Bug 1212835

On a second thought, the only way to fix this properly is to modify the script in Linus' tree. Have you sent a patch already, or should I do it?

If we patch it the source is no longer buildable on non-usrmerged system.

I suppose the fixup in rpm can be done both ways, and then rpm would build either way, and the expanded tree only on the distribution for which it is intended.

Patching the Linus three is probably premature.

The question is *how* to patch it.

I suppose using some PREFIX or INSTALL_PREFIX variable would be desirable (what does perf use, or does it support installation at all?) but even then current kmod upstream would only work with the variable unset.

We have a downstream kmod patch changing the hardcoded path, and using both would be problematic. Currently a module relative path as stored in modules.dep and elsewhere corresponds to exactly one file location, using multiple paths would break that.

Installation is not an issue. There is a symbolic link from /lib to /usr/lib. All we need is to create a similar link in scripts/depmod.sh. Something like this:

--- a/scripts/depmod.sh
+++ b/scripts/depmod.sh
@@ -27,7 +27,8 @@ fi
 # numbers, so we cheat with a symlink here
 depmod_hack_needed=true
 tmp_dir=$(mktemp -d ${TMPDIR:-/tmp}/depmod.XXXXXX)
-mkdir -p "$tmp_dir/lib/modules/$KERNELRELEASE"
+mkdir -p "$tmp_dir/usr/lib/modules/$KERNELRELEASE"
+ln -s usr/lib "$tmp_dir/lib"
 if "$DEPMOD" -b "$tmp_dir" $KERNELRELEASE 2>/dev/null; then
 	if test -e "$tmp_dir/lib/modules/$KERNELRELEASE/modules.dep" -o \
 		-e "$tmp_dir/lib/modules/$KERNELRELEASE/modules.dep.bin"; then

Whatever solution you use, please consider also users of INSTALL_MOD_PATH (i.e. me).

(`make INSTALL_MOD_PATH=$path modules_install` puts modules to $INSTALL_MOD_PATH/lib/modules (not $INSTALL_MOD_PATH/usr/lib/modules)

(In reply to Petr Tesařík from comment #4)
> Installation is not an issue. There is a symbolic link from /lib to
> /usr/lib. All we need is to create a similar link in scripts/depmod.sh.
> Something like this:
> 
> --- a/scripts/depmod.sh
> +++ b/scripts/depmod.sh
> @@ -27,7 +27,8 @@ fi
>  # numbers, so we cheat with a symlink here
>  depmod_hack_needed=true
>  tmp_dir=$(mktemp -d ${TMPDIR:-/tmp}/depmod.XXXXXX)
> -mkdir -p "$tmp_dir/lib/modules/$KERNELRELEASE"
> +mkdir -p "$tmp_dir/usr/lib/modules/$KERNELRELEASE"
> +ln -s usr/lib "$tmp_dir/lib"
>  if "$DEPMOD" -b "$tmp_dir" $KERNELRELEASE 2>/dev/null; then
>  	if test -e "$tmp_dir/lib/modules/$KERNELRELEASE/modules.dep" -o \
>  		-e "$tmp_dir/lib/modules/$KERNELRELEASE/modules.dep.bin"; then

That papers over the problem in the case the modules are not installed.

Nonetheless, for upstreamable patch the aim should be to support installing modules under an arbitrary prefix. Probably the prefix should be queried from kmod because kmod supports only one prefix, and the kernel needs to use that one supported prefix.

Actually there is no change needed for module build, only install.

Pushed the s,/lib/modules/,/usr/lib/modules/, change as patch, and it built all right in kbuild.

So here is an updated patchset for kmod https://github.com/hramrach/kmod/commits/master

MODULE_PREFIX="$(kmod config | jq .module_prefix)"

should set MODULE_PREFIX to the directory in which lib/modules is expected. It gives an error on unpatched kmod but the result is correct empty string either way.

This is an autogenerated message for OBS integration:
This bug (1212835) was mentioned in
https://build.opensuse.org/request/show/1096217 Factory / kmod

And the temporary workaround breaks kernel-source build because of rpmlint badness so I will add the MODULE_PREFIX right away although it relies on downstream kmod feature.

Please test that stuff builds correctly with MODULE_PREFIX (you will need jq on Tumbleweed/ALP).

