ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2024-12-19 21:17:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
master
heads/modules/util-linux

44 lines
1.1 KiB
Makefile
Raw Permalink Normal View History

Build lvm command line utility (issue #80) Replace libuuid with util-linux libuuid (and libblkid, although we are not using libblkid right now). This also requires a much larger coreboot cbfs, which was fixed as part of issue #154.
2017-04-03 21:13:59 +00:00
modules-$(CONFIG_UTIL_LINUX) += util-linux
cryptsetup2 toolstack version bump and script fixes to support multi-LUKS containers (BTRFS QubesOS 4.2) cryptsetup2 2.6.1 is a new release that supports reencryption of Q4.2 release LUKS2 volumes created at installation. This is a critical feature for the Qubes OS 4.2 release for added data at rest protection Cryptsetup 2.6.x internal changes: - Argon2 used externally and internally: requires a lot of RAM and CPU to derivate passphrase to key validated in key slots. - This is used to rate limit efficiently bruteforcing of LUKS key slots, requiring each offline brute force attempt to consume ~15-30 seconds per attempt - OF course, strong passphrases are still recommended, but bruteforcing LUKSv2 containers with Argon2 would require immense time, ram and CPU even to bruteforce low entropy passphrase/PINs. - passphrase change doesn't permit LUKS key slot specification anymore: key slot rotates (new one consusumed per op: then old one wiped internally. EG: LUKS key slot 1 created, then 0 deleted) - reencryption doesn't permit old call arguments. No more direct-io; inadmissively slow through AIO (async) calls, need workarounds for good enough perfs (arguments + newer kernel with cloudfare fixes in tree) cryptsetup 2.6.1 requires: - lvm2 2.03.23, which is also included in this PR. - requires libaio, which is also included in this PR (could be hacked out but deep dependency at first sight: left in) - requires util-linux 2.39 - patches for reproducible builds are included for above 3 packages. luks-functions was updated to support the new cryptsetup2 version calls/changes - reencryption happen in direct-io, offline mode and without locking, requiring linux 5.10.9+ to bypass linux queues - from tests, this is best for performance and reliability in single-user mode - LUKS container ops now validate Disk Recovery Key (DRK) passphrase prior and DRK key slot prior of going forward if needed, failing early. - Heads don't expect DRK to be in static key slot anymore, and finds the DRK key slot dynamically. - If reencrytipn/passphrase change: make sure all LUKS containers on same block device can be unlocked with same DRK - Reencryption: requires to know which key slot to reencrypt. - Find LUKS key slot that unlocks with DRK passphrase unlock prior of reencrypt call - Passphrase change: no slot can be passed, but key slot of DRK rotates. kexec-seal-key - TPM LUKS Disk Unlock Key key slots have changed to be set in max slots per LUKS version (LUKSv1:7 /LUKSv2: 31) - If key slot != default LUKS version's keyslot outside of DRK key slot: prompt the user before wiping that key slot, otherwise wipe automatically - This takes for granted that the DRK key slot alone is needed on the system and Heads controls the LUKS key slots. - If user has something else going on, ie: Using USB Security dongle + TPM DUK, then the user will need to say no when wiping keys. - It was suggested to leave LUKS key slots outside of DRK alone, but then: what to do when all key slots would be used? - Alternative implementation could be to only prompt users to wipe keyslots other then DRK when key slots are all used (LUKSv1: 0-7, LUKSv2: 0-31) - But then cleanup would need to happen prior of operations (LUKS passphrase change, TPM DUK setup) and could be problematic. - LUKS containers now checked to be same LUKS version prior of permitting to set TPM DUK and will refuse to go forward of different versions. TODO: - async (AIO) calls are not used. direct-io is used instead. libaio could be hacked out - this could be subject to future work Notes: - time to deprecated legacy boards the do not enough space for the new space requirements - x230-legacy, x230-legacy-flash, x230-hotp-legacy - t430-legacy, t430-legacy-flash, t430-hotp-legacy already deprecated Unrelated: - typos fixes found along the way Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-08-16 19:20:11 +00:00
util-linux_version := 2.39
Build lvm command line utility (issue #80) Replace libuuid with util-linux libuuid (and libblkid, although we are not using libblkid right now). This also requires a much larger coreboot cbfs, which was fixed as part of issue #154.
