Thomas Renninger
9f28177407
- Update to dracut mainline version 041. Half of the patches got integrated mainline. Some others have been merged together when it made sense some have been left out, but are still in the repository as they need some special treating and mainline discussion whether/how they get added. These are also not urgently needed, but are debugging patches. I broke the rule here to mention every added/deleted/modified patch as every patch is touched and every 2nd got removed (mainline integrated). I also re-ordered the patches in the PatchXY: area for easier merging them and get them discussed and posted mainline easier, topic by topic. OBS-URL: https://build.opensuse.org/request/show/293267 OBS-URL: https://build.opensuse.org/package/show/Base:System/dracut?expand=0&rev=214
126 lines
4.8 KiB
Diff
126 lines
4.8 KiB
Diff
From dccbc0fc7f1b814ad8a03f380a31bed2c9d86a9b Mon Sep 17 00:00:00 2001
|
|
From: Thomas Renninger <trenn@suse.de>
|
|
Date: Tue, 1 Jul 2014 13:53:43 +0200
|
|
Subject: dracut: caps: Remove whole caps module
|
|
|
|
To get installed it must not have systemd included in initramfs which is
|
|
an unsupported scenario for SUSE.
|
|
This gets also rid of the error in its check function.
|
|
|
|
Signed-off-by: Thomas Renninger <trenn@suse.de>
|
|
---
|
|
modules.d/02caps/README | 33 ---------------------------------
|
|
modules.d/02caps/caps.sh | 36 ------------------------------------
|
|
modules.d/02caps/module-setup.sh | 26 --------------------------
|
|
3 files changed, 95 deletions(-)
|
|
delete mode 100644 modules.d/02caps/README
|
|
delete mode 100755 modules.d/02caps/caps.sh
|
|
delete mode 100755 modules.d/02caps/module-setup.sh
|
|
|
|
Index: dracut-041/modules.d/02caps/README
|
|
===================================================================
|
|
--- dracut-041.orig/modules.d/02caps/README 2015-01-31 12:54:52.000000000 +0100
|
|
+++ /dev/null 1970-01-01 00:00:00.000000000 +0000
|
|
@@ -1,33 +0,0 @@
|
|
-This adds the following parameters:
|
|
-rd.caps=1
|
|
- turn the caps module on/off
|
|
-rd.caps.initdrop=cap_sys_module,cap_sys_rawio
|
|
- drop the specified comma separated capabilities
|
|
-rd.caps.disablemodules=1
|
|
- turn off module loading
|
|
-rd.caps.disablekexec=1
|
|
- turn off the kexec functionality
|
|
-
|
|
-If module loading is turned off, all modules have to be loaded in the
|
|
-initramfs, which are used later on. This can be done with
|
|
-"rd.driver.pre="
|
|
-rd.driver.pre=autofs4,sunrpc,ipt_REJECT,nf_conntrack_ipv4,....
|
|
-
|
|
-Because the kernel command line would get huge with all those drivers, I
|
|
-recommend to make use of $initramfs/etc/cmdline.
|
|
-
|
|
-So, all rd.caps.* and rd.driver.pre arguments are in caps.conf can be
|
|
-copied to $initramfs/etc/cmdline with "-i caps.conf /etc/cmdline".
|
|
-
|
|
-Also all modules have to be loaded in the initramfs via "--add-drivers".
