mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-02-12 14:44:11 -05:00
Commita7c699d090("kbuild: rpm-pkg: build a debuginfo RPM") adjusted the __spec_install_post macro to include __os_install_post, which runs brp-strip. This ends up stripping module signatures, breaking loading modules with lockdown enabled. Undo most of the changes of the aforementioned debuginfo patch and mirror commit16c36f8864("kbuild: deb-pkg: use build ID instead of debug link for dbg package") in kernel.spec to generate a functionally equivalent debuginfo package while avoiding touching the modules after they have already been signed during modules_install. Fixes:a7c699d090("kbuild: rpm-pkg: build a debuginfo RPM") Reported-by: Holger Kiehl <Holger.Kiehl@dwd.de> Closes: https://lore.kernel.org/68c375f6-e07e-fec-434d-6a45a4f1390@praktifix.dwd.de/ Tested-by: Holger Kiehl <Holger.Kiehl@dwd.de> Signed-off-by: Nathan Chancellor <nathan@kernel.org> Link: https://patch.msgid.link/20260121-fix-module-signing-binrpm-pkg-v1-1-8fc5832b6cbc@kernel.org Signed-off-by: Nicolas Schier <nsc@kernel.org>
170 lines
5.7 KiB
RPMSpec
170 lines
5.7 KiB
RPMSpec
# _arch is undefined if /usr/lib/rpm/platform/*/macros was not included.
|
|
%{!?_arch: %define _arch dummy}
|
|
%{!?make: %define make make}
|
|
%define makeflags %{?_smp_mflags} ARCH=%{ARCH}
|
|
%define __spec_install_post /usr/lib/rpm/brp-compress || :
|
|
%define debug_package %{nil}
|
|
|
|
Name: kernel
|
|
Summary: The Linux Kernel
|
|
Version: %(echo %{KERNELRELEASE} | sed -e 's/-/_/g')
|
|
Release: %{pkg_release}
|
|
License: GPL
|
|
Group: System Environment/Kernel
|
|
Vendor: The Linux Community
|
|
URL: https://www.kernel.org
|
|
Source0: linux.tar.gz
|
|
Source1: config
|
|
Source2: diff.patch
|
|
Provides: kernel-%{KERNELRELEASE}
|
|
BuildRequires: bc binutils bison dwarves
|
|
BuildRequires: (elfutils-devel or libdw-devel)
|
|
BuildRequires: (elfutils-libelf-devel or libelf-devel) flex
|
|
BuildRequires: gcc make openssl openssl-devel perl python3 rsync
|
|
|
|
%description
|
|
The Linux Kernel, the operating system core itself
|
|
|
|
%package headers
|
|
Summary: Header files for the Linux kernel for use by glibc
|
|
Group: Development/System
|
|
Obsoletes: kernel-headers < %{version}
|
|
Provides: kernel-headers = %{version}
|
|
%description headers
|
|
Kernel-headers includes the C header files that specify the interface
|
|
between the Linux kernel and userspace libraries and programs. The
|
|
header files define structures and constants that are needed for
|
|
building most standard programs and are also needed for rebuilding the
|
|
glibc package.
|
|
|
|
%if %{with_devel}
|
|
%package devel
|
|
Summary: Development package for building kernel modules to match the %{version} kernel
|
|
Group: System Environment/Kernel
|
|
AutoReqProv: no
|
|
%description -n kernel-devel
|
|
This package provides kernel headers and makefiles sufficient to build modules
|
|
against the %{version} kernel package.
|
|
%endif
|
|
|
|
%if %{with_debuginfo}
|
|
%package debuginfo
|
|
Summary: Debug information package for the Linux kernel
|
|
%description debuginfo
|
|
This package provides debug information for the kernel image and modules from the
|
|
%{version} package.
|
|
%endif
|
|
|
|
%prep
|
|
%setup -q -n linux
|
|
cp %{SOURCE1} .config
|
|
patch -p1 < %{SOURCE2}
|
|
|
|
%build
|
|
%{make} %{makeflags} KERNELRELEASE=%{KERNELRELEASE} KBUILD_BUILD_VERSION=%{release}
|
|
|
|
%install
|
|
mkdir -p %{buildroot}/lib/modules/%{KERNELRELEASE}
|
|
cp $(%{make} %{makeflags} -s image_name) %{buildroot}/lib/modules/%{KERNELRELEASE}/vmlinuz