2017-04-03 21:13:59 +00:00
util-linux_dir := util-linux-$(util-linux_version)
util-linux_tar := util-linux-$(util-linux_version).tar.xz
cryptsetup2 toolstack version bump and script fixes to support multi-LUKS containers (BTRFS QubesOS 4.2) cryptsetup2 2.6.1 is a new release that supports reencryption of Q4.2 release LUKS2 volumes created at installation. This is a critical feature for the Qubes OS 4.2 release for added data at rest protection Cryptsetup 2.6.x internal changes: - Argon2 used externally and internally: requires a lot of RAM and CPU to derivate passphrase to key validated in key slots. - This is used to rate limit efficiently bruteforcing of LUKS key slots, requiring each offline brute force attempt to consume ~15-30 seconds per attempt - OF course, strong passphrases are still recommended, but bruteforcing LUKSv2 containers with Argon2 would require immense time, ram and CPU even to bruteforce low entropy passphrase/PINs. - passphrase change doesn't permit LUKS key slot specification anymore: key slot rotates (new one consusumed per op: then old one wiped internally. EG: LUKS key slot 1 created, then 0 deleted) - reencryption doesn't permit old call arguments. No more direct-io; inadmissively slow through AIO (async) calls, need workarounds for good enough perfs (arguments + newer kernel with cloudfare fixes in tree) cryptsetup 2.6.1 requires: - lvm2 2.03.23, which is also included in this PR. - requires libaio, which is also included in this PR (could be hacked out but deep dependency at first sight: left in) - requires util-linux 2.39 - patches for reproducible builds are included for above 3 packages. luks-functions was updated to support the new cryptsetup2 version calls/changes - reencryption happen in direct-io, offline mode and without locking, requiring linux 5.10.9+ to bypass linux queues - from tests, this is best for performance and reliability in single-user mode - LUKS container ops now validate Disk Recovery Key (DRK) passphrase prior and DRK key slot prior of going forward if needed, failing early. - Heads don't expect DRK to be in static key slot anymore, and finds the DRK key slot dynamically. - If reencrytipn/passphrase change: make sure all LUKS containers on same block device can be unlocked with same DRK - Reencryption: requires to know which key slot to reencrypt. - Find LUKS key slot that unlocks with DRK passphrase unlock prior of reencrypt call - Passphrase change: no slot can be passed, but key slot of DRK rotates. kexec-seal-key - TPM LUKS Disk Unlock Key key slots have changed to be set in max slots per LUKS version (LUKSv1:7 /LUKSv2: 31) - If key slot != default LUKS version's keyslot outside of DRK key slot: prompt the user before wiping that key slot, otherwise wipe automatically - This takes for granted that the DRK key slot alone is needed on the system and Heads controls the LUKS key slots. - If user has something else going on, ie: Using USB Security dongle + TPM DUK, then the user will need to say no when wiping keys. - It was suggested to leave LUKS key slots outside of DRK alone, but then: what to do when all key slots would be used? - Alternative implementation could be to only prompt users to wipe keyslots other then DRK when key slots are all used (LUKSv1: 0-7, LUKSv2: 0-31) - But then cleanup would need to happen prior of operations (LUKS passphrase change, TPM DUK setup) and could be problematic. - LUKS containers now checked to be same LUKS version prior of permitting to set TPM DUK and will refuse to go forward of different versions. TODO: - async (AIO) calls are not used. direct-io is used instead. libaio could be hacked out - this could be subject to future work Notes: - time to deprecated legacy boards the do not enough space for the new space requirements - x230-legacy, x230-legacy-flash, x230-hotp-legacy - t430-legacy, t430-legacy-flash, t430-hotp-legacy already deprecated Unrelated: - typos fixes found along the way Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-08-16 19:20:11 +00:00
util-linux_url := https://www.kernel.org/pub/linux/utils/util-linux/v2.39/$(util-linux_tar)
util-linux_hash := 32b30a336cda903182ed61feb3e9b908b762a5e66fe14e43efb88d37162075cb
Build lvm command line utility (issue #80) Replace libuuid with util-linux libuuid (and libblkid, although we are not using libblkid right now). This also requires a much larger coreboot cbfs, which was fixed as part of issue #154.
2017-04-03 21:13:59 +00:00
Pass -O3 and -O2 (optimize for speed) to -Os (Optimize for space) Adresses @easrentai suggestion to pass modules build optimization for space here: #590 (comment) - Uniformized module's $(CROSS_TOOLS) being passed as environment variable, prior of ./configure call Doesn't work for: - busybox (HOSTCXXFLAGS="-Os" attempted prior of ./configure call) - zlib (CFLAGS="-Os" attempted prior of ./configure call) - npth (CFLAGS="-Os" attempted prior of ./configure call)
2023-03-01 16:12:46 +00:00
util-linux_configure := \
Define $(CROSS_TOOLS) to ensure reproducible builds (issue #173) Each of the submodule configuration files defined a subset of the cross compiler tools that it used and many were picking up the system `ar`, `nm`, `strip, `ld`, etc. They all now use a `Makefile` macro that defines the path to the proper cross compiler tools. For ones that need the tools, but not the musl-libc gcc, there is $(CROSS_TOOLS_NOCC) that is all of them without gcc. This is for musl-libc itself, as well as xen and the Linux kernel.
