size * 8); - else - add_device_randomness(buf, size); --- -2.35.1 - @@ -19,7 +19,7 @@ _custom=0 pkgbase=linux _supver=5 _majver=17 -_minver=11 +_minver=13 _gccpatchver='20220315' _gccpatchker='5.17+' if [ "$_minver" == "0" ]; then @@ -43,7 +43,6 @@ source=( https://www.kernel.org/pub/linux/kernel/v${_supver}.x/${_srcname}.tar.{xz,sign} config # the main kernel config file 0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch - 0002-random-treat-bootloader-trust-toggle-the-same-way-as.patch 0003-tick-Detect-and-fix-jiffies-update-stall.patch 0004-tick-rcu-Remove-obsolete-rcu_needs_cpu-parameters.patch 0005-tick-rcu-Stop-allowing-RCU_SOFTIRQ-in-idle.patch @@ -58,11 +57,10 @@ validpgpkeys=( '647F28654894E3BD457199BE38DBBDC86092693E' # Greg Kroah-Hartman ) # https://www.kernel.org/pub/linux/kernel/v5.x/sha256sums.asc -sha256sums=('5708e656fae734c3a7b27718345b29e2f7bfd06dfb85acdffca0ba4505f81b31' +sha256sums=('ea47fd08a16bd9001aacc8b88abd24af489bd87a364dd0545e0b6823a68bef53' 'SKIP' 'c603b522eaf21f9a4e937645798bec4d6939eb5149b55fd487b87ca41454e108' '3e094bc2b28de53c8c26ba557cff29ec69f16c02267a8267e1e7c9bbedee0ea9' - 'ef926b527b303aab1a545c06ab164f0de7ae0e626fe209d9e60e81a185d8c553' '020d88eca1a00ab22aa1ea9bb5cfd9aafde31a2768669bba5dba0d91a3d7c2f5' '8a51d80b784e5c82fd0b013912d8314f20fbc8a173aa8f90487c6163b0921034' '9ef50e453ff86e9f2764da1da1e5c04f644760fb10720a3626dacd211cdc9967' @@ -71,11 +69,10 @@ sha256sums=('5708e656fae734c3a7b27718345b29e2f7bfd06dfb85acdffca0ba4505f81b31' '5a29d172d442a3f31a402d7d306aaa292b0b5ea29139d05080a55e2425f48c5c' 'e9e0d289170b7fb598b572d9c892ae8d1420952034aa415e8b3334f20a58edcc' '6ab863c8cfe6e0dd53a9d6455872fd4391508a8b97ab92e3f13558a6617b12a6') -b2sums=('eac40fbd6589b315983d30e3711c5a71065e8447df607f6ad02a2b430f8f47bdef6ad5cbb7e43c94b2016e9d045955593657dd7e2498f1a04c6272307a579d2f' +b2sums=('3efcb9b576a3ed7e5a8863a06f91b0436d57f0098db5aa72a2751f001f3605d8c6b1f58a92dad5394106d0b29ab5379bfb3937f3bd8ef95931e2d480846f0bc1' 'SKIP' 'f9b876591ae41bf7d92f610d8b9a29bd6ec53b2a3b88aa1bb5e51df9debc244b9a98c4c9b917e463be517c8e10675a46866604e19b3dbc415b779cf7428b3415' 'b816ecce411841a40267cb00e8bcd2b95caf6295aa0a4af166499b46161c6573ea2935b8a3963c9721c24e8b5e346a24b044890ab9680f796c4a560227da2bc4' - '6719eb70c209176ff03804635f27e716182fda5935feb54b39f9dcc2dddbf178b271ba4029c80b7fb3120e51cad4ea7df12cb63437c838abacf41a4096fd6079' 'b0bb82a64a3ebc7ef2dce75ab1fc1610d18021759e0064642d73a27371db77ac33dde4c54c998a82993d27c50fa8b05d89802ae42c636f79dba1d774ada07df8' 'a7a30db59e126b4806f3302b110b0795f2d75d1448a44e5c00d778dfa4ea08df25f8a803d6b3a729167851c04ea965c07e2962e0df0d2e1f56a8e42b2118486b' '221f89858de17a5dfdc86189b1b356e19782913aee8f5c2a82431adee4ad5825b22980f74bb2cb505e03c8a1ca50aa42172c6ec4f9a1d4179bce760e3cf41402' @@ -103,7 +100,6 @@ prepare() { # Hotfixes echo "Applying hotfixes" patch -p1 -i ../0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch - patch -p1 -i ../0002-random-treat-bootloader-trust-toggle-the-same-way-as.patch patch -p1 -i ../0003-tick-Detect-and-fix-jiffies-update-stall.patch patch -p1 -i ../0004-tick-rcu-Remove-obsolete-rcu_needs_cpu-parameters.patch patch -p1 -i ../0005-tick-rcu-Stop-allowing-RCU_SOFTIRQ-in-idle.patch |