Skip to content

Commit b5ee18e

Browse files
committed
Merge branch '3.0-dev' into 3.0
2 parents 6a3673d + 47e1479 commit b5ee18e

61 files changed

Lines changed: 16579 additions & 66 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

LICENSES-AND-NOTICES/SPECS/data/licenses.json

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2256,6 +2256,7 @@
22562256
"kata-packages-uvm",
22572257
"keda",
22582258
"keras",
2259+
"kernel-64k-signed",
22592260
"kernel-signed",
22602261
"kernel-uki",
22612262
"kernel-uki-signed",
@@ -2753,6 +2754,7 @@
27532754
"kbd",
27542755
"keepalived",
27552756
"kernel",
2757+
"kernel-64k",
27562758
"kernel-headers",
27572759
"kernel-mshv",
27582760
"kernel-rt",
Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
%global debug_package %{nil}
2+
%global sha512hmac bash %{_sourcedir}/sha512hmac-openssl.sh
3+
%ifarch aarch64
4+
%global buildarch aarch64
5+
%endif
6+
%define uname_r %{version}-%{release}
7+
Summary: Signed Linux Kernel for %{buildarch} systems
8+
Name: kernel-64k-signed-%{buildarch}
9+
Version: 6.6.57.1
10+
Release: 5%{?dist}
11+
License: GPLv2
12+
Vendor: Microsoft Corporation
13+
Distribution: Azure Linux
14+
Group: System Environment/Kernel
15+
URL: https://github.com/microsoft/CBL-Mariner-Linux-Kernel
16+
# This package's "version" and "release" must reflect the unsigned version that
17+
# was signed.
18+
# An important consequence is that when making a change to this package, the
19+
# unsigned version/release must be increased to keep the two versions consistent.
20+
# Ideally though, this spec will not change much or at all, so the version will
21+
# just track the unsigned package's version/release.
22+
#
23+
# To populate these sources:
24+
# 1. Build the unsigned packages as normal
25+
# 2. Sign the desired binary
26+
# 3. Place the unsigned package and signed binary in this spec's folder
27+
# 4. Build this spec
28+
Source0: kernel-64k-%{version}-%{release}.%{buildarch}.rpm
29+
Source1: vmlinuz-%{uname_r}
30+
Source2: sha512hmac-openssl.sh
31+
BuildRequires: cpio
32+
BuildRequires: grub2-rpm-macros
33+
BuildRequires: openssl
34+
BuildRequires: sed
35+
%{?grub2_configuration_requires}
36+
37+
%description
38+
This package contains the Linux kernel package with kernel signed with the production key
39+
40+
%package -n kernel-64k
41+
Summary: Linux Kernel
42+
Group: System Environment/Kernel
43+
Requires: filesystem
44+
Requires: kmod
45+
Requires(post): coreutils
46+
Requires(postun): coreutils
47+
48+
%description -n kernel-64k
49+
The kernel package contains the signed Linux kernel.
50+
51+
%prep
52+
53+
%build
54+
mkdir rpm_contents
55+
pushd rpm_contents
56+
57+
# This spec's whole purpose is to inject the signed kernel binary
58+
rpm2cpio %{SOURCE0} | cpio -idmv
59+
cp %{SOURCE1} ./boot/vmlinuz-%{uname_r}
60+
61+
popd
62+
63+
%install
64+
pushd rpm_contents
65+
66+
# Don't use * wildcard. It does not copy over hidden files in the root folder...
67+
cp -rp ./. %{buildroot}/
68+
69+
popd
70+
71+
# Recalculate sha512hmac for FIPS
72+
%{sha512hmac} %{buildroot}/boot/vmlinuz-%{uname_r} | sed -e "s,$RPM_BUILD_ROOT,," > %{buildroot}/boot/.vmlinuz-%{uname_r}.hmac
73+
cp %{buildroot}/boot/.vmlinuz-%{uname_r}.hmac %{buildroot}/lib/modules/%{uname_r}/.vmlinuz.hmac
74+
75+
%triggerin -n kernel-64k -- initramfs
76+
mkdir -p %{_localstatedir}/lib/rpm-state/initramfs/pending
77+
touch %{_localstatedir}/lib/rpm-state/initramfs/pending/%{uname_r}
78+
echo "initrd generation of kernel %{uname_r} will be triggered later" >&2
79+
80+
%triggerun -n kernel-64k -- initramfs
81+
rm -rf %{_localstatedir}/lib/rpm-state/initramfs/pending/%{uname_r}
82+
rm -rf /boot/initramfs-%{uname_r}.img
83+
echo "initrd of kernel %{uname_r} removed" >&2
84+
85+
%postun -n kernel-64k
86+
%grub2_postun
87+
88+
%post -n kernel-64k
89+
/sbin/depmod -a %{uname_r}
90+
%grub2_post
91+
92+
%files -n kernel-64k
93+
%defattr(-,root,root)
94+
%license COPYING
95+
/boot/System.map-%{uname_r}
96+
/boot/config-%{uname_r}
97+
/boot/vmlinuz-%{uname_r}
98+
/boot/.vmlinuz-%{uname_r}.hmac
99+
%defattr(0644,root,root)
100+
/lib/modules/%{uname_r}/*
101+
/lib/modules/%{uname_r}/.vmlinuz.hmac
102+
%exclude /lib/modules/%{uname_r}/build
103+
%exclude /lib/modules/%{uname_r}/kernel/drivers/gpu
104+
%exclude /lib/modules/%{uname_r}/kernel/sound
105+
%exclude /module_info.ld
106+
107+
%changelog
108+
* Thu Nov 07 2024 Rachel Menge <rachelmenge@microsoft.com> - 6.6.57.1-5
109+
- Original version for Azure Linux
110+
- Starting with release 5 to align with kernel release.
111+
- License verified
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
3+
# Mocks sha512hmac using the openssl tool.
4+
# Only for use during RPM build.
5+
6+
openssl sha512 -hmac FIPS-FTW-RHT2009 -hex "$1" | cut -f 2 -d ' ' | echo "$(cat -) $1"

