]> git.ipfire.org Git - ipfire-2.x.git/blame - lfs/linux
linux: Fix for CVE-2022-0847 aka Dirty Pipe
[ipfire-2.x.git] / lfs / linux
CommitLineData
df5e82b3 1###############################################################################
df5e82b3 2# #
70df8302 3# IPFire.org - A linux based firewall #
c18dda55 4# Copyright (C) 2007-2022 IPFire Team <info@ipfire.org> #
70df8302
MT
5# #
6# This program is free software: you can redistribute it and/or modify #
df5e82b3 7# it under the terms of the GNU General Public License as published by #
70df8302 8# the Free Software Foundation, either version 3 of the License, or #
df5e82b3
MT
9# (at your option) any later version. #
10# #
70df8302 11# This program is distributed in the hope that it will be useful, #
df5e82b3
MT
12# but WITHOUT ANY WARRANTY; without even the implied warranty of #
13# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
14# GNU General Public License for more details. #
15# #
16# You should have received a copy of the GNU General Public License #
70df8302 17# along with this program. If not, see <http://www.gnu.org/licenses/>. #
df5e82b3 18# #
df5e82b3
MT
19###############################################################################
20
21###############################################################################
22# Definitions
23###############################################################################
24
25include Config
26
a17f1fbb
AF
27VER = 5.15.23
28ARM_PATCHES = 5.15-ipfire5
df5e82b3
MT
29
30THISAPP = linux-$(VER)
79f94395 31DL_FILE = linux-$(VER).tar.xz
a2cb3a33 32DL_FROM = $(URL_IPFIRE)
df5e82b3
MT
33DIR_APP = $(DIR_SRC)/$(THISAPP)
34CFLAGS =
35CXXFLAGS =
36
347db51a 37HEADERS_ARCH = $(BUILD_PLATFORM)
7f841117
AF
38KERNEL_ARCH = $(BUILD_ARCH)
39KERNEL_TARGET = bzImage
347db51a 40
dc7d6b20
MT
41ifeq "$(BUILD_ARCH)" "aarch64"
42 HEADERS_ARCH = arm64
347db51a
MT
43 KERNEL_ARCH = arm64
44 KERNEL_TARGET = Image
45endif
46
aafdd71b 47ifeq "$(BUILD_ARCH)" "armv6l"
07664187 48 KERNEL_ARCH = arm
347db51a 49 KERNEL_TARGET = zImage
ba583892
MT
50endif
51
fdf0c7c1 52VERSUFIX=ipfire$(KCFG)
b0d0b681 53
991d11d7 54ifeq "$(TOOLCHAIN)" "1"
cc24c14b 55 TARGET = $(DIR_INFO)/linux-$(VER)-$(VERSUFIX)-tools
6c4cc7ea 56 HEADERS_PREFIX = $(TOOLS_DIR)
3c7ae787 57 EXTRAMAKE = CROSS_COMPILE=$(CROSSTARGET)-
51f9e7ac
MT
58else
59 TARGET = $(DIR_INFO)/linux-$(VER)-$(VERSUFIX)
cc24c14b 60 HEADERS_PREFIX = /usr
51f9e7ac
MT
61endif
62
bc8fe5ff
AF
63ifeq "$(KCFG)" ""
64LASTKERNEL=1
65endif
bc8fe5ff 66
df5e82b3
MT
67###############################################################################
68# Top-level Rules
69###############################################################################
70objects =$(DL_FILE) \
b69338e0 71 arm-multi-patches-$(ARM_PATCHES).patch.xz
e69f1bf2 72
932a34e5 73$(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE)