Is TW the first distro to hit this (usrmerge isn't that novel) -- do you plan to post the kmod changes to upstream?

Until recently the kernel and kmod relied on the compatibility symlink to work on an usrmerged system, this makes it possible for the kernel to work without one.

Yes, I plan to post this upstream once it gets merged and the various testsuites and kernel modules are confirmed to work.

So the latest news is that kmod maintainer submitted revert of kmod changes to Factory, then kernel would not build in staging and the kernel maintainer would start reverting changes in the hope that it will fix something, and everything is completely messed up.

If you want to change the API between the kernel and kmod (such as by removing the usrmerge support from kmod) then also kindly submit the kernel changes to make the kernel work with your new version of kmod.

Also please describe your vision how usrmerge is going to be supported in kmod.

>Also please describe your vision how usrmerge is going to be supported in kmod.

Well certainly not by breaking the API. The linux kernel itself is known to, in general, revert patches that break public APIs.

The other angle in package maintenance is that every patch adds to the complexity multiplied by the time they have to be lugged around. {at, bash, rpm} are prime examples of such sad stories, and for some patches, you also have to answer to users why the program does not behave the same as upstream.

It's unpleasant that the submitted kmod revert actually broke our (supported) kernel in the ongoing submission. Perhaps it was fixing manually installed kernel (a non-supported one), but why we care more than about our kernel?

Someone care to fix the situation in kmod vs. kernel somehow? I unfortunately don't know what needs to be fixed here. And random reverts in both kernel (by me) and kmod do not help anything.

The current API is built around hardcoded /lib as the location for kernel modules.

Supporting usrmerge inevitably breaks that.

The patches as posted to kernel-source and kmod add support in a reasonably backwards-compatible way.

If you have better ideas how to solve the problem please share them by commenting here.

Also if you had concerns about the kmod patches you could raise them when they were first submitted to Factory, or after the fact by commenting here.

Reverting the patches and breaking the kernel build in the process is not the way to raise your concerns about the approach.

>why we care more than about our kernel?

Well because that's good practice, especially considering that, should I be making a patch for SUSE, I'd want to test it with vanilla too.

A backwards compatible way is to make kmod search multiple paths, not just one. Like $PATH perhaps.

(In reply to Jan Engelhardt from comment #22)

> A backwards compatible way is to make kmod search multiple paths, not just
> one. Like $PATH perhaps.

See Comment #3

Also supporting modules in /lib when we want to move modules away from /lib is an anti-feature.

SUSE-SU-2023:2803-1: An update that solves seven vulnerabilities, contains one feature and has 10 fixes can now be installed.

Category: security (important)
Bug References: 1187829, 1194869, 1210335, 1212051, 1212265, 1212603, 1212605, 1212606, 1212619, 1212701, 1212741, 1212835, 1212838, 1212842, 1212861, 1212869, 1212892
CVE References: CVE-2023-1829, CVE-2023-3090, CVE-2023-3111, CVE-2023-3212, CVE-2023-3357, CVE-2023-3358, CVE-2023-3389
Jira References: SLE-19253
Sources used:
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4-RT_Update_9-1-150400.1.3.1
SUSE Real Time Module 15-SP4 (src): kernel-source-rt-5.14.21-150400.15.40.1, kernel-syms-rt-5.14.21-150400.15.40.1
openSUSE Leap 15.4 (src): kernel-source-rt-5.14.21-150400.15.40.1, kernel-syms-rt-5.14.21-150400.15.40.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Should be fixed in 6.4.2 kernel.

Upstream patch submission https://lore.kernel.org/linux-modules/20230711153126.28876-1-msuchanek@suse.de/

SUSE-SU-2023:2820-1: An update that solves 16 vulnerabilities, contains two features and has 34 fixes can now be installed.

