A recent change to the EFI lockdown patch forces IMA policy to be loaded
when secureboot is used. Unfortunately, we don't have all the pieces in
place to have all components fully signed. Disable appraisal for now
until that gets fixed.
A couple of CONFIG file names were misnamed during their creation.
Fix them up.
configs/fedora/generic/CONFIG_DEBUG_VM_RB revisit this if performance isn't horrible -> configs/fedora/generic/CONFIG_DEBUG_VM_RB
and
configs/fedora/generic/CONFIG_DPM_WATCHDOG revisit this in debug -> configs/fedora/generic/CONFIG_DPM_WATCHDOG
The previous patch moved the configs/base-{generic,debug} to configs/fedora.
Now we update the scripts to reflect that change. Changing the scripts
was straightforward. Handling overrides that didn't use generic names
was a little trickier.
To handle random override names (well rhel), I added some extra logic
in the config_generation script called "ORDER". This tells the scripts
which configs to lay down first and which one overrides it.
Through some testing, I realized I could simplify things and just create
an outer 'order' loop. This removed some duplicated code.
The other change is the 'skip_if_missing' flag. The overrides directory
will not mimic the baseline directory layout 100%. Ensure the baseline
config files are all there, but allow the overrides to have missing files.
Tested on my Fedora and my RHEL tree with success.
It was suggested that base-debug and base-generic were not good names
to use. Further discussion led to using configs/fedora for the base
config files and configs/rhel for any overrides.
This patch does a plain
mkdir configs/fedora
git mv configs/base-{generic,debug} configs/fedora
No code changes.