b69338e0 74arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz
e69f1bf2 75
a17f1fbb
AF
76$(DL_FILE)_MD5 = 5e4405eabbf6b365fd5c9252f666ca60
77arm-multi-patches-$(ARM_PATCHES).patch.xz_MD5 = 5b588bcdf9d21cc7e8ce57c94b775195
bdf9df74 78
df5e82b3
MT
79install : $(TARGET)
80
81check : $(patsubst %,$(DIR_CHK)/%,$(objects))
82
83download :$(patsubst %,$(DIR_DL)/%,$(objects))
84
85md5 : $(subst %,%_MD5,$(objects))
86
f418a984
AF
87dist:
88 @$(PAK)
df5e82b3
MT
89###############################################################################
90# Downloading, checking, md5sum
91###############################################################################
92
93$(patsubst %,$(DIR_CHK)/%,$(objects)) :
94 @$(CHECK)
95
96$(patsubst %,$(DIR_DL)/%,$(objects)) :
97 @$(LOAD)
98
99$(subst %,%_MD5,$(objects)) :
100 @$(MD5)
101
102###############################################################################
103# Installation Details
104###############################################################################
105
106$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
107 @$(PREBUILD)
fdecb907 108 @rm -rf $(DIR_APP) $(DIR_SRC)/linux && cd $(DIR_SRC) && tar axf $(DIR_DL)/$(DL_FILE)
b0d0b681 109
51f9e7ac 110 ln -svf linux-$(VER) $(DIR_SRC)/linux
3a1019f6 111
3a1019f6 112 # Layer7-patch
b2b44178 113 cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-5.15.17-layer7.patch
bb5f0bf8 114
e2b79cd1 115 # DVB Patches
e2b79cd1
AF
116 cd $(DIR_APP) && patch -Np2 < $(DIR_SRC)/src/patches/v4l-dvb_fix_tua6034_pll.patch
117
d33aa452 118 # Wlan Patches
3005eb22 119 cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-4.14_ath_user_regd.patch
91648bd1 120 cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-4.9.8-iwlwifi-noibss_only_on_radar_chan.patch
d33aa452 121
fcffac13 122 # Fix igb and e1000e crash
2e1fe3c8 123 cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-4.14.1-igb-e1000e_fix_lock_at_update_stats.patch
d52f1169 124
1e67b3c3 125 # cs5535audio spams syslog if no ac97 was present (geos router)
91648bd1 126 cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-4.9.8_cs5535audio_fix_logspam_on_geos.patch
1e67b3c3 127
87837787 128 # Fix uevent PHYSDEVDRIVER
91648bd1 129 cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-2.6.32.27_mcs7830-fix-driver-name.patch
bd64e2a0 130
c062c770
AF
131 # fix Boot with enabled usercopy hardening
132 cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-5.9-crypto_testmgr_allocate_buffers_with____GFP_COMP.patch
b923dd3d 133
aafdd71b 134ifeq "$(BUILD_ARCH)" "armv6l"
0a21d63f 135 # Apply Arm-multiarch kernel patches.
5a27051f 136 cd $(DIR_APP) && xzcat $(DIR_DL)/arm-multi-patches-$(ARM_PATCHES).patch.xz | patch -Np1
c448474f 137endif
66a29eaa
AF
138ifeq "$(BUILD_ARCH)" "aarch64"
139 # Apply Arm-multiarch kernel patches.