2017-04-08 17:23:34 +00:00
$(CROSS_TOOLS) \
Pass -O3 and -O2 (optimize for speed) to -Os (Optimize for space) Adresses @easrentai suggestion to pass modules build optimization for space here: #590 (comment) - Uniformized module's $(CROSS_TOOLS) being passed as environment variable, prior of ./configure call Doesn't work for: - busybox (HOSTCXXFLAGS="-Os" attempted prior of ./configure call) - zlib (CFLAGS="-Os" attempted prior of ./configure call) - npth (CFLAGS="-Os" attempted prior of ./configure call)
2023-03-01 16:12:46 +00:00
CFLAGS="-Os" \
./configure \
Support targeting PowerPC 64 This prepares most of the modules to be build for it. Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2021-07-18 17:34:20 +00:00
--host $(MUSL_ARCH)-elf-linux \
Define $(CROSS_TOOLS) to ensure reproducible builds (issue #173) Each of the submodule configuration files defined a subset of the cross compiler tools that it used and many were picking up the system `ar`, `nm`, `strip, `ld`, etc. They all now use a `Makefile` macro that defines the path to the proper cross compiler tools. For ones that need the tools, but not the musl-libc gcc, there is $(CROSS_TOOLS_NOCC) that is all of them without gcc. This is for musl-libc itself, as well as xen and the Linux kernel.
2017-04-08 17:23:34 +00:00
--prefix "/" \
Build lvm command line utility (issue #80) Replace libuuid with util-linux libuuid (and libblkid, although we are not using libblkid right now). This also requires a much larger coreboot cbfs, which was fixed as part of issue #154.
2017-04-03 21:13:59 +00:00
--oldincludedir "$(INSTALL)/include" \
modules: minor refactor/tweaks Just some minor clean ups like fixing whitespace and sorting things. I added (bash)/removed (libusb) white space in order to look like the other modules. I sorted the --enable/--disable/--with blocks so that common stuff looked similar which should aid in comparing modules. I also removed a couple of duplicate config options (--disable-fallback-curses & --disable-regex). Signed-off-by: Manuel Mendez <github@i.m.mmlb.dev> Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-29 03:55:11 +00:00
--disable-all-programs \
--disable-bash-completion \
--enable-agetty \
--enable-libblkid \
--enable-libuuid \
Build lvm command line utility (issue #80) Replace libuuid with util-linux libuuid (and libblkid, although we are not using libblkid right now). This also requires a much larger coreboot cbfs, which was fixed as part of issue #154.
2017-04-03 21:13:59 +00:00
--without-ncurses \
--without-ncursesw \
modules: minor refactor/tweaks Just some minor clean ups like fixing whitespace and sorting things. I added (bash)/removed (libusb) white space in order to look like the other modules. I sorted the --enable/--disable/--with blocks so that common stuff looked similar which should aid in comparing modules. I also removed a couple of duplicate config options (--disable-fallback-curses & --disable-regex). Signed-off-by: Manuel Mendez <github@i.m.mmlb.dev> Signed-off-by: Thierry Laurion <insurgo@riseup.net>
2024-01-29 03:55:11 +00:00
--without-python \
Build lvm command line utility (issue #80) Replace libuuid with util-linux libuuid (and libblkid, although we are not using libblkid right now). This also requires a much larger coreboot cbfs, which was fixed as part of issue #154.
2017-04-03 21:13:59 +00:00
--without-tinfo \
--without-udev \
util-linux_target := \
Define $(CROSS_TOOLS) to ensure reproducible builds (issue #173) Each of the submodule configuration files defined a subset of the cross compiler tools that it used and many were picking up the system `ar`, `nm`, `strip, `ld`, etc. They all now use a `Makefile` macro that defines the path to the proper cross compiler tools. For ones that need the tools, but not the musl-libc gcc, there is $(CROSS_TOOLS_NOCC) that is all of them without gcc. This is for musl-libc itself, as well as xen and the Linux kernel.
2017-04-08 17:23:34 +00:00
$(MAKE_JOBS) \
$(CROSS_TOOLS) \
DESTDIR="$(INSTALL)" \
[WIP] cross build json-c and cryptsetup
2020-10-22 11:16:00 +00:00
install && \
rm $(INSTALL)/lib/libblkid.la && \
rm $(INSTALL)/lib/libuuid.la
Build lvm command line utility (issue #80) Replace libuuid with util-linux libuuid (and libblkid, although we are not using libblkid right now). This also requires a much larger coreboot cbfs, which was fixed as part of issue #154.
2017-04-03 21:13:59 +00:00
Fix build issue * use --libdir to fix issue with .la files which had //lib as lib folder * add libblkid as library
2020-06-16 08:29:01 +00:00
util-linux_libraries += \
.libs/libuuid.so.1 \
.libs/libblkid.so.1 \
Build lvm command line utility (issue #80) Replace libuuid with util-linux libuuid (and libblkid, although we are not using libblkid right now). This also requires a much larger coreboot cbfs, which was fixed as part of issue #154.
2017-04-03 21:13:59 +00:00
Build agetty from util-linux and optionally add it to initrd Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
2022-07-22 17:26:18 +00:00
util-linux_agetty-$(CONFIG_USE_AGETTY) := agetty
util-linux_output := $(util-linux_agetty-y)
Build lvm command line utility (issue #80) Replace libuuid with util-linux libuuid (and libblkid, although we are not using libblkid right now). This also requires a much larger coreboot cbfs, which was fixed as part of issue #154.
2017-04-03 21:13:59 +00:00
util-linux_depends := $(musl_dep)
Reference in New Issue Copy Permalink