import CS systemtap-5.5-2.el9
This commit is contained in:
AlmaLinux RelEng Bot
parent
4255e23ea9
commit
773f562055
2
.gitignore
vendored
2
.gitignore
vendored
@ -1 +1 @@
|
||||
SOURCES/systemtap-5.4.tar.gz
|
||||
SOURCES/systemtap-5.5.tar.gz
|
||||
|
||||
@ -1 +1 @@
|
||||
c7c693578bbd17a3dc2e75e58ef709cc091daa6e SOURCES/systemtap-5.4.tar.gz
|
||||
6cf5ee75c835cfe8a5dc27e714aaca58adc8265b SOURCES/systemtap-5.5.tar.gz
|
||||
|
||||
@ -1,66 +0,0 @@
|
||||
From 53c48b550255ceca1216616fe1948618be166189 Mon Sep 17 00:00:00 2001
|
||||
From: "Frank Ch. Eigler" <fche@redhat.com>
|
||||
Date: Wed, 12 Nov 2025 18:51:26 -0500
|
||||
Subject: [PATCH] PR33428: imply kernel<vmlinux.h>, check by file name, cont'd
|
||||
|
||||
Linux 5.7+ includes a vmlinux.h file ... but previous code looked for
|
||||
version 6.7+ by mistake. Might as well just look for the vmlinux.h
|
||||
file directly in the build tree, and leave a little diagnostic note.
|
||||
---
|
||||
tapsets.cxx | 33 +++++++++++++++++++++------------
|
||||
1 file changed, 21 insertions(+), 12 deletions(-)
|
||||
|
||||
diff --git a/tapsets.cxx b/tapsets.cxx
|
||||
index d267b6506..ae201ab26 100644
|
||||
--- a/tapsets.cxx
|
||||
+++ b/tapsets.cxx
|
||||
@@ -4867,8 +4867,12 @@ dwarf_var_expanding_visitor::visit_cast_op (cast_op *e)
|
||||
if (is_user_module (q.dw.module_name))
|
||||
e->module = q.dw.module_name;
|
||||
else if ((strverscmp(sess.compatible.c_str(), "5.4") >= 0) && // default on new enough systemtap
|
||||
- (strverscmp(sess.kernel_base_release.c_str(), "6.7") >= 0)) // for new enough kernel to have a vmlinux.h
|
||||
- e->module = string(TOK_KERNEL_VMLINUX_H) + string(":") + q.dw.module_name; // PR33428: prefix
|
||||
+ access(string(sess.kernel_build_tree+"/vmlinux.h").c_str(), R_OK) == 0) // file exists; not just kernel 6.7+
|
||||
+ {
|
||||
+ if (sess.verbose > 3)
|
||||
+ clog << _("added implicit kernel<vmlinux.h> for @cast context") << " " << q.dw.module_name << endl;
|
||||
+ e->module = string(TOK_KERNEL_VMLINUX_H) + string(":") + q.dw.module_name; // PR33428: prefix
|
||||
+ }
|
||||
else
|
||||
e->module = q.dw.module_name;
|
||||
}
|
||||
@@ -5166,16 +5170,21 @@ void dwarf_cast_expanding_visitor::visit_cast_op (cast_op* e)
|
||||
// PR33428: prepend "kernel<vmlinux.h>" to the list if there is any
|
||||
// "kernel" or "kernel<FILE>" component.
|
||||
if ((strverscmp(sess.compatible.c_str(), "5.4") >= 0) && // default on new enough systemtap
|
||||
- (strverscmp(sess.kernel_base_release.c_str(), "6.7") >= 0) && // for new enough kernel to have a vmlinux.h
|
||||
- (e->module.find(TOK_KERNEL_VMLINUX_H) == string::npos)) // don't prepend again; might already be here from implicit "" expansion
|
||||
- {
|
||||
- if (e->module.starts_with("kernel")) // right at the front?
|
||||
- e->module = string(TOK_KERNEL_VMLINUX_H) + string(":") + e->module;
|
||||
- else {
|
||||
- string::size_type p = e->module.find(":kernel"); // in the middle?
