Update grsecurity kernels to 4.4.162 #3913

emkll · 2018-10-31T21:44:57Z

Status

Ready for review

4.4.162 kernel packages have already been uploaded to apt-test.freedom.press. Fixes #3838

Description of Changes

Bump kernels to 4.4.162 (linux-image and linux-firmware-image)
Adds intel-microcode package
Add linux-firmware-image for hardware compatibility
Remove 3.14.79 and 4.4.115 kernels.

Testing

Ensure apt-test.freedom.press is in apt-sources.
If using staging VMs, just vagrant up /staging/, and testinfra tests pass
Else, add apt-test.freedom.press to apt sources and run cron-apt -i -s, and reboot
The server comes back up, and uname -r returns 4.4.162-grsec
paxtest blackhat kills all the things

Hardware-specific testing

I have tested this in VMs, NUCs and Mac Minis, and seem to work properly. If you have any other hardware

Deployment

Packages are live on apt-test.freedom.press for testing.

For the 0.11.0 release, kernel debs (both the securedrop-grsec metapackage and linux-image-4.4.162-grsec_4.4.162-grsec-1_amd64 need to be uploaded to the apt server).

If the instances fail to boot, instructions in https://docs.securedrop.org/en/stable/upgrade/0.5.x_to_0.6.html are still valid.

Checklist

If you made changes to the system configuration:

Configuration tests pass

conorsch · 2018-11-02T00:38:05Z

Flagging that these changes cause tests to fail in #3909, which introduces grsec tests in staging. 🎉 Will prioritize review of this PR, so that #3909 can be rebased on top of it.

conorsch · 2018-11-02T02:57:37Z

Ensure apt-test.freedom.press is in apt-sources.
🔴 If using staging VMs, just vagrant up /staging/, and testinfra tests pass (see PaX flags are unset during install time #3916; let's not block merge)
The server comes back up, and uname -r returns 4.4.162-grsec
paxtest blackhat kills all the things

conorsch

Added a few more tests. Only tested in VMs, not on hardware yet. So far, so good. Let's get this in so it can bake during the current development cycle.

msheiny · 2018-11-02T23:33:11Z

hah this is breaking my PR #3909 .. thanks CSO!! Some cherry picking is in order.

conorsch · 2018-11-02T23:35:32Z

@msheiny Now that #3921 is in, we can rebase this on that, then we should be good for merge. Rebase incoming...

Example build failure, showing it's requests: https://circleci.com/gh/freedomofpress/securedrop/19199

msheiny · 2018-11-02T23:36:06Z

@conorsch im rebasing... and fixing stuff

msheiny · 2018-11-02T23:36:18Z

actually i just want to cherry pick here..

msheiny · 2018-11-02T23:40:36Z

disregard! i was confused! rebase away

Now that all users have reported a smooth transition to the 4.4 series kernels, let's remove these old, unmaintained and end-of-life kernel series.

Provides microcode updates to addres various Intel cpu-based vulnerabilities.

Remove 4.4.135 kernels

The microcode package was just added, so let's test for it. Also updated the kernel version to be a constant, so we can reuse it inside package names, notable the firmware image (for additional hardware support).

emkll · 2018-11-20T17:34:43Z

I've been seeing some errors in syslog, in qubes staging, I will see if i can reproduce in other environments:

Nov 20 12:24:08 sd-app kernel: [  183.663203] init: hvc0 main process (1630) terminated with status 1
Nov 20 12:24:08 sd-app kernel: [  183.663213] init: hvc0 main process ended, respawning
Nov 20 12:24:18 sd-app kernel: [  193.668237] init: hvc0 main process (1632) terminated with status 1
Nov 20 12:24:18 sd-app kernel: [  193.668248] init: hvc0 main process ended, respawning
Nov 20 12:24:28 sd-app kernel: [  203.680099] init: hvc0 main process (1634) terminated with status 1
Nov 20 12:24:28 sd-app kernel: [  203.680109] init: hvc0 main process ended, respawning
Nov 20 12:24:38 sd-app kernel: [  213.682809] init: hvc0 main process (1636) terminated with status 1
Nov 20 12:24:38 sd-app kernel: [  213.682819] init: hvc0 main process ended, respawning
Nov 20 12:24:48 sd-app kernel: [  223.690815] init: hvc0 main process (1638) terminated with status 1
Nov 20 12:24:48 sd-app kernel: [  223.690825] init: hvc0 main process ended, respawning
Nov 20 12:24:58 sd-app kernel: [  233.693838] init: hvc0 main process (1640) terminated with status 1
Nov 20 12:24:58 sd-app kernel: [  233.693848] init: hvc0 main process ended, respawning
Nov 20 12:25:08 sd-app kernel: [  243.698088] init: hvc0 main process (1642) terminated with status 1
Nov 20 12:25:08 sd-app kernel: [  243.698099] init: hvc0 main process ended, respawning
Nov 20 12:25:18 sd-app kernel: [  253.703098] init: hvc0 main process (1644) terminated with status 1
Nov 20 12:25:18 sd-app kernel: [  253.703108] init: hvc0 main process ended, respawning
Nov 20 12:25:28 sd-app kernel: [  263.706533] init: hvc0 main process (1646) terminated with status 1
Nov 20 12:25:28 sd-app kernel: [  263.706543] init: hvc0 main process ended, respawning
Nov 20 12:25:38 sd-app kernel: [  273.709408] init: hvc0 main process (1648) terminated with status 1
Nov 20 12:25:38 sd-app kernel: [  273.709419] init: hvc0 main process ended, respawning
Nov 20 12:25:48 sd-app kernel: [  283.712697] init: hvc0 main process (1650) terminated with status 1
Nov 20 12:25:48 sd-app kernel: [  283.712709] init: hvc0 main process ended, respawning

redshiftzero

✅ apt-test.freedom.press in apt sources for both app and mon
✅ after reboot, both app and mon running 4.4.162
❔ testinfra tests pass - I did not test due to #3938
✅ paxtest blackhat kills all the things

