kernel-6.10.0-0.rc1.20240531git4a4be1ad3a6e.21

* Fri May 31 2024 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.10.0-0.rc1.4a4be1ad3a6e.21] - redhat: Build IMA CA certificate into the Fedora kernel (Coiby Xu) - Move CONFIG_RAS_FMPM to the proper location (Aristeu Rozanski) - redhat/configs: Remove CONFIG_NET_ACT_IPT (Ivan Vecera) Resolves: Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
2024-05-31 08:11:59 -05:00 · 2024-05-31 08:11:59 -05:00 · 5e6abd7f4d
commit 5e6abd7f4d
parent d02b6d2d40
31 changed files with 39 additions and 37 deletions
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@ -12,7 +12,7 @@ RHEL_MINOR = 99
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 20
+RHEL_RELEASE = 21

 #
 # RHEL_REBASE_NUM
--- a/Patchlist.changelog
+++ b/Patchlist.changelog
@ -1,5 +1,5 @@
-https://gitlab.com/cki-project/kernel-ark/-/commit/0d1c1cce5327e44d9f59c34357278da9e95fa3cd
- 0d1c1cce5327e44d9f59c34357278da9e95fa3cd blk-throttle: Fix incorrect display of io.max
+https://gitlab.com/cki-project/kernel-ark/-/commit/c0652c0841fbc5d016a75ec3396f81584b55074b
+ c0652c0841fbc5d016a75ec3396f81584b55074b blk-throttle: Fix incorrect display of io.max

 https://gitlab.com/cki-project/kernel-ark/-/commit/6b58b8c1db5679fc8f0bba7d494431cdde1ca696
 6b58b8c1db5679fc8f0bba7d494431cdde1ca696 rh_flags: Rename rh_features to rh_flags
--- a/fedoraimaca.x509
+++ b/fedoraimaca.x509
--- a/kernel-aarch64-16k-debug-fedora.config
+++ b/kernel-aarch64-16k-debug-fedora.config
@ -4985,7 +4985,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 CONFIG_NET_ACT_GATE=m
 CONFIG_NET_ACT_IFE=m
-CONFIG_NET_ACT_IPT=m
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 CONFIG_NET_ACT_NAT=m
--- a/kernel-aarch64-16k-fedora.config
+++ b/kernel-aarch64-16k-fedora.config
@ -4959,7 +4959,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 CONFIG_NET_ACT_GATE=m
 CONFIG_NET_ACT_IFE=m
-CONFIG_NET_ACT_IPT=m
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 CONFIG_NET_ACT_NAT=m
--- a/kernel-aarch64-64k-debug-rhel.config
+++ b/kernel-aarch64-64k-debug-rhel.config
@ -4109,7 +4109,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_ACT_IFE is not set
-# CONFIG_NET_ACT_IPT is not set
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 # CONFIG_NET_ACT_NAT is not set
--- a/kernel-aarch64-64k-rhel.config
+++ b/kernel-aarch64-64k-rhel.config
@ -4088,7 +4088,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_ACT_IFE is not set
-# CONFIG_NET_ACT_IPT is not set
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 # CONFIG_NET_ACT_NAT is not set
--- a/kernel-aarch64-debug-fedora.config
+++ b/kernel-aarch64-debug-fedora.config
@ -4985,7 +4985,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 CONFIG_NET_ACT_GATE=m
 CONFIG_NET_ACT_IFE=m
-CONFIG_NET_ACT_IPT=m
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 CONFIG_NET_ACT_NAT=m
--- a/kernel-aarch64-debug-rhel.config
+++ b/kernel-aarch64-debug-rhel.config
@ -4106,7 +4106,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_ACT_IFE is not set
-# CONFIG_NET_ACT_IPT is not set
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 # CONFIG_NET_ACT_NAT is not set
--- a/kernel-aarch64-fedora.config
+++ b/kernel-aarch64-fedora.config
@ -4959,7 +4959,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 CONFIG_NET_ACT_GATE=m
 CONFIG_NET_ACT_IFE=m
-CONFIG_NET_ACT_IPT=m
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 CONFIG_NET_ACT_NAT=m
--- a/kernel-aarch64-rhel.config
+++ b/kernel-aarch64-rhel.config
@ -4085,7 +4085,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_ACT_IFE is not set
-# CONFIG_NET_ACT_IPT is not set
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 # CONFIG_NET_ACT_NAT is not set
--- a/kernel-aarch64-rt-debug-rhel.config
+++ b/kernel-aarch64-rt-debug-rhel.config
@ -4151,7 +4151,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_ACT_IFE is not set
-# CONFIG_NET_ACT_IPT is not set
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 # CONFIG_NET_ACT_NAT is not set
--- a/kernel-aarch64-rt-rhel.config
+++ b/kernel-aarch64-rt-rhel.config
@ -4130,7 +4130,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_ACT_IFE is not set
-# CONFIG_NET_ACT_IPT is not set
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 # CONFIG_NET_ACT_NAT is not set
--- a/kernel-ppc64le-debug-fedora.config
+++ b/kernel-ppc64le-debug-fedora.config
@ -4104,7 +4104,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 CONFIG_NET_ACT_GATE=m
 CONFIG_NET_ACT_IFE=m
-CONFIG_NET_ACT_IPT=m
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 CONFIG_NET_ACT_NAT=m
--- a/kernel-ppc64le-debug-rhel.config
+++ b/kernel-ppc64le-debug-rhel.config
@ -3763,7 +3763,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_ACT_IFE is not set
-# CONFIG_NET_ACT_IPT is not set
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 # CONFIG_NET_ACT_NAT is not set
--- a/kernel-ppc64le-fedora.config
+++ b/kernel-ppc64le-fedora.config
@ -4076,7 +4076,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 CONFIG_NET_ACT_GATE=m
 CONFIG_NET_ACT_IFE=m
-CONFIG_NET_ACT_IPT=m
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 CONFIG_NET_ACT_NAT=m
--- a/kernel-ppc64le-rhel.config
+++ b/kernel-ppc64le-rhel.config
@ -3743,7 +3743,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_ACT_IFE is not set
-# CONFIG_NET_ACT_IPT is not set
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 # CONFIG_NET_ACT_NAT is not set
--- a/kernel-s390x-debug-fedora.config
+++ b/kernel-s390x-debug-fedora.config
@ -4074,7 +4074,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 CONFIG_NET_ACT_GATE=m
 CONFIG_NET_ACT_IFE=m
-CONFIG_NET_ACT_IPT=m
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 CONFIG_NET_ACT_NAT=m
--- a/kernel-s390x-debug-rhel.config
+++ b/kernel-s390x-debug-rhel.config
@ -3743,7 +3743,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_ACT_IFE is not set
-# CONFIG_NET_ACT_IPT is not set
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 # CONFIG_NET_ACT_NAT is not set
--- a/kernel-s390x-fedora.config
+++ b/kernel-s390x-fedora.config
@ -4046,7 +4046,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 CONFIG_NET_ACT_GATE=m
 CONFIG_NET_ACT_IFE=m
-CONFIG_NET_ACT_IPT=m
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 CONFIG_NET_ACT_NAT=m
--- a/kernel-s390x-rhel.config
+++ b/kernel-s390x-rhel.config
@ -3723,7 +3723,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_ACT_IFE is not set
-# CONFIG_NET_ACT_IPT is not set
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 # CONFIG_NET_ACT_NAT is not set
--- a/kernel-s390x-zfcpdump-rhel.config
+++ b/kernel-s390x-zfcpdump-rhel.config
@ -3732,7 +3732,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_ACT_IFE is not set
-# CONFIG_NET_ACT_IPT is not set
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 # CONFIG_NET_ACT_NAT is not set
--- a/kernel-x86_64-debug-fedora.config
+++ b/kernel-x86_64-debug-fedora.config
@ -4496,7 +4496,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 CONFIG_NET_ACT_GATE=m
 CONFIG_NET_ACT_IFE=m
-CONFIG_NET_ACT_IPT=m
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 CONFIG_NET_ACT_NAT=m
--- a/kernel-x86_64-debug-rhel.config
+++ b/kernel-x86_64-debug-rhel.config
@ -3984,7 +3984,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_ACT_IFE is not set
-# CONFIG_NET_ACT_IPT is not set
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 # CONFIG_NET_ACT_NAT is not set
--- a/kernel-x86_64-fedora.config
+++ b/kernel-x86_64-fedora.config
@ -4470,7 +4470,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 CONFIG_NET_ACT_GATE=m
 CONFIG_NET_ACT_IFE=m
-CONFIG_NET_ACT_IPT=m
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 CONFIG_NET_ACT_NAT=m
--- a/kernel-x86_64-rhel.config
+++ b/kernel-x86_64-rhel.config
@ -3964,7 +3964,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_ACT_IFE is not set
-# CONFIG_NET_ACT_IPT is not set
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 # CONFIG_NET_ACT_NAT is not set
--- a/kernel-x86_64-rt-debug-rhel.config
+++ b/kernel-x86_64-rt-debug-rhel.config
@ -4029,7 +4029,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_ACT_IFE is not set
-# CONFIG_NET_ACT_IPT is not set
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 # CONFIG_NET_ACT_NAT is not set
--- a/kernel-x86_64-rt-rhel.config
+++ b/kernel-x86_64-rt-rhel.config
@ -4009,7 +4009,6 @@ CONFIG_NET_ACT_CT=m
 CONFIG_NET_ACT_GACT=m
 # CONFIG_NET_ACT_GATE is not set
 # CONFIG_NET_ACT_IFE is not set
-# CONFIG_NET_ACT_IPT is not set
 CONFIG_NET_ACT_MIRRED=m
 CONFIG_NET_ACT_MPLS=m
 # CONFIG_NET_ACT_NAT is not set
--- a/kernel.changelog
+++ b/kernel.changelog
@ -1,3 +1,9 @@
+* Fri May 31 2024 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.10.0-0.rc1.4a4be1ad3a6e.21]
+- redhat: Build IMA CA certificate into the Fedora kernel (Coiby Xu)
+- Move CONFIG_RAS_FMPM to the proper location (Aristeu Rozanski)
+- redhat/configs: Remove CONFIG_NET_ACT_IPT (Ivan Vecera)
+Resolves: 
+
 * Thu May 30 2024 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.10.0-0.rc1.4a4be1ad3a6e.20]
 - Linux v6.10.0-0.rc1.4a4be1ad3a6e
 Resolves: 
--- a/kernel.spec
+++ b/kernel.spec
@ -163,13 +163,13 @@ Summary: The Linux kernel
 %define specrpmversion 6.10.0
 %define specversion 6.10.0
 %define patchversion 6.10
-%define pkgrelease 0.rc1.20240530git4a4be1ad3a6e.20
+%define pkgrelease 0.rc1.20240531git4a4be1ad3a6e.21
 %define kversion 6
 %define tarfile_release 6.10-rc1-27-g4a4be1ad3a6e
 # This is needed to do merge window version magic
 %define patchlevel 10
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 0.rc1.20240530git4a4be1ad3a6e.20%{?buildid}%{?dist}
+%define specrelease 0.rc1.20240531git4a4be1ad3a6e.21%{?buildid}%{?dist}
 # This defines the kabi tarball version
 %define kabiversion 6.10.0