Category: security (important)
Bug References: 1065729, 1152472, 1152489, 1160435, 1187829, 1189998, 1194869, 1205758, 1208410, 1208600, 1209039, 1209367, 1210335, 1211299, 1211346, 1211387, 1211410, 1211449, 1211796, 1211852, 1212051, 1212129, 1212154, 1212155, 1212158, 1212265, 1212350, 1212448, 1212494, 1212495, 1212504, 1212513, 1212540, 1212561, 1212563, 1212564, 1212584, 1212592, 1212603, 1212605, 1212606, 1212619, 1212701, 1212741, 1212835, 1212838, 1212842, 1212861, 1212869, 1212892
CVE References: CVE-2023-1077, CVE-2023-1249, CVE-2023-1829, CVE-2023-21102, CVE-2023-3090, CVE-2023-3111, CVE-2023-3141, CVE-2023-3161, CVE-2023-3212, CVE-2023-3357, CVE-2023-3358, CVE-2023-3389, CVE-2023-35788, CVE-2023-35823, CVE-2023-35828, CVE-2023-35829
Jira References: PED-3931, SLE-19253
Sources used:
Basesystem Module 15-SP4 (src): kernel-default-base-5.14.21-150400.24.69.1.150400.24.31.1, kernel-source-5.14.21-150400.24.69.1
Development Tools Module 15-SP4 (src): kernel-syms-5.14.21-150400.24.69.1, kernel-obs-build-5.14.21-150400.24.69.1, kernel-source-5.14.21-150400.24.69.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4_Update_14-1-150400.9.3.1
openSUSE Leap Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.69.1.150400.24.31.1
openSUSE Leap 15.4 (src): kernel-obs-build-5.14.21-150400.24.69.1, kernel-source-5.14.21-150400.24.69.1, kernel-syms-5.14.21-150400.24.69.1, kernel-default-base-5.14.21-150400.24.69.1.150400.24.31.1, kernel-obs-qa-5.14.21-150400.24.69.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): kernel-default-base-5.14.21-150400.24.69.1.150400.24.31.1
SUSE Linux Enterprise Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.69.1.150400.24.31.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): kernel-default-base-5.14.21-150400.24.69.1.150400.24.31.1
SUSE Linux Enterprise Micro 5.4 (src): kernel-default-base-5.14.21-150400.24.69.1.150400.24.31.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

SUSE-SU-2023:2831-1: An update that solves 16 vulnerabilities, contains one feature and has 33 fixes can now be installed.

Category: security (important)
Bug References: 1065729, 1152472, 1152489, 1160435, 1187829, 1189998, 1194869, 1205758, 1208410, 1208600, 1209039, 1209367, 1210335, 1211299, 1211346, 1211387, 1211410, 1211796, 1211852, 1212051, 1212129, 1212154, 1212155, 1212158, 1212265, 1212350, 1212448, 1212494, 1212495, 1212504, 1212513, 1212540, 1212561, 1212563, 1212564, 1212584, 1212592, 1212603, 1212605, 1212606, 1212619, 1212701, 1212741, 1212835, 1212838, 1212842, 1212861, 1212869, 1212892
CVE References: CVE-2023-1077, CVE-2023-1249, CVE-2023-1829, CVE-2023-21102, CVE-2023-3090, CVE-2023-3111, CVE-2023-3141, CVE-2023-3161, CVE-2023-3212, CVE-2023-3357, CVE-2023-3358, CVE-2023-3389, CVE-2023-35788, CVE-2023-35823, CVE-2023-35828, CVE-2023-35829
Jira References: PED-3931
Sources used:
openSUSE Leap 15.4 (src): kernel-source-azure-5.14.21-150400.14.55.1, kernel-syms-azure-5.14.21-150400.14.55.1
Public Cloud Module 15-SP4 (src): kernel-source-azure-5.14.21-150400.14.55.1, kernel-syms-azure-5.14.21-150400.14.55.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

SUSE-SU-2023:2871-1: An update that solves 82 vulnerabilities, contains 25 features and has 390 fixes can now be installed.

