- build daemons hardened (#881250)
- zipl: Use "possible_cpus" kernel parameter (#1016180)
This commit is contained in:
Dan Horák
parent
d93a0307e6
commit
b8434861eb
|
|
@ -1,7 +1,7 @@
|
|||
From 9b225fac81186176075f673dfe5cf8e373b2068a Mon Sep 17 00:00:00 2001
|
||||
From: Dan Horak <dan@danny.cz>
|
||||
Date: Sun, 20 Jul 2008 09:24:05 +0200
|
||||
Subject: [PATCH 1/4] s390-tools-1.5.3-zipl-zfcpdump-2
|
||||
Subject: [PATCH 1/5] s390-tools-1.5.3-zipl-zfcpdump-2
|
||||
|
||||
---
|
||||
common.mak | 4 ++--
|
||||
|
|
@ -29,7 +29,7 @@ index 44adc6e..4373da5 100644
|
|||
From a3d9221076f9eb7cc8434baac71327f786351c63 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Dan=20Hor=C3=A1k?= <dan@danny.cz>
|
||||
Date: Thu, 23 Apr 2009 11:46:01 +0200
|
||||
Subject: [PATCH 2/4] s390-tools-1.8.1-fdasd-su
|
||||
Subject: [PATCH 2/5] s390-tools-1.8.1-fdasd-su
|
||||
|
||||
---
|
||||
fdasd/fdasd.c | 10 ++++++----
|
||||
|
|
@ -63,7 +63,7 @@ index ba22475..f2ac417 100644
|
|||
From d13c754f68ea838a47b8125006b9b493cfbbb7f4 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Dan=20Hor=C3=A1k?= <dan@danny.cz>
|
||||
Date: Wed, 21 Aug 2013 12:13:30 +0200
|
||||
Subject: [PATCH 3/4] dbginfo.sh: Avoiding exclusion list for pipes in sysfs
|
||||
Subject: [PATCH 3/5] dbginfo.sh: Avoiding exclusion list for pipes in sysfs
|
||||
|
||||
Description: dbginfo.sh: Avoiding exclusion list for pipes in sysfs
|
||||
Symptom: The dbginfo.sh script hangs
|
||||
|
|
@ -133,7 +133,7 @@ index 6d07132..0ada40b 100755
|
|||
From 7d540e7f40c731092ac655d1d38af7d69ceee706 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Dan=20Hor=C3=A1k?= <dan@danny.cz>
|
||||
Date: Wed, 21 Aug 2013 12:13:58 +0200
|
||||
Subject: [PATCH 4/4] zipl: Fix zipl "--force" option for DASD multi-volume
|
||||
Subject: [PATCH 4/5] zipl: Fix zipl "--force" option for DASD multi-volume
|
||||
dump
|
||||
|
||||
Description: zipl: Fix zipl "--force" option for DASD multi-volume dump
|
||||
|
|
@ -180,3 +180,43 @@ index f1cec78..529d6b3 100644
|
|||
--
|
||||
1.8.1.4
|
||||
|
||||
|
||||
From 21caf0d0dc05c5e950f369f72027a203a7d3e772 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Dan=20Hor=C3=A1k?= <dan@danny.cz>
|
||||
Date: Tue, 5 Nov 2013 12:23:18 +0100
|
||||
Subject: [PATCH 5/5] zipl: Use "possible_cpus" kernel parameter
|
||||
|
||||
Description: zipl: Use "possible_cpus" kernel parameter
|
||||
Symptom: The zfcpdump system might run out-of memory.
|
||||
Problem: For each possible CPU the zfcpdump kernel consumes memory for
|
||||
the per-CPU data structures. Since it only runs with one CPU
|
||||
this is not necessary. Because only 32 MiB are available for
|
||||
zfcpdump the per-CPU data should not be allocated.
|
||||
Solution: Use the kernel parameter "possible_cpus=1".