SPECS-SIGNED/kernel-signed/kernel-signed.spec

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
Summary: Signed Linux Kernel for %{buildarch} systems
1111
Name: kernel-signed-%{buildarch}
1212
Version: 6.6.57.1
13-
Release: 4%{?dist}
13+
Release: 5%{?dist}
1414
License: GPLv2
1515
Vendor: Microsoft Corporation
1616
Distribution: Azure Linux
@@ -145,6 +145,9 @@ echo "initrd of kernel %{uname_r} removed" >&2
145145
%exclude /module_info.ld
146146

147147
%changelog
148+
* Mon Nov 25 2024 Chris Co <chrco@microsoft.com> - 6.6.57.1-5
149+
- Bump release to match kernel
150+
148151
* Wed Nov 06 2024 Suresh Babu Chalamalasetty <schalam@microsoft.com> - 6.6.57.1-4
149152
- Bump release to match kernel
150153

SPECS-SIGNED/kernel-uki-signed/kernel-uki-signed.spec

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
Summary: Signed Unified Kernel Image for %{buildarch} systems
77
Name: kernel-uki-signed-%{buildarch}
88
Version: 6.6.57.1
9-
Release: 4%{?dist}
9+
Release: 5%{?dist}
1010
License: GPLv2
1111
Vendor: Microsoft Corporation
1212
Distribution: Azure Linux
@@ -68,6 +68,9 @@ popd
6868
/boot/efi/EFI/Linux/vmlinuz-uki-%{kernelver}.efi
6969

7070
%changelog
71+
* Mon Nov 25 2024 Chris Co <chrco@microsoft.com> - 6.6.57.1-5
72+
- Bump release to match kernel
73+
7174
* Wed Nov 06 2024 Suresh Babu Chalamalasetty <schalam@microsoft.com> - 6.6.57.1-4
7275
- Bump release to match kernel
7376

