From 2608b70afdcf5e6b1ee724ca647f0c1f85513e81 Mon Sep 17 00:00:00 2001 From: Johnny Hughes Date: Sep 08 2021 13:31:51 +0000 Subject: Manual CentOS Debranding --- diff --git a/SOURCES/centos-ca-secureboot.der b/SOURCES/centos-ca-secureboot.der new file mode 100644 index 0000000..44a2563 Binary files /dev/null and b/SOURCES/centos-ca-secureboot.der differ diff --git a/SOURCES/centos-dup.x509 b/SOURCES/centos-dup.x509 new file mode 100644 index 0000000..9c65dd3 Binary files /dev/null and b/SOURCES/centos-dup.x509 differ diff --git a/SOURCES/centos-kpatch.x509 b/SOURCES/centos-kpatch.x509 new file mode 100644 index 0000000..ca57a43 Binary files /dev/null and b/SOURCES/centos-kpatch.x509 differ diff --git a/SOURCES/centos.pem b/SOURCES/centos.pem new file mode 100644 index 0000000..82ad817 --- /dev/null +++ b/SOURCES/centos.pem @@ -0,0 +1,42 @@ +-----BEGIN CERTIFICATE----- +MIIDgTCCAmmgAwIBAgIJALYWFXFy+zGAMA0GCSqGSIb3DQEBCwUAMEwxJjAkBgNV +BAMMHUNlbnRPUyBTZWN1cmUgQm9vdCAoQ0Ega2V5IDEpMSIwIAYJKoZIhvcNAQkB +FhNzZWN1cml0eUBjZW50b3Mub3JnMB4XDTE5MDYwMzE0MjA0MFoXDTM4MDEwMTE0 +MjA0MFowVTEvMC0GA1UEAwwmQ2VudE9TIExpbnV4IERyaXZlciB1cGRhdGUgc2ln +bmluZyBrZXkxIjAgBgkqhkiG9w0BCQEWE3NlY3VyaXR5QGNlbnRvcy5vcmcwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD5ECuosQ4HKRRf+Kxfm+BcICBK +PGqB+E/qalqQ3CCM3LWezq0ns/GZTD0CtSAzmOObqJb3gJ9S5gcbaMVBc3JxLlQ+ +RwVy0oNy91uy9TKhYQ3lpHDyujxiFmXPSJLMKOYbOBNObJ7qF6+ptnmDWMu7GWDc +4UGdBdU/evt92LIxsi9ZQCEoZIqdyKBE/Y3V9gBZIZa/4oXMHfW9dWxhy9UszmR9 +hT7ZdgLFpWMFmJW+SS5QEWtp5CpRlcui4QJZl42bMp5JOrVWc+BlKPIsLdY8TqLp +9FdhQ5Ih4auT7zn2V89YgYpq6VMZnPsn/v5piB6i6RK8Falr6SP5SV0cwV/jAgMB +AAGjXTBbMAwGA1UdEwEB/wQCMAAwCwYDVR0PBAQDAgeAMB0GA1UdDgQWBBQpvUwN +BtLpkRBEtdyXMwkTm1HW1TAfBgNVHSMEGDAWgBRU7IGFiT7pGtsI90SIVH6OP3Q6 +8zANBgkqhkiG9w0BAQsFAAOCAQEAK+f4c4aP9TQDiQM4TDyw8iDapr7eBc+Yr0M5 +ELkWEQu55/OwLQrgCA5bdD86diaAXQAlUOXCtFRrbUQHQACEL77/32YdooHfVZZ7 +04CeE+JWxF/cQ3M5hhJnkyxaqFKC+B+bn7Z6eloMnYUPsXwfQEOuyxKaKergAJdq +KnC0pEG3NGgwlwvnD0dwUqbbEUUqL3UQh96hCYDidhCUmuap1E2OGoxGex3ekszf +ErCgwVYb46cv91ba2KqXVWl1FoO3c5MyZcxL46ihQgiY0BI975+HDFjpUZ69n+Um +OhSscRUiKeEQKMVtHzyQUp5t+HCeaZBRPy3rFoIjTEqijKZ6tQ== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDejCCAmKgAwIBAgIJALYWFXFy+zF/MA0GCSqGSIb3DQEBCwUAMEwxJjAkBgNV +BAMMHUNlbnRPUyBTZWN1cmUgQm9vdCAoQ0Ega2V5IDEpMSIwIAYJKoZIhvcNAQkB +FhNzZWN1cml0eUBjZW50b3Mub3JnMB4XDTE5MDYwMzE0MjAwMloXDTM4MDEwMTE0 +MjAwMlowTjEoMCYGA1UEAwwfQ2VudE9TIExpbnV4IGtwYXRjaCBzaWduaW5nIGtl +eTEiMCAGCSqGSIb3DQEJARYTc2VjdXJpdHlAY2VudG9zLm9yZzCCASIwDQYJKoZI +hvcNAQEBBQADggEPADCCAQoCggEBAMG+5OclqB0NE5azrGkSitqUFcZjpRk/rS2P +CetB6jwxOn06TrLGzqnhcE9VBKyEs7CXBLy6lfnORcYOybcR2XvrgqGa1txOZggl +hc8zCj9X7ZCMK2UsWglxQCOtbo0m/vdor/VO3SFbrf/W9+PXhvNtcxMP9yjydbP+ +lS1St8uQv952hu7C1TevyOQN3jpvWRD7DSJIU/2uRFcdIo2QCGokuB/xESXeuGJ2 +F2P9w0h74V18AlVTxtGp/RSJqZaQ2Gi5h4Oa7UsRmhmCoLdmdBe7xnYJrJ4GhxKQ +yG0kU1ikEhZW3YjoVPgBJzTsIhCAzFrOUq0d67a1wTVMiyL60fUCAwEAAaNdMFsw +DAYDVR0TAQH/BAIwADALBgNVHQ8EBAMCB4AwHQYDVR0OBBYEFLSfCGIFkJ3E2iz6 +mTdvsZHS8J54MB8GA1UdIwQYMBaAFFTsgYWJPuka2wj3RIhUfo4/dDrzMA0GCSqG +SIb3DQEBCwUAA4IBAQBcDnjWh8Mx6yaS/OvBOYZprYy5Su0tn+YHiN0czpjVw+zl +NUt2YmRSA/g6xks04CYx+UAL/xnvRcxXd17Ni7eWiROxvgQvBo5nScVkFPq2IIP5 +8aj7LoHR1MUeXfiNqf1JoSlgpRV47wv/+jZD0hmbt1rC2NJp0ZU8OHmt2GWk0jmM +MK72D/pyCUfHetBzPpU9M0cNiukjMUdIL+U7+CXDgKsfdFHcQ76ebWyka7vRSXTs +lBMa2g20Atwz2Hj7tEEAZ74ioQ9029RAlUSNipACe31YdT4/BBWIqHPpeDFkp8W0 +9v4jeTX/2kMBXkjzMfKjhpooa+bFFFLogLeX3P4W +-----END CERTIFICATE----- diff --git a/SOURCES/centossecureboot001.der b/SOURCES/centossecureboot001.der new file mode 100644 index 0000000..e8216b1 Binary files /dev/null and b/SOURCES/centossecureboot001.der differ diff --git a/SOURCES/centossecureboot201.der b/SOURCES/centossecureboot201.der new file mode 100644 index 0000000..ca3c134 Binary files /dev/null and b/SOURCES/centossecureboot201.der differ diff --git a/SOURCES/centossecurebootca2.der b/SOURCES/centossecurebootca2.der new file mode 100644 index 0000000..42bdfcf Binary files /dev/null and b/SOURCES/centossecurebootca2.der differ diff --git a/SOURCES/debrand-rh-i686-cpu.patch b/SOURCES/debrand-rh-i686-cpu.patch new file mode 100644 index 0000000..5592a59 --- /dev/null +++ b/SOURCES/debrand-rh-i686-cpu.patch @@ -0,0 +1,11 @@ +--- a/arch/x86/boot/main.c 2019-03-13 04:04:53.000000000 -0700 ++++ b/arch/x86/boot/main.c 2019-05-25 14:31:21.043272496 -0700 +@@ -147,7 +147,7 @@ void main(void) + + /* Make sure we have all the proper CPU support */ + if (validate_cpu()) { +- puts("This processor is not supported in this version of RHEL.\n"); ++ puts("This processor is not supported in this version of CentOS Linux.\n"); + die(); + } + diff --git a/SOURCES/debrand-rh_taint.patch b/SOURCES/debrand-rh_taint.patch new file mode 100644 index 0000000..74f2e15 --- /dev/null +++ b/SOURCES/debrand-rh_taint.patch @@ -0,0 +1,81 @@ +--- a/kernel/rh_taint.c 2020-10-16 10:41:51.000000000 -0500 ++++ b/kernel/rh_taint.c 2020-11-19 10:50:24.853039167 -0600 +@@ -2,12 +2,12 @@ + #include + + /* +- * The following functions are used by Red Hat to indicate to users that +- * hardware and drivers are unsupported, or have limited support in RHEL major ++ * The following functions are used by CentOS Linux to indicate to users that ++ * hardware and drivers are unsupported, or have limited support in CentOS Linux major + * and minor releases. These functions output loud warning messages to the end + * user and should be USED WITH CAUTION. + * +- * Any use of these functions _MUST_ be documented in the RHEL Release Notes, ++ * Any use of these functions _MUST_ be documented in the CentOS Linux Release Notes, + * and have approval of management. + */ + +@@ -16,15 +16,15 @@ + * @msg: Hardware name, class, or type + * + * Called to mark a device, class of devices, or types of devices as not having +- * support in any RHEL minor release. This does not TAINT the kernel. Red Hat +- * will not fix bugs against this hardware in this minor release. Red Hat may ++ * support in any CentOS Linux minor release. This does not TAINT the kernel. CentOS Linux ++ * will not fix bugs against this hardware in this minor release. CentOS Linux may + * declare support in a future major or minor update release. This cannot be + * used to mark drivers unsupported. + */ + void mark_hardware_unsupported(const char *msg) + { + /* Print one single message */ +- pr_crit("Warning: %s - this hardware has not undergone testing by Red Hat and might not be certified. Please consult https://catalog.redhat.com for certified hardware.\n", msg); ++ pr_crit("Warning: %s - this hardware has not undergone testing by CentOS Linux and might not be certified. Please consult https://catalog.redhat.com for certified hardware.