|
||||
Reproduction: To verify that the fix is included check that the zipl -D output
|
||||
line "kernel parmline" contains "possible_cpus=1".
|
||||
---
|
||||
zipl/src/bootmap.c | 5 +++--
|
||||
1 file changed, 3 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/zipl/src/bootmap.c b/zipl/src/bootmap.c
|
||||
index cc2ed16..68dffe1 100644
|
||||
--- a/zipl/src/bootmap.c
|
||||
+++ b/zipl/src/bootmap.c
|
||||
@@ -603,10 +603,11 @@ create_dump_fs_parmline(const char* parmline, const char* root_dev,
|
||||
if (!result)
|
||||
return NULL;
|
||||
snprintf(result, DUMP_PARAM_MAX_LEN, "%s%sroot=%s dump_part=%d "
|
||||
- "dump_mem=%lld maxcpus=%d cgroup_disable=memory",
|
||||
+ "dump_mem=%lld maxcpus=%d possible_cpus=%d "
|
||||
+ "cgroup_disable=memory",
|
||||
parmline ? parmline : "",
|
||||
parmline ? " " : "", root_dev, part_num,
|
||||
- (unsigned long long) mem, max_cpus);
|
||||
+ (unsigned long long) mem, max_cpus, max_cpus);
|
||||
result[DUMP_PARAM_MAX_LEN - 1] = 0;
|
||||
return result;
|
||||
}
|
||||
--
|
||||
1.8.1.4
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,75 @@
|
|||
From a1d489d42248acd0b5f2e3348df5f2ece22dc9e0 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Dan=20Hor=C3=A1k?= <dan@danny.cz>
|
||||
Date: Tue, 5 Nov 2013 15:34:11 +0100
|
||||
Subject: [PATCH] build daemons hardened
|
||||
|
||||
---
|
||||
common.mak | 3 +++
|
||||
cpuplugd/Makefile | 4 ++--
|
||||
mon_tools/Makefile | 2 ++
|
||||
osasnmpd/Makefile.rules | 3 +++
|
||||
4 files changed, 10 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/common.mak b/common.mak
|
||||
index 4373da5..7b992b4 100644
|
||||
--- a/common.mak
|
||||
+++ b/common.mak
|
||||
@@ -76,6 +76,9 @@ CXXFLAGS = $(WARNFLAGS) -O3 -DS390_TOOLS_RELEASE=$(S390_TOOLS_RELEASE) \
|
||||
-DS390_TOOLS_SYSCONFDIR=$(SYSCONFDIR) \
|
||||
-g $(OPT_FLAGS)
