[OS-BUILD PATCH 0/2] Fix rpm -V verification failures on kernel-core package

[Herton R. Krzesinski (via Email Bridge)]

From: Herton R. Krzesinski on gitlab.com
Merge Request: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1268

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1977056

As reported on bugzilla above, rpm -V on kernel-core package fails, eg.:

```
.M.......  g /boot/System.map-5.13.0-0.rc7.51.el9.x86_64
.M.......  g /boot/initramfs-5.13.0-0.rc7.51.el9.x86_64.img
.......T.    /lib/modules/5.13.0-0.rc7.51.el9.x86_64/modules.builtin.alias.bin
```

This merge request with two commits are aimed to fix those. The ghost files
issue were already fixed in rhel7/rhel8 but kernel-ark lacked the commit,
which I cherry-picked here. The other commit fixes the problem with
modules.builtin.alias.bin which is a depmod created file and we need to remove
in the build process.

---
 redhat/kernel.spec.template |  29 ++++++++++++++++-------------
 1 files changed, 16 insertions(+), 13 deletions(-)

[OS-BUILD PATCH 1/2] rpmspec: amend removal of depmod created files to include modules.builtin.alias.bin

[Herton R. Krzesinski (via Email Bridge)]

From: Herton R. Krzesinski

rpmspec: amend removal of depmod created files to include modules.builtin.alias.bin

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1977056

Right now we don't remove the file modules.builtin.alias.bin from the
list of depmod files we already remove at the kernel build time. This
makes it being included in the kernel-core package and being listed
with rpm -V output, eg.:

$ rpm -V kernel-core
(...)
.......T.    /lib/modules/5.14.0-0.rc2.23.el9.x86_64/modules.builtin.alias.bin

I just redid the removal command to explicitly call each file created by depmod.
We could by mistake do a glob like modules.builtin.* which would wrongly include
modules.builtin.modinfo for example, so seems safest to do it this way. While at
it I removed the *map glob which may be was needed in the past (may
be very distant past?) but this file is not created anymore. I manually
verified the amended list to what is in kmod sources at tools/depmod.c,
at the depmod_output() function.

This also removes the duplicated removal calls, instead of having to
modify two places, just do a single function and call it in the two places
it's needed.

Signed-off-by: Herton R. Krzesinski

diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template
index blahblah..blahblah 100755
--- a/redhat/kernel.spec.template
+++ b/redhat/kernel.spec.template
@@ -1977,10 +1977,16 @@ BuildKernel() {
     ( find $RPM_BUILD_ROOT/lib/modules/$KernelVer -name '*.ko' | xargs /sbin/modinfo -l | \
         grep -E -v 'GPL( v2)?$|Dual BSD/GPL$|Dual MPL/GPL$|GPL and additional rights$' ) && exit 1

-    # remove files that will be auto generated by depmod at rpm -i time
-    pushd $RPM_BUILD_ROOT/lib/modules/$KernelVer/
-        rm -f modules.{alias*,builtin.bin,dep*,*map,symbols*,devname,softdep}
-    popd
+    remove_depmod_files()
+    {
+        # remove files that will be auto generated by depmod at rpm -i time
+        pushd $RPM_BUILD_ROOT/lib/modules/$KernelVer/
+            rm -f modules.{alias,alias.bin,builtin.alias.bin,builtin.bin} \
+                  modules.{dep,dep.bin,devname,softdep,symbols,symbols.bin}
+        popd
+    }
+
+    remove_depmod_files

# Identify modules in the kernel-modules-extras package
     %{SOURCE17} $RPM_BUILD_ROOT lib/modules/$KernelVer $RPM_SOURCE_DIR/mod-extra.list
@@ -2032,10 +2038,7 @@ BuildKernel() {
    touch lib/modules/$KernelVer/modules.builtin
     fi

-    # remove files that will be auto generated by depmod at rpm -i time
-    pushd $RPM_BUILD_ROOT/lib/modules/$KernelVer/
-        rm -f modules.{alias*,builtin.bin,dep*,*map,symbols*,devname,softdep}
-    popd
+    remove_depmod_files

# Go back and find all of the various directories in the tree.  We use this
     # for the dir lists in kernel-core

--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1268

[OS-BUILD PATCH 2/2] rpmspec: correct the ghost initramfs attributes

[Herton R. Krzesinski (via Email Bridge)]

From: Herton R. Krzesinski

rpmspec: correct the ghost initramfs attributes

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1977056

This is a cherry pick from the following rhel-8 change into kernel-ark:

commit 88049ff66893839cb85731db809b1ba47a3a23f3
Author: Rafael Aquini 
Date:   Tue Jun 25 19:25:09 2019 -0400