|
|
-
|
|
-The resulting initramfs creation would look like this:
|
|
-
|
|
- --add-drivers "autofs4 sunrpc ipt_REJECT nf_conntrack_ipv4 \
|
|
- nf_defrag_ipv4 iptable_filter ip_tables
|
|
- ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack
|
|
- ip6table_filter ip6_tables dm_mirror dm_region_hash dm_log uinput ppdev
|
|
- parport_pc parport ipv6 sg 8139too 8139cp mii i2c_piix4 i2c_core ext3
|
|
- jbd mbcache sd_mod crc_t10dif sr_mod cdrom ata_generic pata_acpi ata_piix
|
|
- dm_mod" \
|
|
- /boot/initramfs-caps.img
|
|
Index: dracut-041/modules.d/02caps/caps.sh
|
|
===================================================================
|
|
--- dracut-041.orig/modules.d/02caps/caps.sh 2015-03-17 13:30:53.230199929 +0100
|
|
+++ /dev/null 1970-01-01 00:00:00.000000000 +0000
|
|
@@ -1,34 +0,0 @@
|
|
-#!/bin/bash
|
|
-
|
|
-capsmode=$(getarg rd.caps)
|
|
-
|
|
-if [ "$capsmode" = "1" ]; then
|
|
- CAPS_INIT_DROP=$(getarg rd.caps.initdrop=)
|
|
- CAPS_USERMODEHELPER_BSET=$(capsh --drop="$CAPS_INIT_DROP" -- -c 'while read a b ; do [ "$a" = "CapBnd:" ] && echo $((0x${b:$((${#b}-8)):8})) $((0x${b:$((${#b}-16)):8})) && break; done < /proc/self/status')
|
|
- CAPS_MODULES_DISABLED=$(getarg rd.caps.disablemodules=)
|
|
- CAPS_KEXEC_DISABLED=$(getarg rd.caps.disablekexec=)
|
|
-
|
|
- info "Loading CAPS_MODULES $CAPS_MODULES"
|
|
- for i in $CAPS_MODULES;do modprobe $i 2>&1 >/dev/null | vinfo; done
|
|
-
|
|
- if [ "$CAPS_MODULES_DISABLED" = "1" -a -e /proc/sys/kernel/modules_disabled ]; then
|
|
- info "Disabling module loading."
|
|
- echo $CAPS_MODULES_DISABLED > /proc/sys/kernel/modules_disabled
|
|
- fi
|
|
-
|
|
- if [ "$CAPS_KEXEC_DISABLED" = "1" -a -e /proc/sys/kernel/kexec_disabled ]; then
|
|
- info "Disabling kexec."
|
|
- echo $CAPS_KEXEC_DISABLED > /proc/sys/kernel/kexec_disabled
|
|
- fi
|
|
-
|
|
- info "CAPS_USERMODEHELPER_BSET=$CAPS_USERMODEHELPER_BSET"
|
|
- if [ -e /proc/sys/kernel/usermodehelper/bset ]; then
|
|
- info "Setting usermode helper bounding set."
|
|
- echo $CAPS_USERMODEHELPER_BSET > /proc/sys/kernel/usermodehelper/bset
|
|
- echo $CAPS_USERMODEHELPER_BSET > /proc/sys/kernel/usermodehelper/inheritable
|
|
- fi
|
|
-
|
|
- echo "CAPS_INIT_DROP=\"$CAPS_INIT_DROP\"" > /etc/capsdrop
|
|
- info "Will drop capabilities $CAPS_INIT_DROP from init."
|
|
-fi
|
|
-
|
|
Index: dracut-041/modules.d/02caps/module-setup.sh
|
|
===================================================================
|
|
--- dracut-041.orig/modules.d/02caps/module-setup.sh 2015-03-17 13:30:53.238200386 +0100
|
|
+++ /dev/null 1970-01-01 00:00:00.000000000 +0000
|
|
@@ -1,24 +0,0 @@
|
|
-#!/bin/bash
|
|
-
|
|
-# called by dracut
|
|
-check() {
|
|
- require_binaries capsh
|
|
-}
|
|
-
|
|
-# called by dracut
|
|
-depends() {
|
|
- return 0
|
|
-}
|
|
-
|
|
-# called by dracut
|
|
-install() {
|
|
- if ! dracut_module_included "systemd"; then
|
|
- inst_hook pre-pivot 00 "$moddir/caps.sh"
|
|
- inst $(type -P capsh 2>/dev/null) /usr/sbin/capsh
|
|
- # capsh wants bash and we need bash also
|
|
- inst /bin/bash
|
|
- else
|
|
- dwarning "caps: does not work with systemd in the initramfs"
|
|
- fi
|
|
-}
|
|
-
|