5a27051f 140 cd $(DIR_APP) && xzcat $(DIR_DL)/arm-multi-patches-$(ARM_PATCHES).patch.xz | patch -Np1
fdecb907 141endif
0b4976e2
AF
142 cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux/linux-3.14.79-amba-fix.patch
143
de686e49
MT
144 # Fix for CVE-2022-0847 aka Dirty Pipe
145 cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/kernel-5.15-CVE-2022-0847.patch
146
cee50e12 147ifeq "$(KCFG)" "-headers"
51f9e7ac 148 # Install the header files
3c7ae787 149 cd $(DIR_APP) && make ARCH=$(HEADERS_ARCH) $(EXTRAMAKE) headers
51f9e7ac 150 -mkdir -pv $(BUILDROOT)/$(HEADERS_PREFIX)/include
c062c770
AF
151 cd $(DIR_APP) && find usr/include -name '.*' -delete
152 cd $(DIR_APP) && rm usr/include/Makefile
153 cd $(DIR_APP) && cp -rv usr/include/* $(BUILDROOT)/$(HEADERS_PREFIX)/include
51f9e7ac
MT
154else
155
aa2049e5
MT
156 # Install ipfire logo
157 cd $(DIR_APP) && cp -vf $(DIR_SRC)/config/kernel/ipfire_logo.ppm \
158 drivers/video/logo/logo_linux_clut224.ppm
159
df5e82b3 160 # Cleanup kernel source
dc7d6b20 161 cp $(DIR_SRC)/config/kernel/kernel.config.$(BUILD_ARCH)-$(VERSUFIX) $(DIR_APP)/.config
6f67c28d
MT
162 cd $(DIR_APP) && make oldconfig
163 cd $(DIR_APP) && make clean
fdecb907 164 cd $(DIR_APP) && sed -i -e 's/EXTRAVERSION\ =.*/EXTRAVERSION\ =\ -$(VERSUFIX)/' Makefile
3a1019f6 165
831ff05d
AF
166 # Copy Module signing key configuration
167 cp -f $(DIR_SRC)/config/kernel/x509.genkey $(DIR_APP)/certs/x509.genkey
168
2e65d316
AF
169 # Remove modules folder if exists
170 rm -rf /lib/modules/$(VER)-$(VERSUFIX)
171
347db51a
MT
172 # Build the kernel
173 cd $(DIR_APP) && make $(MAKETUNING) $(KERNEL_TARGET) modules
a158cbbb 174
347db51a
MT
175 # Install the kernel
176 cd $(DIR_APP) && cp -v arch/$(KERNEL_ARCH)/boot/$(KERNEL_TARGET) /boot/vmlinuz-$(VER)-$(VERSUFIX)
2b2e03ed
AF
177 cd $(DIR_APP) && cp -v System.map /boot/System.map-$(VER)-$(VERSUFIX)
178 cd $(DIR_APP) && cp -v .config /boot/config-$(VER)-$(VERSUFIX)
6f67c28d 179 cd $(DIR_APP) && make $(MAKETUNING) modules_install
376e42ce 180
dc7d6b20 181ifeq "$(BUILD_PLATFORM)" "arm"
6f67c28d 182 cd $(DIR_APP) && make $(MAKETUNING) dtbs
5b17da41 183 mkdir -p /boot/dtb-$(VER)-$(VERSUFIX)
574a7117 184 cd $(DIR_APP)/arch/$(KERNEL_ARCH)/boot/dts && for f in $$(find -name "*.dtb"); do \
5b17da41
AF
185 cp -v --parents $$f /boot/dtb-$(VER)-$(VERSUFIX)/ ; \
186 chmod 644 /boot/dtb-$(VER)-$(VERSUFIX)/$$f ; \
7284262a
AF
187 done
188endif
189
0ad5f6a1
MT
190 # Recreate source and build links
191 rm -rf /lib/modules/$(VER)-$(VERSUFIX)/{build,source}
192 mkdir -p /lib/modules/$(VER)-$(VERSUFIX)/build
193 ln -sf build /lib/modules/$(VER)-$(VERSUFIX)/source
194
195 # Create dirs for extra modules
196 mkdir -p /lib/modules/$(VER)-$(VERSUFIX)/extra
197
198 cd $(DIR_APP) && cp --parents $$(find -type f -name "Makefile*" -o -name "Kconfig*") \
199 /lib/modules/$(VER)-$(VERSUFIX)/build
200 cd $(DIR_APP) && cp Module.symvers System.map /lib/modules/$(VER)-$(VERSUFIX)/build
201 rm -rf /lib/modules/$(VER)-$(VERSUFIX)/build/{Documentation,scripts,include}
202
203 cd $(DIR_APP) && cp .config /lib/modules/$(VER)-$(VERSUFIX)/build
204 cd $(DIR_APP) && cp -a scripts /lib/modules/$(VER)-$(VERSUFIX)/build
205 find /lib/modules/$(VER)-$(VERSUFIX)/build/scripts -name "*.o" -exec rm -vf {} \;
206
207 cd $(DIR_APP) && cp -a --parents arch/$(HEADERS_ARCH)/include /lib/modules/$(VER)-$(VERSUFIX)/build
208 cd $(DIR_APP) && cp -a include /lib/modules/$(VER)-$(VERSUFIX)/build/include
209
831ff05d
AF
210 # Copy module signing key for off tree modules
211 cd $(DIR_APP) && cp -f certs/signing_key.* /lib/modules/$(VER)-$(VERSUFIX)/build/certs/
212
0ad5f6a1 213 # Install objtool
c1e8c954
MT
214 cd $(DIR_APP) && cp -a tools/objtool/objtool \
215 /lib/modules/$(VER)-$(VERSUFIX)/build/tools/objtool/ || :
0ad5f6a1
MT
216 cd $(DIR_APP) && cp -a --parents tools/build/{Build,Build.include,fixdep.c} \
217 tools/scripts/utilities.mak /lib/modules/$(VER)-$(VERSUFIX)/build
218
219 # Make sure we can build external modules
220 touch -r /lib/modules/$(VER)-$(VERSUFIX)/build/Makefile \
3f60a1e1 221 /lib/modules/$(VER)-$(VERSUFIX)/build/include/generated/uapi/linux/version.h
0ad5f6a1
MT
222 touch -r /lib/modules/$(VER)-$(VERSUFIX)/build/.config \
223 /lib/modules/$(VER)-$(VERSUFIX)/build/autoconf.h
224 cp /lib/modules/$(VER)-$(VERSUFIX)/build/.config \
225 /lib/modules/$(VER)-$(VERSUFIX)/build/include/config/auto.conf
226
227 # Fix permissions
228 find /lib/modules/$(VER)-$(VERSUFIX) -name "modules.order" \
229 -exec chmod 644 {} \;
230
231 find /lib/modules/$(VER)-$(VERSUFIX) -name ".*.cmd" -exec rm -f {} \;
232
bc8fe5ff
AF
233ifeq "$(LASTKERNEL)" "1"
234 # Only do this once
81e974f3 235 cd $(DIR_APP) && install -m 755 usr/gen_init_cpio /sbin/
d644d86f 236
050479e9
AF
237 # disable drm by install drm to /bin/false because i915 ignore blacklisting
238 echo install drm /bin/false > /etc/modprobe.d/framebuffer.conf
239
aa1dd878 240 # Blacklist old framebuffer modules
4c76d08b 241 for f in $$(find /lib/modules/$(VER)-$(VERSUFIX)/kernel/drivers/video/fbdev/ -name *.ko.xz); do \
ba109afd 242 echo "blacklist $$(basename $$f)" >> /etc/modprobe.d/framebuffer.conf ; \
030a57c5 243 done
aa1dd878 244 # Blacklist new drm framebuffer modules
4c76d08b 245 for f in $$(find /lib/modules/$(VER)-$(VERSUFIX)/kernel/drivers/gpu/drm -name *.ko.xz); do \
ba109afd 246 echo "blacklist $$(basename $$f)" >> /etc/modprobe.d/framebuffer.conf ; \
e31045ee 247 done
4c76d08b 248 sed -i -e "s|.ko.xz||g" /etc/modprobe.d/framebuffer.conf
e2e106be 249
78a51aaf 250 # Disable ipv6 at runtime
ba109afd 251 echo "options ipv6 disable_ipv6=1" > /etc/modprobe.d/ipv6.conf
26c1cc71 252endif
51f9e7ac 253endif
8885467f 254
22820bf2
AF
255 #force new build of external modules and initrd if the kernel was rebuild
256 -rm -f /usr/src/log/*-kmod-$(VER)-$(VERSUFIX)
257 -rm -f /usr/src/log/linux-initrd-$(VER)-$(VERSUFIX)
258
0ad5f6a1 259 @rm -rf $(DIR_APP) $(DIR_SRC)/linux
df5e82b3 260 @$(POSTBUILD)