\n", msg); + } + EXPORT_SYMBOL(mark_hardware_unsupported); + +@@ -35,12 +35,12 @@ EXPORT_SYMBOL(mark_hardware_unsupported) + * Called to minimize the support status of a previously supported device in + * a minor release. This does not TAINT the kernel. Marking hardware + * deprecated is usually done in conjunction with the hardware vendor. Future +- * RHEL major releases may not include this driver. Driver updates and fixes ++ * CentOS Linux major releases may not include this driver. Driver updates and fixes + * for this device will be limited to critical issues in future minor releases. + */ + void mark_hardware_deprecated(const char *msg) + { +- pr_crit("Warning: %s - this hardware is not recommended for new deployments. It continues to be supported in this RHEL release, but it is likely to be removed in the next major release. Driver updates and fixes for this device will be limited to critical issues. Please contact Red Hat Support or your device's hardware vendor for additional information.\n", msg); ++ pr_crit("Warning: %s - this hardware is not recommended for new deployments. It continues to be supported in this CentOS Linux release, but it is likely to be removed in the next major release. Driver updates and fixes for this device will be limited to critical issues. Please contact CentOS Linux Support or your device's hardware vendor for additional information.\n", msg); + } + EXPORT_SYMBOL(mark_hardware_deprecated); + +@@ -50,9 +50,9 @@ EXPORT_SYMBOL(mark_hardware_deprecated); + * + * Called to minimize the support status of a new driver. This does TAINT the + * kernel. Calling this function indicates that the driver or subsystem has +- * had limited testing and is not marked for full support within this RHEL +- * minor release. The next RHEL minor release may contain full support for +- * this driver. Red Hat does not guarantee that bugs reported against this ++ * had limited testing and is not marked for full support within this CentOS Linux ++ * minor release. The next CentOS Linux minor release may contain full support for ++ * this driver. CentOS Linux does not guarantee that bugs reported against this + * driver or subsystem will be resolved. + */ + void mark_tech_preview(const char *msg, struct module *mod) +@@ -81,13 +81,13 @@ EXPORT_SYMBOL(mark_tech_preview); + * mark_driver_unsupported - drivers that we know we don't want to support + * @name: the name of the driver + * +- * In some cases Red Hat has chosen to build a driver for internal QE ++ * In some cases CentOS Linux has chosen to build a driver for internal QE + * use. Use this function to mark those drivers as unsupported for + * customers. + */ + void mark_driver_unsupported(const char *name) + { +- pr_crit("Warning: %s - This driver has not undergone sufficient testing by Red Hat for this release and therefore cannot be used in production systems.\n", ++ pr_crit("Warning: %s - This driver has not undergone sufficient testing by CentOS Linux for this release and therefore cannot be used in production systems.\n", + name ? name : "kernel"); + } + EXPORT_SYMBOL(mark_driver_unsupported); diff --git a/SOURCES/debrand-single-cpu.patch b/SOURCES/debrand-single-cpu.patch new file mode 100644 index 0000000..b3eed51 --- /dev/null +++ b/SOURCES/debrand-single-cpu.patch @@ -0,0 +1,11 @@ +--- a/arch/x86/kernel/setup.c 2019-03-13 04:04:53.000000000 -0700 ++++ b/arch/x86/kernel/setup.c 2019-05-27 08:35:54.580595314 -0700 +@@ -900,7 +900,7 @@ static void rh_check_supported(void) + if (((boot_cpu_data.x86_max_cores * smp_num_siblings) == 1) && + !guest && is_kdump_kernel()) { + pr_crit("Detected single cpu native boot.\n"); +- pr_crit("Important: In Red Hat Enterprise Linux 8, single threaded, single CPU 64-bit physical systems are unsupported by Red Hat. Please contact your Red Hat support representative for a list of certified and supported systems."); ++ pr_crit("Important: In CentOS Linux 8, single threaded, single CPU 64-bit physical systems are unsupported. Please see http://wiki.centos.org/FAQ for more information"); + } + + /* diff --git a/SOURCES/x509.genkey b/SOURCES/x509.genkey index b1bbe38..dbfe9a7 100644 --- a/SOURCES/x509.genkey +++ b/SOURCES/x509.genkey @@ -5,9 +5,9 @@ prompt = no x509_extensions = myexts [ req_distinguished_name ] -O = Red Hat -CN = Red Hat Enterprise Linux kernel signing key -emailAddress = secalert@redhat.com +O = CentOS +CN = CentOS kernel signing key +emailAddress = security@centos.org [ myexts ] basicConstraints=critical,CA:FALSE diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec index 9469533..295f138 100644 --- a/SPECS/kernel.spec +++ b/SPECS/kernel.spec @@ -19,7 +19,7 @@ %global distro_build 305 # Sign the x86_64 kernel for secure boot authentication -%ifarch x86_64 aarch64 s390x ppc64le +%ifarch x86_64 aarch64 %global signkernel 1 %else %global signkernel 0 @@ -445,44 +445,34 @@ Source9: x509.genkey %if %{?released_kernel} -Source10: redhatsecurebootca5.cer -Source11: redhatsecurebootca3.cer -Source12: redhatsecureboot501.cer -Source13: redhatsecureboot301.cer -Source14: secureboot_s390.cer -Source15: secureboot_ppc.cer +Source10: centossecurebootca2.der +Source11: centos-ca-secureboot.der +Source12: centossecureboot201.der +Source13: centossecureboot001.der %define secureboot_ca_0 %{SOURCE11} %define secureboot_ca_1 %{SOURCE10} %ifarch x86_64 aarch64 %define secureboot_key_0 %{SOURCE13} -%define pesign_name_0 redhatsecureboot301 +%define pesign_name_0 centossecureboot001 %define secureboot_key_1 %{SOURCE12} -%define pesign_name_1 redhatsecureboot501 -%endif -%ifarch s390x -%define secureboot_key_0 %{SOURCE14} -%define pesign_name_0 redhatsecureboot302 -%endif -%ifarch ppc64le -%define secureboot_key_0 %{SOURCE15} -%define pesign_name_0 redhatsecureboot303 +%define pesign_name_1 centossecureboot201 %endif # released_kernel %else -Source11: redhatsecurebootca4.cer -Source12: redhatsecurebootca2.cer -Source13: redhatsecureboot401.cer -Source14: redhatsecureboot003.cer +Source11: centossecurebootca2.der +Source12: centos-ca-secureboot.der +Source13: centossecureboot201.der +Source14: centossecureboot001.der %define secureboot_ca_0 %{SOURCE12} %define secureboot_ca_1 %{SOURCE11} %define secureboot_key_0 %{SOURCE14} -%define pesign_name_0 redhatsecureboot003 +%define pesign_name_0 centossecureboot001 %define secureboot_key_1 %{SOURCE13} -%define pesign_name_1 redhatsecureboot401 +%define pesign_name_1 centossecureboot201 # released_kernel %endif @@ -514,8 +504,8 @@ Source43: generate_bls_conf.sh Source44: mod-internal.list -Source100: rheldup3.x509 -Source101: rhelkpatch1.x509 +Source100: centos-dup.x509 +Source101: centos-kpatch.x509 %if %{with_kabichk} Source200: check-kabi @@ -543,7 +533,12 @@ Source2000: cpupower.service Source2001: cpupower.config Source2002: kvm_stat.logrotate +Source9000: centos.pem + ## Patches needed for building this package +Patch1000: debrand-single-cpu.patch +Patch1001: debrand-rh_taint.patch +Patch1002: debrand-rh-i686-cpu.patch # empty final patch to facilitate testing of kernel patches Patch999999: linux-kernel-test.patch @@ -553,8 +548,8 @@ Patch999999: linux-kernel-test.patch BuildRoot: %{_tmppath}/%{name}-%{KVERREL}-root %description -This is the package which provides the Linux %{name} for Red Hat Enterprise -Linux. It is based on upstream Linux at version %{version} and maintains kABI +This is the package which provides the Linux %{name} for CentOS. +It is based on upstream Linux at version %{version} and maintains kABI compatibility of a set of approved symbols, however it is heavily modified with backports and fixes pulled from newer upstream Linux %{name} releases. This means this is not a %{version} kernel anymore: it includes several components which come @@ -562,7 +557,7 @@ from newer upstream linux versions, while maintaining a well tested and stable core. Some of the components/backports that may be pulled in are: changes like updates to the core kernel (eg.: scheduler, cgroups, memory management, security fixes and features), updates to block layer, supported filesystems, major driver -updates for supported hardware in Red Hat Enterprise Linux, enhancements for +updates for supported hardware in CentOS, enhancements for enterprise customers, etc. # @@ -803,14 +798,14 @@ kernel-gcov includes the gcov graph and source files for gcov coverage collectio %endif %package -n %{name}-abi-stablelists -Summary: The Red Hat Enterprise Linux kernel ABI symbol stablelists +Summary: The CentOS kernel ABI symbol stablelists Group: System Environment/Kernel AutoReqProv: no Obsoletes: %{name}-abi-whitelists < %{rpmversion}-%{pkg_release} Provides: %{name}-abi-whitelists %description -n %{name}-abi-stablelists -The kABI package contains information pertaining to the Red Hat Enterprise -Linux kernel ABI, including lists of kernel symbols that are needed by +The kABI package contains information pertaining to the CentOS +kernel ABI, including lists of kernel symbols that are needed by external Linux kernel modules, and a yum plugin to aid enforcement. %if %{with_kabidw_base} @@ -819,8 +814,8 @@ Summary: The baseline dataset for kABI verification using DWARF data Group: System Environment/Kernel AutoReqProv: no %description kernel-kabidw-base-internal -The package contains data describing the current ABI of the Red Hat Enterprise -Linux kernel, suitable for the kabi-dw tool. +The package contains data describing the current ABI of the CentOS +kernel, suitable for the kabi-dw tool. %endif # @@ -892,7 +887,7 @@ Requires: %{name}%{?1:-%{1}}-modules-uname-r = %{KVERREL}%{?variant}%{?1:+%{1}}\ AutoReq: no\ AutoProv: yes\ %description %{?1:%{1}-}modules-internal\ -This package provides kernel modules for the %{?2:%{2} }kernel package for Red Hat internal usage.\ +This package provides kernel modules for the %{?2:%{2} }kernel package for CentOS internal usage.\ %{nil} # @@ -1090,10 +1085,14 @@ ApplyOptionalPatch() } %setup -q -n %{name}-%{rpmversion}-%{pkgrelease} -c +cp -v %{SOURCE9000} linux-%{rpmversion}-%{pkgrelease}/certs/rhel.pem mv linux-%{rpmversion}-%{pkgrelease} linux-%{KVERREL} cd linux-%{KVERREL} +ApplyOptionalPatch debrand-single-cpu.patch +ApplyOptionalPatch debrand-rh_taint.patch +ApplyOptionalPatch debrand-rh-i686-cpu.patch ApplyOptionalPatch linux-kernel-test.patch # END OF PATCH APPLICATIONS