diff --git a/.gitignore b/.gitignore index 2e05275..96c8b74 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/systemtap-5.4.tar.gz +SOURCES/systemtap-5.5.tar.gz diff --git a/.systemtap.metadata b/.systemtap.metadata index 9774ffe..a4487c2 100644 --- a/.systemtap.metadata +++ b/.systemtap.metadata @@ -1 +1 @@ -c7c693578bbd17a3dc2e75e58ef709cc091daa6e SOURCES/systemtap-5.4.tar.gz +6cf5ee75c835cfe8a5dc27e714aaca58adc8265b SOURCES/systemtap-5.5.tar.gz diff --git a/SOURCES/0001-PR33428-imply-kernel-vmlinux-h.patch b/SOURCES/0001-PR33428-imply-kernel-vmlinux-h.patch deleted file mode 100644 index c2614ff..0000000 --- a/SOURCES/0001-PR33428-imply-kernel-vmlinux-h.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 53c48b550255ceca1216616fe1948618be166189 Mon Sep 17 00:00:00 2001 -From: "Frank Ch. Eigler" -Date: Wed, 12 Nov 2025 18:51:26 -0500 -Subject: [PATCH] PR33428: imply kernel, check by file name, cont'd - -Linux 5.7+ includes a vmlinux.h file ... but previous code looked for -version 6.7+ by mistake. Might as well just look for the vmlinux.h -file directly in the build tree, and leave a little diagnostic note. ---- - tapsets.cxx | 33 +++++++++++++++++++++------------ - 1 file changed, 21 insertions(+), 12 deletions(-) - -diff --git a/tapsets.cxx b/tapsets.cxx -index d267b6506..ae201ab26 100644 ---- a/tapsets.cxx -+++ b/tapsets.cxx -@@ -4867,8 +4867,12 @@ dwarf_var_expanding_visitor::visit_cast_op (cast_op *e) - if (is_user_module (q.dw.module_name)) - e->module = q.dw.module_name; - else if ((strverscmp(sess.compatible.c_str(), "5.4") >= 0) && // default on new enough systemtap -- (strverscmp(sess.kernel_base_release.c_str(), "6.7") >= 0)) // for new enough kernel to have a vmlinux.h -- e->module = string(TOK_KERNEL_VMLINUX_H) + string(":") + q.dw.module_name; // PR33428: prefix -+ access(string(sess.kernel_build_tree+"/vmlinux.h").c_str(), R_OK) == 0) // file exists; not just kernel 6.7+ -+ { -+ if (sess.verbose > 3) -+ clog << _("added implicit kernel for @cast context") << " " << q.dw.module_name << endl; -+ e->module = string(TOK_KERNEL_VMLINUX_H) + string(":") + q.dw.module_name; // PR33428: prefix -+ } - else - e->module = q.dw.module_name; - } -@@ -5166,16 +5170,21 @@ void dwarf_cast_expanding_visitor::visit_cast_op (cast_op* e) - // PR33428: prepend "kernel" to the list if there is any - // "kernel" or "kernel" component. - if ((strverscmp(sess.compatible.c_str(), "5.4") >= 0) && // default on new enough systemtap -- (strverscmp(sess.kernel_base_release.c_str(), "6.7") >= 0) && // for new enough kernel to have a vmlinux.h -- (e->module.find(TOK_KERNEL_VMLINUX_H) == string::npos)) // don't prepend again; might already be here from implicit "" expansion -- { -- if (e->module.starts_with("kernel")) // right at the front? -- e->module = string(TOK_KERNEL_VMLINUX_H) + string(":") + e->module; -- else { -- string::size_type p = e->module.find(":kernel"); // in the middle? -- if (p != string::npos) -- e->module.insert(p, TOK_KERNEL_VMLINUX_H + string (":")); -- } -+ access(string(sess.kernel_build_tree+"/vmlinux.h").c_str(), R_OK) == 0) // file exists; not just kernel 6.7+ -+ { -+ if (sess.verbose > 3) -+ clog << _("added implicit kernel for @cast expanding") << " " << e->module << endl; -+ -+ if (e->module.find(TOK_KERNEL_VMLINUX_H) == string::npos) // don't prepend again; might already be here from implicit "" expansion -+ { -+ if (e->module.starts_with("kernel")) // right at the front? -+ e->module = string(TOK_KERNEL_VMLINUX_H) + string(":") + e->module; -+ else { -+ string::size_type p = e->module.find(":kernel"); // in the middle? -+ if (p != string::npos) -+ e->module.insert(p, TOK_KERNEL_VMLINUX_H + string (":")); -+ } -+ } - } - - tokenize(e->module, modules, ":"); --- -2.51.0 - diff --git a/SOURCES/systemtap-mok-sha1-fix.patch b/SOURCES/systemtap-mok-sha1-fix.patch new file mode 100644 index 0000000..6ccf072 --- /dev/null +++ b/SOURCES/systemtap-mok-sha1-fix.patch @@ -0,0 +1,52 @@ +commit 41b6fa81922e2c7ba6a19f769167160b98e42bd1 +Author: Martin Cermak +Date: Mon Jun 1 17:40:32 2026 +0200 + + Use SHA1 for MOK directory naming and matching + + Commit a4bd43278 (April 2026) changed SystemTap to use SHA256 instead of + SHA1 for certificate fingerprinting, including MOK (Machine Owner Key) + directory naming and matching. Mokutil (the system tool for managing + UEFI MOKs) is