Category: security (important)
Bug References: 1065729, 1109158, 1142685, 1152472, 1152489, 1155798, 1160435, 1166486, 1172073, 1174777, 1177529, 1186449, 1187829, 1189998, 1189999, 1191731, 1193629, 1194869, 1195175, 1195655, 1195921, 1196058, 1197534, 1197617, 1198101, 1198400, 1198438, 1198835, 1199304, 1199701, 1200054, 1202353, 1202633, 1203039, 1203200, 1203325, 1203331, 1203332, 1203693, 1203906, 1204356, 1204363, 1204662, 1204993, 1205153, 1205191, 1205205, 1205544, 1205650, 1205756, 1205758, 1205760, 1205762, 1205803, 1205846, 1206024, 1206036, 1206056, 1206057, 1206103, 1206224, 1206232, 1206340, 1206459, 1206492, 1206493, 1206552, 1206578, 1206640, 1206649, 1206677, 1206824, 1206843, 1206876, 1206877, 1206878, 1206880, 1206881, 1206882, 1206883, 1206884, 1206885, 1206886, 1206887, 1206888, 1206889, 1206890, 1206891, 1206893, 1206894, 1206935, 1206992, 1207034, 1207036, 1207050, 1207051, 1207088, 1207125, 1207149, 1207158, 1207168, 1207185, 1207270, 1207315, 1207328, 1207497, 1207500, 1207501, 1207506, 1207507, 1207521, 1207553, 1207560, 1207574, 1207588, 1207589, 1207590, 1207591, 1207592, 1207593, 1207594, 1207602, 1207603, 1207605, 1207606, 1207607, 1207608, 1207609, 1207610, 1207611, 1207612, 1207613, 1207614, 1207615, 1207616, 1207617, 1207618, 1207619, 1207620, 1207621, 1207622, 1207623, 1207624, 1207625, 1207626, 1207627, 1207628, 1207629, 1207630, 1207631, 1207632, 1207633, 1207634, 1207635, 1207636, 1207637, 1207638, 1207639, 1207640, 1207641, 1207642, 1207643, 1207644, 1207645, 1207646, 1207647, 1207648, 1207649, 1207650, 1207651, 1207652, 1207653, 1207734, 1207768, 1207769, 1207770, 1207771, 1207773, 1207795, 1207827, 1207842, 1207845, 1207875, 1207878, 1207933, 1207935, 1207948, 1208050, 1208076, 1208081, 1208105, 1208107, 1208128, 1208130, 1208149, 1208153, 1208183, 1208212, 1208219, 1208290, 1208368, 1208410, 1208420, 1208428, 1208429, 1208449, 1208534, 1208541, 1208542, 1208570, 1208588, 1208598, 1208599, 1208600, 1208601, 1208602, 1208604, 1208605, 1208607, 1208619, 1208628, 1208700, 1208741, 1208758, 1208759, 1208776, 1208777, 1208784, 1208787, 1208815, 1208816, 1208829, 1208837, 1208843, 1208845, 1208848, 1208864, 1208902, 1208948, 1208976, 1209008, 1209039, 1209052, 1209092, 1209159, 1209256, 1209258, 1209262, 1209287, 1209288, 1209290, 1209291, 1209292, 1209366, 1209367, 1209436, 1209457, 1209504, 1209532, 1209556, 1209600, 1209615, 1209635, 1209636, 1209637, 1209684, 1209687, 1209693, 1209739, 1209779, 1209780, 1209788, 1209798, 1209799, 1209804, 1209805, 1209856, 1209871, 1209927, 1209980, 1209982, 1209999, 1210034, 1210050, 1210158, 1210165, 1210202, 1210203, 1210206, 1210216, 1210230, 1210294, 1210301, 1210329, 1210335, 1210336, 1210337, 1210409, 1210439, 1210449, 1210450, 1210453, 1210454, 1210498, 1210506, 1210533, 1210551, 1210565, 1210584, 1210629, 1210644, 1210647, 1210725, 1210741, 1210762, 1210763, 1210764, 1210765, 1210766, 1210767, 1210768, 1210769, 1210770, 1210771, 1210775, 1210783, 1210791, 1210793, 1210806, 1210816, 1210817, 1210827, 1210853, 1210940, 1210943, 1210947, 1210953, 1210986, 1211014, 1211025, 1211037, 1211043, 1211044, 1211089, 1211105, 1211113, 1211131, 1211205, 1211263, 1211280, 1211281, 1211299, 1211346, 1211387, 1211400, 1211410, 1211414, 1211449, 