[rpmspec] correct the ghost initramfs attributes

Message-id: 
    Patchwork-id: 265851
    O-Subject: [RHEL8 PATCH] redhat: spec: correct the ghost initramfs attributes
    Bugzilla: 1678881
    RH-Acked-by: Jarod Wilson 
    RH-Acked-by: Jan Stancek

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1678881
    Upstream Status: RHEL only
    Build Info: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=22353984

This patch is a forward port of the following RHEL-7 commit:
    commit f9e549645b10405f8b12f07649327ea293a5a78a
    Author: Kyle Walker 
    Date:   Mon Feb 4 19:11:11 2019 -0500

[redhat] spec: Correct the ghost initramfs attributes

Message-id: 
        Patchwork-id: 239860
        O-Subject: [RHEL7 BZ 1571909] spec: Correct the ghost initramfs attributes
        Bugzilla: 1571909
        RH-Acked-by: Tony Camuso 
        RH-Acked-by: Jarod Wilson 
        RH-Acked-by: Patrick Talbert

Bugzilla: 1571909
        Message-id: 
        Patchwork-id: 239860
        O-Subject: [RHEL7 BZ 1571909] spec: Correct the ghost initramfs attributes
        Bugzilla: 1571909
        RH-Acked-by: Tony Camuso 
        RH-Acked-by: Jarod Wilson 
        RH-Acked-by: Patrick Talbert

Bugzilla: 1571909
        Upstream Status: RHEL only
        Build Info: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=20067072

The initramfs ghost directive doesn't include the necessary attributes
        macro. When generating the initramfs, dracut sets the umask to 0077, which
        will result in 0600 as shown below.

# dracut -f 2>/dev/null 1>&2
            # ls -l /boot/initramfs-3.10.0-957.1.3.el7.x86_64.img
            -rw-------. 1 root root 21266044 Feb  4 12:09 /boot/initramfs-3.10.0-957.1.3.el7.x86_64.img

But this doesn't match the specfile which currently assumes 0644 and
        results in RPM verification failures.

# rpm -V kernel
            .M.......  g /boot/initramfs-3.10.0-957.1.3.el7.x86_64.img

The issue was masked in previous releases as ghost directives were never
        properly verified as indicated in BZ1395818. Resolved by applying a 0600
        attribute set for ghost initramfs entries.

Signed-off-by: Kyle Walker 
        Signed-off-by: Jan Stancek

Signed-off-by: Rafael Aquini 
    Signed-off-by: Herton R. Krzesinski

Signed-off-by: Herton R. Krzesinski

diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template
index blahblah..blahblah 100755
--- a/redhat/kernel.spec.template
+++ b/redhat/kernel.spec.template
@@ -2883,13 +2883,13 @@ fi
 /lib/modules/%{KVERREL}%{?3:+%{3}}/dtb \
 %ghost /%{image_install_path}/dtb-%{KVERREL}%{?3:+%{3}} \
 %endif\
-%attr(600,root,root) /lib/modules/%{KVERREL}%{?3:+%{3}}/System.map\
-%ghost /boot/System.map-%{KVERREL}%{?3:+%{3}}\
+%attr(0600, root, root) /lib/modules/%{KVERREL}%{?3:+%{3}}/System.map\
+%ghost %attr(0600, root, root) /boot/System.map-%{KVERREL}%{?3:+%{3}}\
 /lib/modules/%{KVERREL}%{?3:+%{3}}/symvers.gz\
 /lib/modules/%{KVERREL}%{?3:+%{3}}/config\
-%ghost /boot/symvers-%{KVERREL}%{?3:+%{3}}.gz\
-%ghost /boot/config-%{KVERREL}%{?3:+%{3}}\
-%ghost /boot/initramfs-%{KVERREL}%{?3:+%{3}}.img\
+%ghost %attr(0600, root, root) /boot/symvers-%{KVERREL}%{?3:+%{3}}.gz\
+%ghost %attr(0600, root, root) /boot/initramfs-%{KVERREL}%{?3:+%{3}}.img\
+%ghost %attr(0644, root, root) /boot/config-%{KVERREL}%{?3:+%{3}}\
 %dir /lib/modules\
 %dir /lib/modules/%{KVERREL}%{?3:+%{3}}\
 %dir /lib/modules/%{KVERREL}%{?3:+%{3}}/kernel\

--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1268

[Don Zickus (via Email Bridge)]

From: Don Zickus on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/1268#note_6335546...

Acked-by: Don Zickus 
(via approve button)