hardcoded to use SHA1 fingerprints. That commit rendered + SystemTap incompatible with mokutil. + + Revert only the MOK fingerprint calculation back to SHA1 in + read_cert_info_from_file() while keeping SHA256 for the actual module + signing operation. This makes SystemTap's MOK directory names match what + mokutil displays. + + Assisted-by: Anthropic Claude + +diff --git a/nsscommon.cxx b/nsscommon.cxx +index 5ab59ed8e..db88f6b8f 100644 +--- a/nsscommon.cxx ++++ b/nsscommon.cxx +@@ -1962,12 +1962,16 @@ read_cert_info_from_file (const string &certPath, string &fingerprint) + } + + // Get the fingerprint from the signature. +- unsigned char fingerprint_buf[32]; // SHA256_LENGTH ++ // Use SHA1 for MOK fingerprints to match mokutil behavior ++ // MOKutil always uses SHA1 fingerprints regardless of certificate signature algorithm ++ unsigned char fingerprint_buf[SHA1_LENGTH]; + SECItem fpItem; +- rv = PK11_HashBuf(SEC_OID_SHA256, fingerprint_buf, derCert.data, derCert.len); ++ rv = PK11_HashBuf(SEC_OID_SHA1, fingerprint_buf, derCert.data, derCert.len); + if (rv) + { +- nsscommon_error (_F("Could not decode SHA256 fingerprint from file %s", ++ // Note: We use SHA1 for MOK fingerprints because mokutil (the UEFI MOK ++ // enrollment tool) always displays SHA1 fingerprints, not SHA256. ++ nsscommon_error (_F("Could not decode SHA1 fingerprint from file %s", + certPath.c_str ())); + goto done; + } +@@ -1976,7 +1980,7 @@ read_cert_info_from_file (const string &certPath, string &fingerprint) + str = CERT_Hexify(&fpItem, 1); + if (! str) + { +- nsscommon_error (_F("Could not hexify SHA256 fingerprint from file %s", ++ nsscommon_error (_F("Could not hexify SHA1 fingerprint from file %s", + certPath.c_str ())); + goto done; + } diff --git a/SPECS/systemtap.spec b/SPECS/systemtap.spec index 1b3945d..6fd7a1f 100644 --- a/SPECS/systemtap.spec +++ b/SPECS/systemtap.spec @@ -130,8 +130,8 @@ f /var/log/stap-server/log 0644 stap-server stap-server - Name: systemtap # PRERELEASE -Version: 5.4 -Release: 4%{?release_override}%{?dist} +Version: 5.5 +Release: 2%{?release_override}%{?dist} # for version, see also configure.ac @@ -168,8 +168,7 @@ Summary: Programmable system-wide instrumentation system License: GPL-2.0-or-later URL: https://sourceware.org/systemtap/ Source: ftp://sourceware.org/pub/systemtap/releases/systemtap-%{version}.tar.gz - -Patch1: 0001-PR33428-imply-kernel-vmlinux-h.patch +Patch0: systemtap-mok-sha1-fix.patch # Build* BuildRequires: make @@ -219,7 +218,7 @@ BuildRequires: xmlto /usr/share/xmlto/format/fo/pdf %endif %if %{with_emacsvim} # for _emacs_sitelispdir macros etc. -BuildRequires: emacs +BuildRequires: emacs-common %endif %if %{with_java} BuildRequires: java-devel @@ -338,6 +337,9 @@ Summary: Programmable system-wide instrumentation system - runtime License: GPL-2.0-or-later URL: https://sourceware.org/systemtap/ Requires(pre): shadow-utils +%if 0%{?fedora} >= 45 || 0%{?rhel} >= 11 +Recommends: yama-ptrace-enable +%endif Conflicts: systemtap-devel < %{version}-%{release} Conflicts: systemtap-server < %{version}-%{release} Conflicts: systemtap-client < %{version}-%{release} @@ -450,10 +452,12 @@ Conflicts: systemtap-testsuite = %{version}-%{release}.x86_64 Requires: gcc gcc-c++ make glibc-devel # testsuite/systemtap.base/ptrace.exp needs strace Requires: strace -# testsuite/systemtap.base/ipaddr.exp needs nc. Unfortunately, the rpm +# testsuite/systemtap.base/ipaddr.exp needs nc or ncat. Unfortunately, the rpm # that provides nc has changed over time (from 'nc' to -# 'nmap-ncat'). So, we'll do a file-based require. -Requires: /usr/bin/nc +# 'nmap-ncat'). So, we'll do a file-based recommend. +Recommends: /usr/bin/nc +# Suggest nmap-ncat for /usr/bin/ncat +Recommends: /usr/bin/ncat %ifnarch ia64 ppc64le aarch64 %if 0%{?fedora} >= 21 || 0%{?rhel} >= 8 # no prelink @@ -614,7 +618,8 @@ or within a container. # ------------------------------------------------------------------------ %prep -%autosetup -p1 +%setup -q +%patch -P0 -p1 %build @@ -1372,6 +1377,13 @@ exit 0 # PRERELEASE %changelog +* Mon Jun 01 2026 Martin Cermak - 5.5-2 +- Systemtap 5.5 doesn't work in SecureBoot mode + +* Fri May 01 2026 Frank Ch. Eigler - 5.5-1 +- Upstream release, see wiki page below for detailed notes. + https://sourceware.org/systemtap/wiki/SystemTapReleases + * Tue Dec 2 2025 Martin Cermak - 5.4-4 - Fix RHEL-132676