Hardened Kernel updates for 2024-09-22 #343751
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Ma27
requested changes
Sep 22, 2024
|
The unsupported kernels need removing from |
|
Oh right, that's how it was built. Can you remove the kernels from both files then, please? EDIT: that said, maybe we need a checklist for removing kernels. Always grepping for references is a little annoying and - as it turns out - error-prone. |
fabianhjr
force-pushed
the
fix-linux-hardened
branch
from
36f994d
to
a1c5be5
Compare
|
Dropped the EOLed kernels from the original PR, then removed from |
|
Building on |
|
Result of 75 packages marked as broken and skipped:
66 packages failed to build:
389 packages built:
Not sure which of these are regressions; I’ll try on |
ofborg
bot
added
10.rebuild-darwin: 0
|
Fwiw the 5.4 hardened tests ( Seems like something failed very early: 5.15/5.10 are fine. EDIT:
In my experience most of these will be hardened issues, not new regressions. |
|
FWIW: Result of 85 packages marked as broken and skipped:
47 packages failed to build:
599 packages built:
Maybe we should just mark 5.4 broken if it’s causing issues? |
|
Don't think so, the extensions of the base kernels are also exposed but their broken attribute might need to be set or a maintainer of a specific extension might fix it. Though those have probably been broken for a long time and unrelated to the update |
|
The issue I see with marking those as broken is that you always have to maintain that list of broken things and for me hardened kernel is something, very few people want (and they know that most of the stuff doesn't build anyways), so I wouldn't want to invest too much time into that. OTOH it would obviously save Hydra from scheduling builds that are known to fail. What I'm wondering is: how many kernel modules to actually build for hardened? Perhaps it's easier to go the other way round and mark everything as broken except for the N things that actually build. |
|
ZHF is upcoming so maintainers would either fix or have that marked as broken then |
|
Hi @Ma27, is it ok to merge this as is meanwhile? (Merging is blocked on your requested changes) |
|
@fabianhjr I don't mind the extensions being broken, but what do we do about the failing 5.4 hardened test? This actually seems like a regression. |
|
Would like to take a look but focusing on unbreaking some things on the staging-next cycle (of which linux-hardened is part of such breakage) I could target this to staging-next where these are currently not building and would be part of fixing them but I don't think other maintainers would notice that test failure until it landed on main :s |
|
Oh nvm, not a regression, has been broken since July 28, so two months with breakage |
|
I mean, I don't expect you to fix it, for me it would be perfectly sufficient to mark 5.4 hardened as broken. This is actually a little dangerous IMHO since it seems to have trouble booting up properly according to the logs I've pasted above. EDIT: that said, I can also take care of this tonight (CEST). |
|
I wonder if there is really any good reason for us to carry hardened kernels other than for the latest supported release and the latest supported LTS release. I don’t remember if I had a specific rationale at the time other than matching what we already carried in the tree. |
|
Took the liberty of pushing a fix that marks linux_5_4_hardened as broken. Would later open an issue to discuss what's next to do. |
Due to releases now including a v (and before didn't) hardened hasn't been updated since May 2024 (4 months ago)
Smoketest fails with
machine # [ 3.785769] systemd[1]: dev-hugepages.mount: Failed to spawn executor: Argument list too long
machine # [ 3.788689] systemd[1]: dev-hugepages.mount: Failed to spawn 'mount' task: Argument list too long
machine # [ 3.790100] systemd[1]: dev-hugepages.mount: Failed with result 'resources'.
machine # [ 3.791572] systemd[1]: Failed to mount Huge Pages File System.
Ma27
force-pushed
the
fix-linux-hardened
branch
from
49c21a7
to
62c09a3
Compare
Ma27
approved these changes
Sep 23, 2024
|
Thanks @Ma27, sure thing won't merge until eval finishes. Thanks for helping out :3 |
ofborg
bot
requested review from
TredwellGit,
Ma27,
NeQuissimus and
thoughtpolice
|
Eval finished, merging |
|
Backport failed for Please cherry-pick the changes locally and resolve any conflicts. git fetch origin release-24.05
git worktree add -d .worktree/backport-343751-to-release-24.05 origin/release-24.05
cd .worktree/backport-343751-to-release-24.05
git switch --create backport-343751-to-release-24.05
git cherry-pick -x 60623de0b351f669b2486ed0c6b32c0d826a234e ad3ec7bd3d6f9eb1803f5ca0f6598260abb640de fec646af8d166d7ed31a85c044921843a889bad0 6178bdf0298f37f2ec35f0ede8f3f81e63868f82 2794012a3e1c8bbf8b58ef975213ebc2d3a2afe2 1f403d3a06fe27e83c21adfe5c68d08c31a136e3 e930509d183abe4abc3cb55ee4f5c2284c1003e0 6a510f85187e6370586a823ea924c060fe7d6278 f0e642ad8bccc0c3c2754a3e1da4a4cffecbfb47 57a558e46d0dc66981b9ab54261aa1216d6a5247 904a34e89ba1457cd55b6606a92c236ca6d90e6d 62c09a3647304d28907ac45c015ff5f8fb07ac94 |
13 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of changes
Last hardened kernel updates: #315121
Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.