[OS-BUILD PATCH] redhat/configs: Enable CONFIG_X86_KERNEL_IBT for Fedora and ARK

[Josh Poimboeuf (via Email Bridge)]

From: Josh Poimboeuf <jpoimboe(a)redhat.com&gt;

redhat/configs: Enable CONFIG_X86_KERNEL_IBT for Fedora and ARK

Kernel IBT is a nice kernel hardening feature with virtually no
performance impact.  Since commit 4fd5f70ce14d ("x86/Kconfig: Enable
kernel IBT by default"), its now enabled by default upstream.  Enable it
in Fedora and ARK as well.

Signed-off-by: Josh Poimboeuf <jpoimboe(a)redhat.com&gt;

diff --git a/redhat/configs/common/generic/x86/CONFIG_X86_KERNEL_IBT
b/redhat/configs/common/generic/x86/CONFIG_X86_KERNEL_IBT
index blahblah..blahblah 100644
--- a/redhat/configs/common/generic/x86/CONFIG_X86_KERNEL_IBT
+++ b/redhat/configs/common/generic/x86/CONFIG_X86_KERNEL_IBT
@@ -1 +1 @@
-# CONFIG_X86_KERNEL_IBT is not set
+CONFIG_X86_KERNEL_IBT=y

--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346

[Waiman Long (via Email Bridge)]

From: Waiman Long on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1298...

I think we should backport this IBT support to RHEL9. Hopefully we can do it
in 9.3 or 9.4.

[Patrick Talbert (via Email Bridge)]

From: Patrick Talbert on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1322...

This fails to build for x86_64: https://s3.amazonaws.com/arr-cki-prod-trusted-
artifacts/trusted-
artifacts/812113046/build%20x86_64/3967140915/artifacts/build.log

[Justin M. Forbes (via Email Bridge)]

From: Justin M. Forbes on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1322...

This seems unrelated

[Justin M. Forbes (via Email Bridge)]

From: Justin M. Forbes on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1322...

Verified with a local build, flipping this config item doesn't seem to break
things.

[Patrick Talbert (via Email Bridge)]

From: Patrick Talbert on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1327...

Hmm when I build this locally with the cki builder-rawhide image I get the
same error. I wonder if it somehow has the wrong libbpf version.
~~~
ptalbert@toolbox (builder_rawhide):~/git/gitlab/kernel-ark (mr2346-rebase)$
rpm -qa | grep libbpf
libbpf-1.1.0-2.fc38.x86_64
libbpf-devel-1.1.0-2.fc38.x86_64
~~~

[Justin M. Forbes (via Email Bridge)]

From: Justin M. Forbes on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1327...

Right, so this does seem to fail in rawhide, but not when built on f37. It
seems the version of dwarves (pahole) matters, and the newer pahole chokes.

[Josh Poimboeuf (via Email Bridge)]

From: Josh Poimboeuf on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1347...

This combination of newer toolchain with kernel IBT seems to be uncovering a
bug in the kernel's ELF note section alignment. I'm working on a fix to post
upstream.

[Patrick Talbert (via Email Bridge)]

From: Patrick Talbert on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1348...

The dwarves package was updated yesterday and the pipeline builder image has
picked it up so now the pipeline can successfully build the kernel with this
MR applied.

Are you saying there is some further problem that needs to be fixed before
this should be merged?

[Josh Poimboeuf (via Email Bridge)]

From: Josh Poimboeuf on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1348...

Hm, if I understand correctly the dwarves change is a workaround, whereas my
patch is fixing the root cause.  If it's working with the dwarves change then
I think it should be fine to merge this MR.

[Josh Poimboeuf (via Email Bridge)]

From: Josh Poimboeuf on gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2346#note_1352...

After more upstream discussion, the dwarves workaround looks good enough.  I
still have an upstream patch under review but it doesn't need to block this
MR.