1211465, 1211519, 1211564, 1211590, 1211592, 1211593, 1211595, 1211654, 1211686, 1211687, 1211688, 1211689, 1211690, 1211691, 1211692, 1211693, 1211714, 1211794, 1211796, 1211804, 1211807, 1211808, 1211820, 1211836, 1211847, 1211852, 1211855, 1211960, 1212051, 1212129, 1212154, 1212155, 1212158, 1212265, 1212350, 1212445, 1212448, 1212456, 1212494, 1212495, 1212504, 1212513, 1212540, 1212556, 1212561, 1212563, 1212564, 1212584, 1212592, 1212603, 1212605, 1212606, 1212619, 1212685, 1212701, 1212741, 1212835, 1212838, 1212842, 1212848, 1212861, 1212869, 1212892, 1212961, 1213010, 1213011, 1213012, 1213013, 1213014, 1213015, 1213016, 1213017, 1213018, 1213019, 1213020, 1213021, 1213024, 1213025, 1213032, 1213034, 1213035, 1213036, 1213037, 1213038, 1213039, 1213040, 1213041, 1213087, 1213088, 1213089, 1213090, 1213092, 1213093, 1213094, 1213095, 1213096, 1213098, 1213099, 1213100, 1213102, 1213103, 1213104, 1213105, 1213106, 1213107, 1213108, 1213109, 1213110, 1213111, 1213112, 1213113, 1213114, 1213116, 1213134
CVE References: CVE-2022-36280, CVE-2022-38096, CVE-2022-4269, CVE-2022-45884, CVE-2022-45885, CVE-2022-45886, CVE-2022-45887, CVE-2022-45919, CVE-2022-4744, CVE-2023-0045, CVE-2023-0122, CVE-2023-0179, CVE-2023-0394, CVE-2023-0461, CVE-2023-0469, CVE-2023-0590, CVE-2023-0597, CVE-2023-1075, CVE-2023-1076, CVE-2023-1077, CVE-2023-1079, CVE-2023-1095, CVE-2023-1118, CVE-2023-1249, CVE-2023-1382, CVE-2023-1513, CVE-2023-1582, CVE-2023-1583, CVE-2023-1611, CVE-2023-1637, CVE-2023-1652, CVE-2023-1670, CVE-2023-1829, CVE-2023-1838, CVE-2023-1855, CVE-2023-1989, CVE-2023-1998, CVE-2023-2002, CVE-2023-21102, CVE-2023-21106, CVE-2023-2124, CVE-2023-2156, CVE-2023-2162, CVE-2023-2176, CVE-2023-2235, CVE-2023-2269, CVE-2023-22998, CVE-2023-23000, CVE-2023-23001, CVE-2023-23004, CVE-2023-23006, CVE-2023-2430, CVE-2023-2483, CVE-2023-25012, CVE-2023-2513, CVE-2023-26545, CVE-2023-28327, CVE-2023-28410, CVE-2023-28464, CVE-2023-28866, CVE-2023-3006, CVE-2023-30456, CVE-2023-30772, CVE-2023-3090, CVE-2023-31084, CVE-2023-3111, CVE-2023-3141, CVE-2023-31436, CVE-2023-3161, CVE-2023-3212, CVE-2023-3220, CVE-2023-32233, CVE-2023-33288, CVE-2023-3357, CVE-2023-3358, CVE-2023-3389, CVE-2023-33951, CVE-2023-33952, CVE-2023-35788, CVE-2023-35823, CVE-2023-35828, CVE-2023-35829
Jira References: PED-1549, PED-3210, PED-3259, PED-3692, PED-370, PED-3750, PED-3759, PED-376, PED-3931, PED-4022, PED-835, SES-1880, SLE-18375, SLE-18377, SLE-18378, SLE-18379, SLE-18383, SLE-18384, SLE-18385, SLE-18978, SLE-18992, SLE-19001, SLE-19253, SLE-19255, SLE-19556
Sources used:
openSUSE Leap 15.5 (src): kernel-livepatch-SLE15-SP5_Update_1-1-150500.11.7.1, kernel-syms-5.14.21-150500.55.7.1, kernel-obs-qa-5.14.21-150500.55.7.1, kernel-obs-build-5.14.21-150500.55.7.1, kernel-source-5.14.21-150500.55.7.1, kernel-default-base-5.14.21-150500.55.7.1.150500.6.2.5
Basesystem Module 15-SP5 (src): kernel-source-5.14.21-150500.55.7.1, kernel-default-base-5.14.21-150500.55.7.1.150500.6.2.5
Development Tools Module 15-SP5 (src): kernel-source-5.14.21-150500.55.7.1, kernel-syms-5.14.21-150500.55.7.1, kernel-obs-build-5.14.21-150500.55.7.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_1-1-150500.11.7.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

