Blame SOURCES/mod-denylist.sh

e8eba4
#! /bin/bash
e8eba4
# shellcheck disable=SC2164
e8eba4
e8eba4
RpmDir=$1
e8eba4
ModDir=$2
e8eba4
Dir="$1/$2"
e8eba4
# Note the list filename must have the format mod-[PACKAGE].list, for example,
e8eba4
# mod-internal.list or mod-extra.list.  The PACKAGE is used to create a
e8eba4
# override directory for the modules.
e8eba4
List=$3
e8eba4
Dest="$4"
e8eba4
e8eba4
blacklist()
e8eba4
{
e8eba4
	cat > "$RpmDir/etc/modprobe.d/$1-blacklist.conf" <<-__EOF__
e8eba4
	# This kernel module can be automatically loaded by non-root users. To
e8eba4
	# enhance system security, the module is blacklisted by default to ensure
e8eba4
	# system administrators make the module available for use as needed.
e8eba4
	# See https://access.redhat.com/articles/3760101 for more details.
e8eba4
	#
e8eba4
	# Remove the blacklist by adding a comment # at the start of the line.
e8eba4
	blacklist $1
e8eba4
__EOF__
e8eba4
}
e8eba4
e8eba4
check_blacklist()
e8eba4
{
e8eba4
	mod=$(find "$RpmDir/$ModDir" -name "$1")
e8eba4
	[ ! "$mod" ] && return 0
e8eba4
	if modinfo "$mod" | grep -q '^alias:\s\+net-'; then
e8eba4
		mod="${1##*/}"
e8eba4
		mod="${mod%.ko*}"
e8eba4
		echo "$mod has an alias that allows auto-loading. Blacklisting."
e8eba4
		blacklist "$mod"
e8eba4
	fi
e8eba4
}
e8eba4
e8eba4
find_depends()
e8eba4
{
e8eba4
	dep=$1
e8eba4
	depends=$(modinfo "$dep" | sed -n -e "/^depends/ s/^depends:[ \t]*//p")
e8eba4
	[ -z "$depends" ] && exit
e8eba4
	for mod in ${depends//,/ }
e8eba4
	do
e8eba4
		match=$(grep "^$mod.ko" "$ListName")
e8eba4
		[ -z "$match" ] && continue
e8eba4
		# check if the module we are looking at is in mod-* too.
e8eba4
		# if so we do not need to mark the dep as required.
e8eba4
		mod2=${dep##*/}  # same as $(basename $dep), but faster
e8eba4
		match2=$(grep "^$mod2" "$ListName")
e8eba4
		if [ -n "$match2" ]
e8eba4
		then
e8eba4
			#echo $mod2 >> notreq.list
e8eba4
			continue
e8eba4
		fi
e8eba4
		echo "$mod".ko >> req.list
e8eba4
	done
e8eba4
}
e8eba4
e8eba4
foreachp()
e8eba4
{
e8eba4
	P=$(nproc)
e8eba4
	bgcount=0
e8eba4
	while read -r mod; do
e8eba4
		$1 "$mod" &
e8eba4
e8eba4
		bgcount=$((bgcount + 1))
e8eba4
		if [ $bgcount -eq "$P" ]; then
e8eba4
			wait -n
e8eba4
			bgcount=$((bgcount - 1))
e8eba4
		fi
e8eba4
	done
e8eba4
e8eba4
	wait
e8eba4
}
e8eba4
e8eba4
# Destination was specified on the command line
e8eba4
test -n "$4" && echo "$0: Override Destination $Dest has been specified."
e8eba4
e8eba4
pushd "$Dir"
e8eba4
e8eba4
OverrideDir=$(basename "$List")
e8eba4
OverrideDir=${OverrideDir%.*}
e8eba4
OverrideDir=${OverrideDir#*-}
e8eba4
mkdir -p "$OverrideDir"
e8eba4
e8eba4
rm -rf modnames
e8eba4
find . -name "*.ko" -type f > modnames
e8eba4
# Look through all of the modules, and throw any that have a dependency in
e8eba4
# our list into the list as well.
e8eba4
rm -rf dep.list dep2.list
e8eba4
rm -rf req.list req2.list
e8eba4
touch dep.list req.list
e8eba4
cp "$List" .