SPECS/cf-cli/CVE-2024-24786.patch

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
From 1576982839ab9771784526720ed0a2f4a2aa2280 Mon Sep 17 00:00:00 2001
2+
From: bala <balakumaran.kannan@microsoft.com>
3+
Date: Mon, 25 Nov 2024 16:47:53 +0000
4+
Subject: [PATCH] Vendor patch applied
5+
6+
---
7+
.../protobuf/encoding/protojson/decode.go | 12 ++++
8+
.../encoding/protojson/well_known_types.go | 59 +++++++------------
9+
.../protobuf/internal/encoding/json/decode.go | 2 +-
10+
3 files changed, 33 insertions(+), 40 deletions(-)
11+
12+
diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/decode.go b/vendor/google.golang.org/protobuf/encoding/protojson/decode.go
13+
index 5f28148..67fe4e7 100644
14+
--- a/vendor/google.golang.org/protobuf/encoding/protojson/decode.go
15+
+++ b/vendor/google.golang.org/protobuf/encoding/protojson/decode.go
16+
@@ -11,6 +11,7 @@ import (
17+
"strconv"
18+
"strings"
19+
20+
+ "google.golang.org/protobuf/encoding/protowire"
21+
"google.golang.org/protobuf/internal/encoding/json"
22+
"google.golang.org/protobuf/internal/encoding/messageset"
23+
"google.golang.org/protobuf/internal/errors"
24+
@@ -47,6 +48,10 @@ type UnmarshalOptions struct {
25+
protoregistry.MessageTypeResolver
26+
protoregistry.ExtensionTypeResolver
27+
}
28+
+
29+
+ // RecursionLimit limits how deeply messages may be nested.
30+
+ // If zero, a default limit is applied.
31+
+ RecursionLimit int
32+
}
33+
34+
// Unmarshal reads the given []byte and populates the given proto.Message
35+
@@ -67,6 +72,9 @@ func (o UnmarshalOptions) unmarshal(b []byte, m proto.Message) error {
36+
if o.Resolver == nil {
37+
o.Resolver = protoregistry.GlobalTypes
38+
}
39+
+ if o.RecursionLimit == 0 {
40+
+ o.RecursionLimit = protowire.DefaultRecursionLimit
41+
+ }
42+
43+
dec := decoder{json.NewDecoder(b), o}
44+
if err := dec.unmarshalMessage(m.ProtoReflect(), false); err != nil {
45+
@@ -114,6 +122,10 @@ func (d decoder) syntaxError(pos int, f string, x ...interface{}) error {
46+
47+
// unmarshalMessage unmarshals a message into the given protoreflect.Message.
48+
func (d decoder) unmarshalMessage(m protoreflect.Message, skipTypeURL bool) error {
49+
+ d.opts.RecursionLimit--
50+
+ if d.opts.RecursionLimit < 0 {
51+
+ return errors.New("exceeded max recursion depth")
52+
+ }
53+
if unmarshal := wellKnownTypeUnmarshaler(m.Descriptor().FullName()); unmarshal != nil {
54+
return unmarshal(d, m)
55+
}
56+
diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
57+
index 6c37d41..4b177c8 100644
58+
--- a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
59+
+++ b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
60+
@@ -176,7 +176,7 @@ func (d decoder) unmarshalAny(m protoreflect.Message) error {
61+
// Use another decoder to parse the unread bytes for @type field. This
62+
// avoids advancing a read from current decoder because the current JSON
63+
// object may contain the fields of the embedded type.
64+
- dec := decoder{d.Clone(), UnmarshalOptions{}}
65+
+ dec := decoder{d.Clone(), UnmarshalOptions{RecursionLimit: d.opts.RecursionLimit}}
66+
tok, err := findTypeURL(dec)
67+
switch err {
68+
case errEmptyObject:
69+
@@ -308,48 +308,29 @@ Loop:
70+
// array) in order to advance the read to the next JSON value. It relies on
71+
// the decoder returning an error if the types are not in valid sequence.
72+
func (d decoder) skipJSONValue() error {
73+
- tok, err := d.Read()
74+
- if err != nil {
75+
- return err
76+
- }
77+
- // Only need to continue reading for objects and arrays.
78+
- switch tok.Kind() {
79+
- case json.ObjectOpen:
80+
- for {
81+
- tok, err := d.Read()
82+
- if err != nil {
83+
- return err
84+
- }
85+
- switch tok.Kind() {
86+
- case json.ObjectClose:
87+
- return nil
88+
- case json.Name:
89+
- // Skip object field value.
90+
- if err := d.skipJSONValue(); err != nil {
91+
- return err
92+
- }
93+
- }
94+
+ var open int
95+
+ for {
96+
+ tok, err := d.Read()
97+
+ if err != nil {
98+
+ return err
99+
}
100+
-
101+
- case json.ArrayOpen:
102+
- for {
103+
- tok, err := d.Peek()
104+
- if err != nil {
105+
- return err
106+
- }
107+
- switch tok.Kind() {
108+
- case json.ArrayClose:
109+
- d.Read()
110+
- return nil
111+
- default:
112+
- // Skip array item.
113+
- if err := d.skipJSONValue(); err != nil {
114+
- return err
115+
- }
116+
+ switch tok.Kind() {
117+
+ case json.ObjectClose, json.ArrayClose:
118+
+ open--
119+
+ case json.ObjectOpen, json.ArrayOpen:
120+
+ open++
121+
+ if open > d.opts.RecursionLimit {
122+
+ return errors.New("exceeded max recursion depth")
123+
}
124+
+ case json.EOF:
125+
+ // This can only happen if there's a bug in Decoder.Read.
126+
+ // Avoid an infinite loop if this does happen.
127+
+ return errors.New("unexpected EOF")
128+
+ }
129+
+ if open == 0 {
130+
+ return nil
131+
}
132+
}
133+
- return nil
134+
}
135+
136+
// unmarshalAnyValue unmarshals the given custom-type message from the JSON
137+
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
138+
index d043a6e..d2b3ac0 100644
139+
--- a/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
140+
+++ b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
141+
@@ -121,7 +121,7 @@ func (d *Decoder) Read() (Token, error) {
142+
143+
case ObjectClose:
144+
if len(d.openStack) == 0 ||
145+
- d.lastToken.kind == comma ||
146+
+ d.lastToken.kind&(Name|comma) != 0 ||
147+
d.openStack[len(d.openStack)-1] != ObjectOpen {
148+
return Token{}, d.newSyntaxError(tok.pos, unexpectedFmt, tok.RawString())
149+
}
150+
--
151+
2.39.4
152+