|
||||
|
||||
+DAEMON_CFLAGS = -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1
|
||||
+DAEMON_LDFLAGS = -specs=/usr/lib/rpm/redhat/redhat-hardened-ld
|
||||
+
|
||||
# make G=1
|
||||
# Compile tools so that gcov can be used to collect code coverage data.
|
||||
# See the gcov man page for details.
|
||||
diff --git a/cpuplugd/Makefile b/cpuplugd/Makefile
|
||||
index 4a72075..28480f5 100644
|
||||
--- a/cpuplugd/Makefile
|
||||
+++ b/cpuplugd/Makefile
|
||||
@@ -1,6 +1,6 @@
|
||||
include ../common.mak
|
||||
|
||||
-CFLAGS += -I../include
|
||||
+CFLAGS += $(DAEMON_CFLAGS) -I../include
|
||||
|
||||
all: cpuplugd
|
||||
|
||||
@@ -10,7 +10,7 @@ OBJECTS = daemon.o cpu.o info.o terms.o config.o main.o getopt.o mem.o
|
||||
$(OBJECTS): cpuplugd.h
|
||||
|
||||
cpuplugd: $(OBJECTS)
|
||||
- $(LINK) $(LDFLAGS) $^ $(LOADLIBES) $(LDLIBS) -o $@
|
||||
+ $(LINK) $(DAEMON_LDFLAGS) $(LDFLAGS) $^ $(LOADLIBES) $(LDLIBS) -o $@
|
||||
|
||||
clean:
|
||||
rm -f cpuplugd $(OBJECTS)
|
||||
diff --git a/mon_tools/Makefile b/mon_tools/Makefile
|
||||
index c8c58fc..b025f65 100644
|
||||
--- a/mon_tools/Makefile
|
||||
+++ b/mon_tools/Makefile
|
||||
@@ -1,6 +1,8 @@
|
||||
include ../common.mak
|
||||
|
||||
CPPFLAGS += -I../include
|
||||
+CFLAGS += $(DAEMON_CFLAGS)
|
||||
+LDFLAGS += $(DAEMON_LDFLAGS)
|
||||
|
||||
all: mon_fsstatd mon_procd
|
||||
|
||||
diff --git a/osasnmpd/Makefile.rules b/osasnmpd/Makefile.rules
|
||||
index 6668ed6..11ee8eb 100644
|
||||
--- a/osasnmpd/Makefile.rules
|
||||
+++ b/osasnmpd/Makefile.rules
|
||||
@@ -10,4 +10,7 @@ CPPFLAGS += -DNETSNMP5
|
||||
endif
|
||||
CPPFLAGS += -I../include
|
||||
|
||||
+CFLAGS += $(DAEMON_CFLAGS)
|
||||
+LDFLAGS += $(DAEMON_LDFLAGS)
|
||||
+
|
||||
OBJS = ibmOSAMib.o ibmOSAMibUtil.o osasnmpd.o
|
||||
--
|
||||
1.8.1.4
|
||||
|
||||
|
|
@ -1,13 +1,11 @@
|
|||
%define cmsfsver 1.1.8c
|
||||
%define vipaver 2.0.4
|
||||
|
||||
%{!?_initddir: %define _initddir %{_initrddir}}
|
||||
|
||||
Name: s390utils
|
||||
Summary: Utilities and daemons for IBM System/z
|
||||
Group: System Environment/Base
|
||||
Version: 1.23.0
|
||||
Release: 3%{?dist}
|
||||
Release: 4%{?dist}
|
||||
Epoch: 2
|
||||
License: GPLv2 and GPLv2+ and CPL
|
||||
ExclusiveArch: s390 s390x
|
||||
|
|
@ -36,6 +34,7 @@ Source19: mon_statd.initd
|
|||
Source21: normalize_dasd_arg
|
||||
|
||||
Patch1: s390-tools-1.23.0-fedora.patch
|
||||
Patch2: s390-tools-1.23.0-hardening.patch
|
||||
|
||||
Patch1000: cmsfs-1.1.8-warnings.patch
|
||||
Patch1001: cmsfs-1.1.8-kernel26.patch
|
||||
|
|
@ -65,6 +64,7 @@ be used together with the zSeries (s390) Linux kernel and device drivers.
|
|||
|
||||
# Fedora/RHEL changes
|
||||
%patch1 -p1 -b .fedora
|
||||
%patch2 -p1 -b .hardening
|
||||
|
||||
#
|
||||
# cmsfs
|
||||
|
|
@ -734,6 +734,10 @@ User-space development files for the s390/s390x architecture.
|
|||
|
||||
|
||||
%changelog
|
||||
* Wed Nov 06 2013 Dan Horák <dan[at]danny.cz> - 2:1.23.0-4
|
||||
- build daemons hardened (#881250)
|
||||
- zipl: Use "possible_cpus" kernel parameter (#1016180)
|
||||
|
||||
* Wed Aug 21 2013 Dan Horák <dan[at]danny.cz> - 2:1.23.0-3
|
||||
- dbginfo.sh: Avoiding exclusion list for pipes in sysfs (#996732)
|
||||
- zipl: Fix zipl "--force" option for DASD multi-volume dump (#997361)
|
||||
|
|
|
|||
Loading…
Reference in New Issue