what features are required in Fedora kernel

[Dan Horák]

Hi all,

I am building kernels for some ARM based devices that use Fedora/ARM as
user-land. These devices are usually very limited in the size of kernel
that can be stored in their flash memories (like 2MB kernel, 4MB
ramdisk). So I would like to know what kernel features make a "Fedora
kernel", what are the MUST HAVE features?

Now I have those on my list
- audit
- SELinux
- IPv6
- Netfilter for both IPv4 and IPv6
but there are others for sure. Heavily modular kernel is about 1.65 MB
now.


	Thanks
		Dan

[Steve Grubb]

On Friday 04 September 2009 02:17:10 pm Dan Horák wrote:
>  I am building kernels for some ARM based devices that use Fedora/ARM
> as
>  user-land.  
Glad to see someone else looking at the ARM kernel.


>  These devices are usually very limited in the size of kernel
>  that can be stored in their flash memories (like 2MB kernel, 4MB
>  ramdisk). So I would like to know what kernel features make a "Fedora
>  kernel", what are the MUST HAVE features? 
Maybe some usb devices. Which ones...I don't know. :)

>  Now I have those on my list
>  - audit 
Note that the audit system on ARM is dysfunctional. No one has ever taken the 
time to write the requisite code in arch/arm/kernel/ptrace.c to call 
audit_syscall_entry(). Without that code upstream (or as a patch), the audit 
system is limited to user space originating events. I don't know if SE Linux 
AVC's are affected by the audit system not having its hands on a lot of 
information during the syscall.

>  - SELinux
>  - IPv6
>  - Netfilter for both IPv4 and IPv6 
Netfilter is needed badly on that arch since the default system image has a 
mail server listening to the public IP address and running as root. Iptables 
is needed to block this access.

-Steve

[Dan Horák]

Steve Grubb píše v Pá 04. 09. 2009 v 14:41 -0400:
>  On Friday 04 September 2009 02:17:10 pm Dan Horák wrote:
>  > I am building kernels for some ARM based devices that use Fedora/ARM as
>  > user-land. 
>  
>  Glad to see someone else looking at the ARM kernel.
>  
>  
>  > These devices are usually very limited in the size of kernel
>  > that can be stored in their flash memories (like 2MB kernel, 4MB
>  > ramdisk). So I would like to know what kernel features make a "Fedora
>  > kernel", what are the MUST HAVE features?
>  
>  Maybe some usb devices. Which ones...I don't know. :) 
USB support is built as modular so I can enable all :-)

>  > Now I have those on my list
>  > - audit
>  
>  Note that the audit system on ARM is dysfunctional. No one has ever taken the 
>  time to write the requisite code in arch/arm/kernel/ptrace.c to call 
>  audit_syscall_entry(). Without that code upstream (or as a patch), the audit 
>  system is limited to user space originating events. I don't know if SE Linux 
>  AVC's are affected by the audit system not having its hands on a lot of 
>  information during the syscall. 
good to know

>  > - SELinux
>  > - IPv6
>  > - Netfilter for both IPv4 and IPv6
>  
>  Netfilter is needed badly on that arch since the default system image has a 
>  mail server listening to the public IP address and running as root. Iptables 
>  is needed to block this access. 
I have uploaded my kernel + modules, see
https://www.redhat.com/archives/fedora-arm/2009-September/msg00006.html
for details.


		Dan

[Mike McGrath]

On Fri, 4 Sep 2009, Dan Horák wrote:

>  Hi all,
>
>  I am building kernels for some ARM based devices that use Fedora/ARM as
>  user-land. These devices are usually very limited in the size of kernel
>  that can be stored in their flash memories (like 2MB kernel, 4MB
>  ramdisk). So I would like to know what kernel features make a "Fedora
>  kernel", what are the MUST HAVE features?
>  
This is an interesting question.  I'd hate to think that something being
unable to be included because of technical reasons would cause us to be
unable to call something Fedora.

	-Mike

[Roland McGrath]

>  This is an interesting question.  I'd hate to think that
> something being
>  unable to be included because of technical reasons would cause us to be
>  unable to call something Fedora. 
Well, I think it's more or less "whatever works".  That is, we require
the various kernel features that the rest of the Fedora packages and
their integration need to work properly.

Are you trying to get the installed kernel rpm size real small,
or just to get the kernel+initrd real small?  The latter seems
fairly easy--just make everything not in the boot path modular
and make sure mkinitrd doesn't include anything unnecessary.
Then everything else can be in post-boot modules and you don't
necessarily have to strip down the kernel build particularly.


Thanks,
Roland

[Dan Horák]

Roland McGrath píše v Pá 04. 09. 2009 v 14:20 -0700:
>  > This is an interesting question.  I'd hate to think that
> something being
>  > unable to be included because of technical reasons would cause us to be
>  > unable to call something Fedora.
>  
>  Well, I think it's more or less "whatever works".  That is, we require
>  the various kernel features that the rest of the Fedora packages and
>  their integration need to work properly.
>  
>  Are you trying to get the installed kernel rpm size real small,
>  or just to get the kernel+initrd real small?  The latter seems 
I am not playing with the kernel rpm for now, having a working kernel
rpm on ARM is a long-term goal.

>  fairly easy--just make everything not in the boot path modular
>  and make sure mkinitrd doesn't include anything unnecessary.
>  Then everything else can be in post-boot modules and you don't
>  necessarily have to strip down the kernel build particularly. 
Yes, it works. The first experiment was how small today's kernel can be.
And it's good to know that it can be small enough, at least on 32-bit
platform. Now it requires to properly mix the built-in and modularized
stuff.


		Dan

[Dan Horák]

Mike McGrath píše v Pá 04. 09. 2009 v 15:55 -0500:
>  On Fri, 4 Sep 2009, Dan Horák wrote:
>  
>  > Hi all,
>  >
>  > I am building kernels for some ARM based devices that use Fedora/ARM as
>  > user-land. These devices are usually very limited in the size of kernel
>  > that can be stored in their flash memories (like 2MB kernel, 4MB
>  > ramdisk). So I would like to know what kernel features make a "Fedora
>  > kernel", what are the MUST HAVE features?
>  >
>  
>  This is an interesting question.  I'd hate to think that something being
>  unable to be included because of technical reasons would cause us to be
>  unable to call something Fedora. 
It's not meant as a strict question what can or can't be called Fedora,
but rather what are the important features that are used by the user
space tools in Fedora.


		Dan