SUSE-SU-2023:2892-1: An update that solves 15 vulnerabilities, contains one feature and has 85 fixes can now be installed.

Category: security (important)
Bug References: 1187829, 1189998, 1194869, 1205758, 1208410, 1209039, 1209780, 1210335, 1210565, 1210584, 1210853, 1211014, 1211346, 1211400, 1211410, 1211794, 1211852, 1212051, 1212265, 1212350, 1212405, 1212445, 1212448, 1212456, 1212494, 1212495, 1212504, 1212513, 1212540, 1212556, 1212561, 1212563, 1212564, 1212584, 1212592, 1212603, 1212605, 1212606, 1212619, 1212685, 1212701, 1212741, 1212835, 1212838, 1212842, 1212848, 1212861, 1212869, 1212892, 1212961, 1213010, 1213011, 1213012, 1213013, 1213014, 1213015, 1213016, 1213017, 1213018, 1213019, 1213020, 1213021, 1213024, 1213025, 1213032, 1213034, 1213035, 1213036, 1213037, 1213038, 1213039, 1213040, 1213041, 1213087, 1213088, 1213089, 1213090, 1213092, 1213093, 1213094, 1213095, 1213096, 1213098, 1213099, 1213100, 1213102, 1213103, 1213104, 1213105, 1213106, 1213107, 1213108, 1213109, 1213110, 1213111, 1213112, 1213113, 1213114, 1213116, 1213134
CVE References: CVE-2023-1249, CVE-2023-1829, CVE-2023-2430, CVE-2023-28866, CVE-2023-3090, CVE-2023-3111, CVE-2023-3212, CVE-2023-3220, CVE-2023-3357, CVE-2023-3358, CVE-2023-3389, CVE-2023-35788, CVE-2023-35823, CVE-2023-35828, CVE-2023-35829
Jira References: PED-3931
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-azure-5.14.21-150500.33.6.1, kernel-source-azure-5.14.21-150500.33.6.1
Public Cloud Module 15-SP5 (src): kernel-syms-azure-5.14.21-150500.33.6.1, kernel-source-azure-5.14.21-150500.33.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

2023-07-19 17:14:01 65a8ad3472873c84acb72e2b15eb6609 30-6.1         76  60

should have fixed it.

SUSE-SU-2023:3006-1: An update that solves three vulnerabilities and has 60 fixes can now be installed.

Category: security (important)
Bug References: 1150305, 1173438, 1202716, 1205496, 1207617, 1207620, 1207629, 1207630, 1207633, 1207634, 1207653, 1208788, 1210584, 1210765, 1210766, 1210771, 1211867, 1212301, 1212657, 1212741, 1212835, 1212871, 1212905, 1212986, 1212987, 1212988, 1212989, 1212990, 1213010, 1213011, 1213012, 1213013, 1213014, 1213015, 1213017, 1213018, 1213019, 1213020, 1213021, 1213022, 1213023, 1213024, 1213025, 1213032, 1213033, 1213034, 1213035, 1213036, 1213037, 1213038, 1213039, 1213040, 1213041, 1213042, 1213059, 1213133, 1213215, 1213218, 1213221, 1213286, 1213344, 1213346, 1213525
CVE References: CVE-2023-20593, CVE-2023-2985, CVE-2023-35001
Sources used:
SUSE Linux Enterprise Real Time 12 SP5 (src): kernel-source-rt-4.12.14-10.133.1, kernel-syms-rt-4.12.14-10.133.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

This is an autogenerated message for OBS integration:
This bug (1212835) was mentioned in
https://build.opensuse.org/request/show/1103741 Factory / kmod

SUSE-SU-2023:3302-1: An update that solves 28 vulnerabilities, contains two features and has 115 fixes can now be installed.