|
|
# DEPMOD=true makes depmod no-op. We do not package depmod-generated files.
|
|
%{make} %{makeflags} INSTALL_MOD_PATH=%{buildroot} INSTALL_MOD_STRIP=1 DEPMOD=true modules_install
|
|
%{make} %{makeflags} INSTALL_HDR_PATH=%{buildroot}/usr headers_install
|
|
cp System.map %{buildroot}/lib/modules/%{KERNELRELEASE}
|
|
cp .config %{buildroot}/lib/modules/%{KERNELRELEASE}/config
|
|
if %{make} %{makeflags} run-command KBUILD_RUN_COMMAND='test -d ${srctree}/arch/${SRCARCH}/boot/dts' 2>/dev/null; then
|
|
%{make} %{makeflags} INSTALL_DTBS_PATH=%{buildroot}/lib/modules/%{KERNELRELEASE}/dtb dtbs_install
|
|
fi
|
|
ln -fns /usr/src/kernels/%{KERNELRELEASE} %{buildroot}/lib/modules/%{KERNELRELEASE}/build
|
|
%if %{with_devel}
|
|
%{make} %{makeflags} run-command KBUILD_RUN_COMMAND='${srctree}/scripts/package/install-extmod-build %{buildroot}/usr/src/kernels/%{KERNELRELEASE}'
|
|
%endif
|
|
|
|
{
|
|
echo "/lib/modules/%{KERNELRELEASE}"
|
|
|
|
for x in alias alias.bin builtin.alias.bin builtin.bin dep dep.bin \
|
|
devname softdep symbols symbols.bin weakdep; do
|
|
echo "%ghost /lib/modules/%{KERNELRELEASE}/modules.${x}"
|
|
done
|
|
|
|
for x in System.map config vmlinuz; do
|
|
echo "%ghost /boot/${x}-%{KERNELRELEASE}"
|
|
done
|
|
|
|
if [ -d "%{buildroot}/lib/modules/%{KERNELRELEASE}/dtb" ];then
|
|
find "%{buildroot}/lib/modules/%{KERNELRELEASE}/dtb" -printf "%%%ghost /boot/dtb-%{KERNELRELEASE}/%%P\n"
|
|
fi
|
|
|
|
echo "%exclude /lib/modules/%{KERNELRELEASE}/build"
|
|
} > %{buildroot}/kernel.list
|
|
|
|
%if %{with_debuginfo}
|
|
# copying vmlinux directly to the debug directory means it will not get
|
|
# stripped (but its source paths will still be collected + fixed up)
|
|
mkdir -p %{buildroot}/usr/lib/debug/lib/modules/%{KERNELRELEASE}
|
|
cp vmlinux %{buildroot}/usr/lib/debug/lib/modules/%{KERNELRELEASE}
|
|
|
|
echo /usr/lib/debug/lib/modules/%{KERNELRELEASE}/vmlinux > %{buildroot}/debuginfo.list
|
|
|
|
while read -r mod; do
|
|
mod="${mod%.o}.ko"
|
|
dbg="%{buildroot}/usr/lib/debug/lib/modules/%{KERNELRELEASE}/kernel/${mod}"
|
|
buildid=$("${READELF}" -n "${mod}" | sed -n 's@^.*Build ID: \(..\)\(.*\)@\1/\2@p')
|
|
link="%{buildroot}/usr/lib/debug/.build-id/${buildid}.debug"
|
|
|
|
mkdir -p "${dbg%/*}" "${link%/*}"
|
|
"${OBJCOPY}" --only-keep-debug "${mod}" "${dbg}"
|
|
ln -sf --relative "${dbg}" "${link}"
|
|
|
|
echo "${dbg#%{buildroot}}" >> %{buildroot}/debuginfo.list
|
|
echo "${link#%{buildroot}}" >> %{buildroot}/debuginfo.list
|
|
done < modules.order
|
|
%endif
|
|
|
|
%clean
|
|
rm -rf %{buildroot}
|
|
|
|
%post
|
|
if [ -x /usr/bin/kernel-install ]; then
|
|
/usr/bin/kernel-install add %{KERNELRELEASE} /lib/modules/%{KERNELRELEASE}/vmlinuz
|
|
fi
|
|
for file in vmlinuz System.map config; do
|
|
if ! cmp --silent "/lib/modules/%{KERNELRELEASE}/${file}" "/boot/${file}-%{KERNELRELEASE}"; then
|
|
cp "/lib/modules/%{KERNELRELEASE}/${file}" "/boot/${file}-%{KERNELRELEASE}"
|
|
fi
|
|
done
|
|
if [ -d "/lib/modules/%{KERNELRELEASE}/dtb" ] && \
|
|
! diff -rq "/lib/modules/%{KERNELRELEASE}/dtb" "/boot/dtb-%{KERNELRELEASE}" >/dev/null 2>&1; then
|
|
rm -rf "/boot/dtb-%{KERNELRELEASE}"
|
|
cp -r "/lib/modules/%{KERNELRELEASE}/dtb" "/boot/dtb-%{KERNELRELEASE}"
|
|
fi
|
|
if [ ! -e "/lib/modules/%{KERNELRELEASE}/modules.dep" ]; then
|
|
/usr/sbin/depmod %{KERNELRELEASE}
|
|
fi
|
|
|
|
%preun
|
|
if [ -x /usr/bin/kernel-install ]; then
|
|
kernel-install remove %{KERNELRELEASE}
|
|
fi
|
|
|
|
%files -f %{buildroot}/kernel.list
|
|
%defattr (-, root, root)
|
|
%exclude /kernel.list
|
|
|
|
%files headers
|
|
%defattr (-, root, root)
|
|
/usr/include
|
|
|
|
%if %{with_devel}
|
|
%files devel
|
|
%defattr (-, root, root)
|
|
/usr/src/kernels/%{KERNELRELEASE}
|
|
/lib/modules/%{KERNELRELEASE}/build
|
|
%endif
|
|
|
|
%if %{with_debuginfo}
|
|
%files -f %{buildroot}/debuginfo.list debuginfo
|
|
%defattr (-, root, root)
|
|
%exclude /debuginfo.list
|
|
%endif
|