|
||||
- if (p != string::npos)
|
||||
- e->module.insert(p, TOK_KERNEL_VMLINUX_H + string (":"));
|
||||
- }
|
||||
+ access(string(sess.kernel_build_tree+"/vmlinux.h").c_str(), R_OK) == 0) // file exists; not just kernel 6.7+
|
||||
+ {
|
||||
+ if (sess.verbose > 3)
|
||||
+ clog << _("added implicit kernel<vmlinux.h> for @cast expanding") << " " << e->module << endl;
|
||||
+
|
||||
+ if (e->module.find(TOK_KERNEL_VMLINUX_H) == string::npos) // don't prepend again; might already be here from implicit "" expansion
|
||||
+ {
|
||||
+ if (e->module.starts_with("kernel")) // right at the front?
|
||||
+ e->module = string(TOK_KERNEL_VMLINUX_H) + string(":") + e->module;
|
||||
+ else {
|
||||
+ string::size_type p = e->module.find(":kernel"); // in the middle?
|
||||
+ if (p != string::npos)
|
||||
+ e->module.insert(p, TOK_KERNEL_VMLINUX_H + string (":"));
|
||||
+ }
|
||||
+ }
|
||||
}
|
||||
|
||||
tokenize(e->module, modules, ":");
|
||||
--
|
||||
2.51.0
|
||||
|
||||
52
SOURCES/systemtap-mok-sha1-fix.patch
Normal file
52
SOURCES/systemtap-mok-sha1-fix.patch
Normal file
@ -0,0 +1,52 @@
|
||||
commit 41b6fa81922e2c7ba6a19f769167160b98e42bd1
|
||||
Author: Martin Cermak <mcermak@redhat.com>
|
||||
Date: Mon Jun 1 17:40:32 2026 +0200
|
||||
|
||||
Use SHA1 for MOK directory naming and matching
|
||||
|
||||
Commit a4bd43278 (April 2026) changed SystemTap to use SHA256 instead of
|
||||
SHA1 for certificate fingerprinting, including MOK (Machine Owner Key)
|
||||
directory naming and matching. Mokutil (the system tool for managing
|
||||
UEFI MOKs) is hardcoded to use SHA1 fingerprints. That commit rendered
|
||||
SystemTap incompatible with mokutil.
|
||||
|
||||
Revert only the MOK fingerprint calculation back to SHA1 in
|
||||
read_cert_info_from_file() while keeping SHA256 for the actual module
|
||||
signing operation. This makes SystemTap's MOK directory names match what
|
||||
mokutil displays.
|
||||
|
||||
Assisted-by: Anthropic Claude
|
||||
|
||||
diff --git a/nsscommon.cxx b/nsscommon.cxx
|
||||
index 5ab59ed8e..db88f6b8f 100644
|
||||
--- a/nsscommon.cxx
|
||||
+++ b/nsscommon.cxx
|
||||
@@ -1962,12 +1962,16 @@ read_cert_info_from_file (const string &certPath, string &fingerprint)
|
||||
}
|
||||
|
||||
// Get the fingerprint from the signature.
|
||||
- unsigned char fingerprint_buf[32]; // SHA256_LENGTH
|
||||
+ // Use SHA1 for MOK fingerprints to match mokutil behavior
|
||||
+ // MOKutil always uses SHA1 fingerprints regardless of certificate signature algorithm
|
||||
+ unsigned char fingerprint_buf[SHA1_LENGTH];
|
||||
SECItem fpItem;
|
||||
- rv = PK11_HashBuf(SEC_OID_SHA256, fingerprint_buf, derCert.data, derCert.len);
|
||||
+ rv = PK11_HashBuf(SEC_OID_SHA1, fingerprint_buf, derCert.data, derCert.len);
|
||||
if (rv)
|
||||
{
|
||||
- nsscommon_error (_F("Could not decode SHA256 fingerprint from file %s",
|
||||
+ // Note: We use SHA1 for MOK fingerprints because mokutil (the UEFI MOK
|
||||
+ // enrollment tool) always displays SHA1 fingerprints, not SHA256.
