Creates Focal-specific kernel metapackage#5691
Merged
Conversation
added 3 commits
January 5, 2021 17:25
Creates a Focal-only version of the "securedrop-grsec" metapackage, so we can provide distro-specific behavior, namely: * use paxctld, rather than paxctl * pin explicit kernel version via grub Much of the new metapackage logic is taken from the comparable work already implemented in: https://github.com/freedomofpress/securedrop-debian-packaging/tree/cee267e7dfebd9553cdf4b02ecbe54783049121c/securedrop-workstation-grsec/debian Also tweaks the package build logic to support per-distro packages.
A bit of per-distro logic, but mostly verifying the paxctl/paxctld settings are as expected. These tests aren't actually passing yet, because the "securedrop-grsec" metapackage isn't installed from scratch.
The "securedrop-grsec" metapackage isn't included in the "install-local-packages" logic, for the staging environment. That makes evaluationg metapackage changes difficult. Let's add support for local metapackages to aid in adjusting kernel-related settings.
conorsch
force-pushed
the
5690-kernel-metapackage-for-focal
branch
from
bd6c578 to
842787a
Compare
Codecov Report
@@ Coverage Diff @@
## develop #5691 +/- ##
========================================
Coverage 85.54% 85.54%
========================================
Files 52 52
Lines 3771 3771
Branches 474 474
========================================
Hits 3226 3226
Misses 440 440
Partials 105 105 Continue to review full report at Codecov.
|
Contributor
Author
|
Note that post-merge, we should upload the new focal |
kushaldas
approved these changes
Jan 8, 2021
Contributor
kushaldas
left a comment
kushaldas
left a comment
There was a problem hiding this comment.
Tested locally against Focal target. Also did visual review. Looks good.
conorsch
pushed a commit
to freedomofpress/build-logs
that referenced
this pull request
Jan 8, 2021
Built post-merge of freedomofpress/securedrop#5691
conorsch
pushed a commit
to freedomofpress/securedrop-apt-test
that referenced
this pull request
Jan 8, 2021
Built after merge of [0], build logs at [1]. [0] freedomofpress/securedrop#5691 [1] freedomofpress/build-logs@06916a4
This was referenced Jan 8, 2021
emkll
added a commit
that referenced
this pull request
Feb 4, 2021
This will pull in and install 5.4 series kernels for Focal installs, thanks to the split metapackage logic introduced in #5691
emkll
added a commit
that referenced
this pull request
Feb 4, 2021
This will pull in and install 5.4 series kernels for Focal installs, thanks to the split metapackage logic introduced in #5691
kushaldas
pushed a commit
that referenced
this pull request
Feb 5, 2021
This will pull in and install 5.4 series kernels for Focal installs, thanks to the split metapackage logic introduced in #5691
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Status
Ready for review.
Description of Changes
Fixes #5690. Fixes #4134.
Changes proposed in this pull request:
securedrop-grsecmetapackage, for pinning kernel and configuring paxctldsecuredrop-grsecin staging environment (previously we only used the package from apt-test in staging)Testing
make build-debs-focaland inspect thesecuredrop-grsecmetapackage that's createdDeployment
Focal-only.
Checklist
If you made changes to the server application code:
make lint) and tests (make test) pass in the development containerIf you made changes to
securedrop-admin:make -C admin test) pass in the admin development containerIf you made changes to the system configuration:
If you made non-trivial code changes:
Choose one of the following:
If you added or updated a code dependency:
Choose one of the following: