krd/linux
1
0
Fork 0
Code Activity

sync with Debian

Browse Source
This commit is contained in:
Konstantin Demin
2025-03-27 01:51:30 +03:00
parent 06a5da3214
commit 3d597650a9
75 changed files with 405 additions and 976 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
debian/patches/features/all/db-mok-keyring/0003-MODSIGN-checking-the-blacklisted-hash-before-loading-a-kernel-module.patch vendored
View File

@@ -39,7 +39,7 @@ Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
#include <uapi/linux/module.h>
#include "internal.h"
@@ -37,13 +39,60 @@ void set_module_sig_enforced(void)
@@ -37,13 +39,60 @@
sig_enforce = true;
}
@@ -101,7 +101,7 @@ Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
int ret;
pr_devel("==>%s(,%zu)\n", __func__, modlen);
@@ -51,6 +100,7 @@ int mod_verify_sig(const void *mod, stru
@@ -51,6 +100,7 @@
if (modlen <= sizeof(ms))
return -EBADMSG;
@@ -109,7 +109,7 @@ Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms));
ret = mod_check_sig(&ms, modlen, "module");
@@ -61,10 +111,17 @@ int mod_verify_sig(const void *mod, stru
@@ -61,10 +111,17 @@
modlen -= sig_len + sizeof(ms);
info->len = modlen;

2
debian/patches/features/all/db-mok-keyring/trust-machine-keyring-by-default.patch vendored
View File

@@ -11,6 +11,8 @@ To keep backward compatibility skip this check.
security/integrity/platform_certs/machine_keyring.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c
index a401640a63cd..0627f14eacbe 100644
--- a/security/integrity/platform_certs/machine_keyring.c
+++ b/security/integrity/platform_certs/machine_keyring.c
@@ -68,10 +68,7 @@ static bool __init trust_moklist(void)

14
debian/patches/features/all/drivers-media-dvb-usb-af9005-request_firmware.patch vendored
View File

@@ -11,9 +11,11 @@ a version of the script which is directly derived from the driver.
drivers/media/dvb/dvb-usb/af9005-fe.c | 66 ++++++++++++++++++++++++++------
2 files changed, 54 insertions(+), 14 deletions(-)
--- a/drivers/media/usb/dvb-usb/Kconfig
+++ b/drivers/media/usb/dvb-usb/Kconfig
@@ -35,10 +35,10 @@ config DVB_USB_A800
Index: debian-kernel/drivers/media/usb/dvb-usb/Kconfig
===================================================================
--- debian-kernel.orig/drivers/media/usb/dvb-usb/Kconfig
+++ debian-kernel/drivers/media/usb/dvb-usb/Kconfig
@@ -260,10 +260,10 @@ config DVB_USB_OPERA1
config DVB_USB_AF9005
tristate "Afatech AF9005 DVB-T USB1.1 support"
@@ -25,8 +27,10 @@ a version of the script which is directly derived from the driver.
help
Say Y here to support the Afatech AF9005 based DVB-T USB1.1 receiver
and the TerraTec Cinergy T USB XE (Rev.1)
--- a/drivers/media/usb/dvb-usb/af9005-fe.c
+++ b/drivers/media/usb/dvb-usb/af9005-fe.c
Index: debian-kernel/drivers/media/usb/dvb-usb/af9005-fe.c
===================================================================
--- debian-kernel.orig/drivers/media/usb/dvb-usb/af9005-fe.c
+++ debian-kernel/drivers/media/usb/dvb-usb/af9005-fe.c
@@ -9,10 +9,26 @@
* see Documentation/driver-api/media/drivers/dvb-usb.rst for more information
*/

2
debian/patches/features/all/lockdown/arm64-add-kernel-config-option-to-lock-down-when.patch vendored
View File

@@ -141,7 +141,7 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c]
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -765,7 +765,8 @@ extern int efi_mem_desc_lookup(u64 phys_
@@ -764,7 +764,8 @@ extern int efi_mem_desc_lookup(u64 phys_
extern int __efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md);
extern void efi_mem_reserve(phys_addr_t addr, u64 size);
extern int efi_mem_reserve_persistent(phys_addr_t addr, u64 size);

16
debian/patches/features/all/lockdown/efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch vendored
View File

@@ -106,11 +106,11 @@ cc: linux-efi@vger.kernel.org
+}
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -876,6 +876,14 @@ static inline int efi_range_is_wc(unsign
#define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */
#define EFI_MEM_NO_SOFT_RESERVE 11 /* Is the kernel configured to ignore soft reservations? */
#define EFI_PRESERVE_BS_REGIONS 12 /* Are EFI boot-services memory segments available? */
+#define EFI_SECURE_BOOT 13 /* Are we in Secure Boot mode? */
@@ -864,6 +864,14 @@ static inline int efi_range_is_wc(unsign
#define EFI_MEM_ATTR 9 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */
#define EFI_MEM_NO_SOFT_RESERVE 10 /* Is the kernel configured to ignore soft reservations? */
#define EFI_PRESERVE_BS_REGIONS 11 /* Are EFI boot-services memory segments available? */
+#define EFI_SECURE_BOOT 12 /* Are we in Secure Boot mode? */
+
+enum efi_secureboot_mode {
+ efi_secureboot_mode_unset,
@@ -121,7 +121,7 @@ cc: linux-efi@vger.kernel.org
#ifdef CONFIG_EFI
/*
@@ -900,6 +908,7 @@ static inline bool efi_rt_services_suppo
@@ -888,6 +896,7 @@ static inline bool efi_rt_services_suppo
return (efi.runtime_supported_mask & mask) == mask;
}
extern void efi_find_mirror(void);
@@ -129,7 +129,7 @@ cc: linux-efi@vger.kernel.org
#else
static inline bool efi_enabled(int feature)
{
@@ -919,6 +928,7 @@ static inline bool efi_rt_services_suppo
@@ -907,6 +916,7 @@ static inline bool efi_rt_services_suppo
}
static inline void efi_find_mirror(void) {}
@@ -137,7 +137,7 @@ cc: linux-efi@vger.kernel.org
#endif
extern int efi_status_to_err(efi_status_t status);
@@ -1137,13 +1147,6 @@ static inline bool efi_runtime_disabled(
@@ -1125,13 +1135,6 @@ static inline bool efi_runtime_disabled(
extern void efi_call_virt_check_flags(unsigned long flags, const void *caller);
extern unsigned long efi_call_virt_save_flags(void);

4
debian/patches/features/all/security-perf-allow-further-restriction-of-perf_event_open.patch vendored
View File

@@ -22,7 +22,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -1623,6 +1623,11 @@ int perf_cpu_time_max_percent_handler(co
@@ -1617,6 +1617,11 @@ int perf_cpu_time_max_percent_handler(co
int perf_event_max_stack_handler(const struct ctl_table *table, int write,
void *buffer, size_t *lenp, loff_t *ppos);
@@ -50,7 +50,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
/* Minimum for 512 kiB + 1 user control page */
int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */
@@ -12691,6 +12696,9 @@ SYSCALL_DEFINE5(perf_event_open,
@@ -12681,6 +12686,9 @@ SYSCALL_DEFINE5(perf_event_open,
if (err)
return err;