I did not see any odd messages in syslog like you report @emkll. Minor nit inline, else if you're happy with this, feel free to merge

redshiftzero · 2018-11-21T23:58:37Z

molecule/testinfra/staging/common/test_grsecurity.py

@@ -3,6 +3,9 @@
 import re


+KERNEL_VERSION = "4.4.162"


Nit: in the spirit of DRY, can we use pytest.securedrop_test_vars.grsec_version here?

redshiftzero

restamping after my requested change was implemented

conorsch · 2018-11-26T18:44:49Z

No concerns, changes look good. Will rebase #3909 on top of latest develop post-merge to re-run CI over there.

emkll requested review from conorsch and msheiny as code owners October 31, 2018 21:44

emkll mentioned this pull request Oct 31, 2018

Update securedrop kernels to 4.4.161+ #3838

Closed

conorsch previously approved these changes Nov 2, 2018

View reviewed changes

conorsch dismissed their stale review via bb708cb November 2, 2018 23:51

conorsch force-pushed the 3838-bump-kernels-to-4.4.162 branch from 9cd2900 to bb708cb Compare November 2, 2018 23:51

emkll and others added 4 commits November 19, 2018 11:36

Remove 3.14 series kernels

f286144

Now that all users have reported a smooth transition to the 4.4 series kernels, let's remove these old, unmaintained and end-of-life kernel series.

Add intel-microcode package

aeb9f1d

Provides microcode updates to addres various Intel cpu-based vulnerabilities.

Bump kernels to 4.4.162

eca014e

Remove 4.4.135 kernels

Adds config tests for kernel-related packages

dfabb1c

The microcode package was just added, so let's test for it. Also updated the kernel version to be a constant, so we can reuse it inside package names, notable the firmware image (for additional hardware support).

emkll force-pushed the 3838-bump-kernels-to-4.4.162 branch from bb708cb to dfabb1c Compare November 19, 2018 16:38

redshiftzero previously approved these changes Nov 22, 2018

View reviewed changes

emkll dismissed redshiftzero’s stale review via b383733 November 22, 2018 13:19

Use test_vars kernel version for DRY-ness

9234c32

emkll force-pushed the 3838-bump-kernels-to-4.4.162 branch from b383733 to 9234c32 Compare November 22, 2018 14:31

redshiftzero approved these changes Nov 26, 2018

View reviewed changes

conorsch merged commit 36cbb21 into develop Nov 26, 2018

conorsch mentioned this pull request Nov 26, 2018

Nested Virtualization of Staging Env in CI #3909

Merged

redshiftzero deleted the 3838-bump-kernels-to-4.4.162 branch November 28, 2018 04:27

This was referenced Nov 28, 2018

Remove 3.14.79 kernels from securedrop-grsec metapackage #3643

Closed

Release SecureDrop 0.11.0 #3946

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update grsecurity kernels to 4.4.162 #3913

Update grsecurity kernels to 4.4.162 #3913

emkll commented Oct 31, 2018 •

edited

Loading

conorsch commented Nov 2, 2018

conorsch commented Nov 2, 2018 •

edited

Loading

conorsch left a comment

msheiny commented Nov 2, 2018

conorsch commented Nov 2, 2018 •

edited

Loading

msheiny commented Nov 2, 2018

msheiny commented Nov 2, 2018

msheiny commented Nov 2, 2018

emkll commented Nov 20, 2018

redshiftzero left a comment

redshiftzero Nov 21, 2018

redshiftzero left a comment

conorsch commented Nov 26, 2018

Update grsecurity kernels to 4.4.162 #3913

Update grsecurity kernels to 4.4.162 #3913

Conversation

emkll commented Oct 31, 2018 • edited Loading

Status

Description of Changes

Testing

Hardware-specific testing

Deployment

Checklist

If you made changes to the system configuration:

conorsch commented Nov 2, 2018

conorsch commented Nov 2, 2018 • edited Loading

conorsch left a comment

Choose a reason for hiding this comment

msheiny commented Nov 2, 2018

conorsch commented Nov 2, 2018 • edited Loading

msheiny commented Nov 2, 2018

msheiny commented Nov 2, 2018

msheiny commented Nov 2, 2018

emkll commented Nov 20, 2018

redshiftzero left a comment

Choose a reason for hiding this comment

redshiftzero Nov 21, 2018

Choose a reason for hiding this comment

redshiftzero left a comment

Choose a reason for hiding this comment

conorsch commented Nov 26, 2018

emkll commented Oct 31, 2018 •

edited

Loading

conorsch commented Nov 2, 2018 •

edited

Loading

conorsch commented Nov 2, 2018 •

edited

Loading