e8eba4
e8eba4
# This variable needs to be exported because it is used in sub-script
e8eba4
# executed by xargs
e8eba4
ListName=$(basename "$List")
e8eba4
export ListName
e8eba4
e8eba4
foreachp find_depends < modnames
e8eba4
e8eba4
sort -u req.list > req2.list
e8eba4
sort -u "$ListName" > modules2.list
e8eba4
join -v 1 modules2.list req2.list > modules3.list
e8eba4
e8eba4
while IFS= read -r mod
e8eba4
do
e8eba4
    # get the path for the module
e8eba4
    modpath=$(grep /"$mod" modnames)
e8eba4
    [ -z "$modpath" ] && continue
e8eba4
    echo "$modpath" >> dep.list
e8eba4
done < modules3.list
e8eba4
e8eba4
sort -u dep.list > dep2.list
e8eba4
e8eba4
if [ -n "$Dest" ]; then
e8eba4
    # now move the modules into the $Dest directory
e8eba4
    while IFS= read -r mod
e8eba4
    do
e8eba4
	newpath=$(dirname "$mod" | sed -e "s/kernel\\//$Dest\//")
e8eba4
	mkdir -p "$newpath"
e8eba4
	mv "$mod" "$newpath"
e8eba4
	echo "$mod" | sed -e "s/kernel\\//$Dest\//" | sed -e "s|^.|${ModDir}|g" >> "$RpmDir"/"$ListName"
e8eba4
    done < dep2.list
e8eba4
fi
e8eba4
e8eba4
popd
e8eba4
e8eba4
# If we're signing modules, we can't leave the .mod files for the .ko files
e8eba4
# we've moved in .tmp_versions/.  Remove them so the Kbuild 'modules_sign'
e8eba4
# target doesn't try to sign a non-existent file.  This is kinda ugly, but
e8eba4
# so are the modules-* packages.
e8eba4
e8eba4
while IFS= read -r mod
e8eba4
do
e8eba4
  modfile=$(basename "$mod" | sed -e 's/.ko/.mod/')
e8eba4
  rm .tmp_versions/"$modfile"
e8eba4
done < "$Dir"/dep2.list
e8eba4
e8eba4
if [ -z "$Dest" ]; then
e8eba4
	sed -e "s|^.|${ModDir}|g" "$Dir"/dep2.list > "$RpmDir/$ListName"
e8eba4
	echo "./$RpmDir/$ListName created."
e8eba4
	[ -d "$RpmDir/etc/modprobe.d/" ] || mkdir -p "$RpmDir/etc/modprobe.d/"
e8eba4
	foreachp check_blacklist < "$List"
e8eba4
fi
e8eba4
e8eba4
# Many BIOS-es export a PNP-id which causes the floppy driver to autoload
e8eba4
# even though most modern systems don't have a 3.5" floppy driver anymore
e8eba4
# this replaces the old die_floppy_die.patch which removed the PNP-id from
e8eba4
# the module
e8eba4
e8eba4
floppylist=("$RpmDir"/"$ModDir"/kernel/drivers/block/floppy.ko*)
e8eba4
if [[ -n ${floppylist[0]} && -f ${floppylist[0]} ]]; then
e8eba4
     blacklist "floppy"
e8eba4
fi
e8eba4
e8eba4
# avoid an empty kernel-extra package
e8eba4
echo "$ModDir/$OverrideDir" >> "$RpmDir/$ListName"
e8eba4
e8eba4
pushd "$Dir"
e8eba4
rm modnames dep.list dep2.list req.list req2.list
e8eba4
rm "$ListName" modules2.list modules3.list
e8eba4
popd