@ -929,6 +929,16 @@ Source102: nvidiagpuoot001.x509
 Source103: rhelimaca1.x509
 Source104: rhelima.x509
 Source105: rhelima_centos.x509
+Source106: fedoraimaca.x509
+
+%if 0%{?fedora}%{?eln}
+%define ima_ca_cert %{SOURCE106}
+%endif
+
+%if 0%{?rhel} && !0%{?eln}
+%define ima_ca_cert %{SOURCE103}
+# rhel && !eln
+%endif

 %if 0%{?centos}
 %define ima_signing_cert %{SOURCE105}
@ -1905,26 +1915,32 @@ do
 done
 %endif

+%if %{signkernel}%{signmodules}
+
 # Add DUP and kpatch certificates to system trusted keys for RHEL
 %if 0%{?rhel}
 %{log_msg "Add DUP and kpatch certificates to system trusted keys for RHEL"}
-%if %{signkernel}%{signmodules}
 openssl x509 -inform der -in %{SOURCE100} -out rheldup3.pem
 openssl x509 -inform der -in %{SOURCE101} -out rhelkpatch1.pem
 openssl x509 -inform der -in %{SOURCE102} -out nvidiagpuoot001.pem
-openssl x509 -inform der -in %{SOURCE103} -out rhelimaca1.pem
-cat rheldup3.pem rhelkpatch1.pem nvidiagpuoot001.pem rhelimaca1.pem > ../certs/rhel.pem
+cat rheldup3.pem rhelkpatch1.pem nvidiagpuoot001.pem > ../certs/rhel.pem
 %if %{signkernel}
 %ifarch s390x ppc64le
 openssl x509 -inform der -in %{secureboot_ca_0} -out secureboot.pem
 cat secureboot.pem >> ../certs/rhel.pem
 %endif
 %endif
+
+# rhel
+%endif
+
+openssl x509 -inform der -in %{ima_ca_cert} -out imaca.pem
+cat imaca.pem >> ../certs/rhel.pem
+
 for i in *.config; do
  sed -i 's@CONFIG_SYSTEM_TRUSTED_KEYS=""@CONFIG_SYSTEM_TRUSTED_KEYS="certs/rhel.pem"@' $i
 done
 %endif
-%endif

 # Adjust FIPS module name for RHEL
 %if 0%{?rhel}
@ -4001,9 +4017,14 @@ fi\
 #
 #
 %changelog
-* Thu May 30 2024 Justin M. Forbes <jforbes@fedoraproject.org> [6.10.0-0.rc1.20240530git4a4be1ad3a6e.20]
+* Fri May 31 2024 Justin M. Forbes <jforbes@fedoraproject.org> [6.10.0-0.rc1.20240531git4a4be1ad3a6e.21]
 - blk-throttle: Fix incorrect display of io.max (Waiman Long)

+* Fri May 31 2024 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.10.0-0.rc1.4a4be1ad3a6e.21]
+- redhat: Build IMA CA certificate into the Fedora kernel (Coiby Xu)
+- Move CONFIG_RAS_FMPM to the proper location (Aristeu Rozanski)
+- redhat/configs: Remove CONFIG_NET_ACT_IPT (Ivan Vecera)
+
 * Thu May 30 2024 Fedora Kernel Team <kernel-team@fedoraproject.org> [6.10.0-0.rc1.4a4be1ad3a6e.20]
 - Linux v6.10.0-0.rc1.4a4be1ad3a6e

--- a/4
+++ b/4
@ -1,5 +1,5 @@
 SHA512 (kernel-abi-stablelists-6.6.0.tar.bz2) = 4f917598056dee5e23814621ec96ff2e4a411c8c4ba9d56ecb01b23cb96431825bedbecfcbaac9338efbf5cb21694d85497fa0bf43e7c80d9cd10bc6dd144dbd
 SHA512 (kernel-kabi-dw-6.6.0.tar.bz2) = 19308cd976031d05e18ef7f5d093218acdb89446418bab0cd956ff12cf66369915b9e64bb66fa9f20939428a60e81884fec5be3529c6c7461738d6540d3cc5c6
 SHA512 (linux-6.10-rc1-27-g4a4be1ad3a6e.tar.xz) = d9209b2a1096759c6729f9f2c5e59fc70cdf69b38d52971605db0a8d050f6845191fe3e4b0d3b0e92f80fea3fd66c2f33c96a8e06b365b8b98e9fa487997cfb4
-SHA512 (kernel-abi-stablelists-6.10.0.tar.xz) = 89213b1c9fd9927314e7f32e0ae105c654e23aca5f5340202d992424118988db9e253c26bcf2d16b3a679d62544c256bc8ca2d3097e22664ffd60613994542f7
-SHA512 (kernel-kabi-dw-6.10.0.tar.xz) = 6bf116117094f897f603fbeddee735a034ec2d10a0553d8a076f86f9f97a18527838637e55767696c0d95408033df7be1765f93174debba9c75a73d307c357bd
+SHA512 (kernel-abi-stablelists-6.10.0.tar.xz) = 8a7fb2a75a41ee41a4ad3ad9cb06ffc286de8d18b620e8d6565ed0366e41fdd8afd497e7ae72e0e5117cd66bce383dbaf3849988bb7044a247056336973c249f
+SHA512 (kernel-kabi-dw-6.10.0.tar.xz) = e8c05d128de7b560a6d2cd0913668d0a979b2df2acf291015abba65c5278ac2adde95a16a5d93d28b46d1205c7bf68fd786873caf93d8e10be697eca08787606