SPECS/cf-cli/cf-cli.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Summary: The official command line client for Cloud Foundry.
55
Name: cf-cli
66
# Note: Upgrading the package also warrants an upgrade in the CF_BUILD_SHA
77
Version: 8.7.3
8-
Release: 2%{?dist}
8+
Release: 3%{?dist}
99
License: Apache-2.0
1010
Vendor: Microsoft Corporation
1111
Distribution: Azure Linux
@@ -32,6 +32,7 @@ Source0: https://github.com/cloudfoundry/cli/archive/refs/tags/v%{version
3232
# - For the value of "--mtime" use the date "2021-04-26 00:00Z" to simplify future updates.
3333
Source1: cli-%{version}-vendor.tar.gz
3434
Patch0: CVE-2023-39325.patch
35+
Patch1: CVE-2024-24786.patch
3536

3637
BuildRequires: golang >= 1.18.3
3738
%global debug_package %{nil}
@@ -44,6 +45,7 @@ The official command line client for Cloud Foundry.
4445
%setup -q -n cli-%{version}
4546
tar --no-same-owner -xf %{SOURCE1}
4647
%patch 0 -p1
48+
%patch 1 -p1
4749

4850
%build
4951
export GOPATH=%{our_gopath}
@@ -65,6 +67,9 @@ install -p -m 755 -t %{buildroot}%{_bindir} ./out/cf
6567
%{_bindir}/cf
6668

6769
%changelog
70+
* Mon Nov 25 2024 Bala <balakumaran.kannan@microsoft.com> - 8.7.3-3
71+
- Fix CVE-2024-24786
72+
6873
* Mon Jul 29 2024 Muhammad Falak <mwani@microsoft.com> - 8.7.3-2
6974
- Fix CF_BUILD_SHA to have correct build sha in the binary
7075
- Move Source1 un-taring in prep section

0 commit comments

Comments
 (0)