|
||||
+ nsscommon_error (_F("Could not decode SHA1 fingerprint from file %s",
|
||||
certPath.c_str ()));
|
||||
goto done;
|
||||
}
|
||||
@@ -1976,7 +1980,7 @@ read_cert_info_from_file (const string &certPath, string &fingerprint)
|
||||
str = CERT_Hexify(&fpItem, 1);
|
||||
if (! str)
|
||||
{
|
||||
- nsscommon_error (_F("Could not hexify SHA256 fingerprint from file %s",
|
||||
+ nsscommon_error (_F("Could not hexify SHA1 fingerprint from file %s",
|
||||
certPath.c_str ()));
|
||||
goto done;
|
||||
}
|
||||
@ -130,8 +130,8 @@ f /var/log/stap-server/log 0644 stap-server stap-server -
|
||||
|
||||
Name: systemtap
|
||||
# PRERELEASE
|
||||
Version: 5.4
|
||||
Release: 4%{?release_override}%{?dist}
|
||||
Version: 5.5
|
||||
Release: 2%{?release_override}%{?dist}
|
||||
# for version, see also configure.ac
|
||||
|
||||
|
||||
@ -168,8 +168,7 @@ Summary: Programmable system-wide instrumentation system
|
||||
License: GPL-2.0-or-later
|
||||
URL: https://sourceware.org/systemtap/
|
||||
Source: ftp://sourceware.org/pub/systemtap/releases/systemtap-%{version}.tar.gz
|
||||
|
||||
Patch1: 0001-PR33428-imply-kernel-vmlinux-h.patch
|
||||
Patch0: systemtap-mok-sha1-fix.patch
|
||||
|
||||
# Build*
|
||||
BuildRequires: make
|
||||
@ -219,7 +218,7 @@ BuildRequires: xmlto /usr/share/xmlto/format/fo/pdf
|
||||
%endif
|
||||
%if %{with_emacsvim}
|
||||
# for _emacs_sitelispdir macros etc.
|
||||
BuildRequires: emacs
|
||||
BuildRequires: emacs-common
|
||||
%endif
|
||||
%if %{with_java}
|
||||
BuildRequires: java-devel
|
||||
@ -338,6 +337,9 @@ Summary: Programmable system-wide instrumentation system - runtime
|
||||
License: GPL-2.0-or-later
|
||||
URL: https://sourceware.org/systemtap/
|
||||
Requires(pre): shadow-utils
|
||||
%if 0%{?fedora} >= 45 || 0%{?rhel} >= 11
|
||||
Recommends: yama-ptrace-enable
|
||||
%endif
|
||||
Conflicts: systemtap-devel < %{version}-%{release}
|
||||
Conflicts: systemtap-server < %{version}-%{release}
|
||||
Conflicts: systemtap-client < %{version}-%{release}
|
||||
@ -450,10 +452,12 @@ Conflicts: systemtap-testsuite = %{version}-%{release}.x86_64
|
||||
Requires: gcc gcc-c++ make glibc-devel
|
||||
# testsuite/systemtap.base/ptrace.exp needs strace
|
||||
Requires: strace
|
||||
# testsuite/systemtap.base/ipaddr.exp needs nc. Unfortunately, the rpm
|
||||
# testsuite/systemtap.base/ipaddr.exp needs nc or ncat. Unfortunately, the rpm
|
||||
# that provides nc has changed over time (from 'nc' to
|
||||
# 'nmap-ncat'). So, we'll do a file-based require.
|
||||
Requires: /usr/bin/nc
|
||||
# 'nmap-ncat'). So, we'll do a file-based recommend.
|
||||
Recommends: /usr/bin/nc
|
||||
# Suggest nmap-ncat for /usr/bin/ncat
|
||||
Recommends: /usr/bin/ncat
|
||||
%ifnarch ia64 ppc64le aarch64
|
||||
%if 0%{?fedora} >= 21 || 0%{?rhel} >= 8
|
||||
# no prelink
|
||||
@ -614,7 +618,8 @@ or within a container.
|
||||
# ------------------------------------------------------------------------
|
||||
|
||||
%prep
|
||||
%autosetup -p1
|
||||
%setup -q
|
||||
%patch -P0 -p1
|
||||
|
||||
%build
|
||||
|
||||
@ -1372,6 +1377,13 @@ exit 0
|
||||
|
||||
# PRERELEASE
|
||||
%changelog
|
||||
* Mon Jun 01 2026 Martin Cermak <mcermak@redhat.com> - 5.5-2
|
||||
- Systemtap 5.5 doesn't work in SecureBoot mode
|
||||
|
||||
* Fri May 01 2026 Frank Ch. Eigler <fche@redhat.com> - 5.5-1
|
||||
- Upstream release, see wiki page below for detailed notes.
|
||||
https://sourceware.org/systemtap/wiki/SystemTapReleases
|
||||
|
||||
* Tue Dec 2 2025 Martin Cermak <mcermak@redhat.com> - 5.4-4
|
||||
- Fix RHEL-132676
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user