Category: security (important)
Bug References: 1150305, 1187829, 1193629, 1194869, 1206418, 1207129, 1207894, 1207948, 1208788, 1210335, 1210565, 1210584, 1210627, 1210780, 1210825, 1210853, 1211014, 1211131, 1211243, 1211738, 1211811, 1211867, 1212051, 1212256, 1212265, 1212301, 1212445, 1212456, 1212502, 1212525, 1212603, 1212604, 1212685, 1212766, 1212835, 1212838, 1212842, 1212846, 1212848, 1212861, 1212869, 1212892, 1212901, 1212905, 1212961, 1213010, 1213011, 1213012, 1213013, 1213014, 1213015, 1213016, 1213017, 1213018, 1213019, 1213020, 1213021, 1213024, 1213025, 1213032, 1213034, 1213035, 1213036, 1213037, 1213038, 1213039, 1213040, 1213041, 1213059, 1213061, 1213087, 1213088, 1213089, 1213090, 1213092, 1213093, 1213094, 1213095, 1213096, 1213098, 1213099, 1213100, 1213102, 1213103, 1213104, 1213105, 1213106, 1213107, 1213108, 1213109, 1213110, 1213111, 1213112, 1213113, 1213114, 1213116, 1213134, 1213167, 1213205, 1213206, 1213226, 1213233, 1213245, 1213247, 1213252, 1213258, 1213259, 1213263, 1213264, 1213272, 1213286, 1213287, 1213304, 1213417, 1213493, 1213523, 1213524, 1213533, 1213543, 1213578, 1213585, 1213586, 1213588, 1213601, 1213620, 1213632, 1213653, 1213705, 1213713, 1213715, 1213747, 1213756, 1213759, 1213777, 1213810, 1213812, 1213856, 1213857, 1213863, 1213867, 1213870, 1213871, 1213872
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-1829, CVE-2023-20569, CVE-2023-20593, CVE-2023-21400, CVE-2023-2156, CVE-2023-2166, CVE-2023-2430, CVE-2023-2985, CVE-2023-3090, CVE-2023-31083, CVE-2023-3111, CVE-2023-3117, CVE-2023-31248, CVE-2023-3212, CVE-2023-3268, CVE-2023-3389, CVE-2023-3390, CVE-2023-35001, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776, CVE-2023-3812, CVE-2023-38409, CVE-2023-3863, CVE-2023-4004
Jira References: PED-4718, PED-4758
Sources used:
openSUSE Leap 15.5 (src): kernel-livepatch-SLE15-SP5-RT_Update_3-1-150500.11.5.1, kernel-syms-rt-5.14.21-150500.13.11.1, kernel-source-rt-5.14.21-150500.13.11.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_3-1-150500.11.5.1
SUSE Real Time Module 15-SP5 (src): kernel-syms-rt-5.14.21-150500.13.11.1, kernel-source-rt-5.14.21-150500.13.11.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

See README.usrmerge in the Factory kmod package on information how to build the upstream kernel on Tumbleweed.

SUSE-SU-2023:3349-1: An update that solves 11 vulnerabilities and has 74 fixes can now be installed.

Category: security (important)
Bug References: 1087082, 1150305, 1173438, 1188885, 1202670, 1202716, 1205496, 1206418, 1207526, 1207528, 1207561, 1207617, 1207620, 1207629, 1207630, 1207633, 1207634, 1207653, 1208788, 1210584, 1210765, 1210766, 1210771, 1211738, 1211867, 1212266, 1212301, 1212657, 1212741, 1212835, 1212871, 1212905, 1212986, 1212987, 1212988, 1212989, 1212990, 1213010, 1213011, 1213012, 1213013, 1213014, 1213015, 1213017, 1213018, 1213019, 1213020, 1213021, 1213022, 1213023, 1213024, 1213025, 1213032, 1213033, 1213034, 1213035, 1213036, 1213037, 1213038, 1213039, 1213040, 1213041, 1213042, 1213059, 1213133, 1213167, 1213215, 1213218, 1213221, 1213286, 1213287, 1213344, 1213346, 1213350, 1213525, 1213585, 1213586, 1213588, 1213705, 1213747, 1213766, 1213819, 1213823, 1213825, 1213827
CVE References: CVE-2018-3639, CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-20593, CVE-2023-2985, CVE-2023-35001, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776
Sources used:
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): kernel-syms-azure-4.12.14-16.146.1, kernel-source-azure-4.12.14-16.146.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): kernel-syms-azure-4.12.14-16.146.1, kernel-source-azure-4.12.14-16.146.1
SUSE Linux Enterprise Server 12 SP5 (src): kernel-syms-azure-4.12.14-16.146.1, kernel-source-azure-4.12.14-16.146.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

SUSE-SU-2023:3392-1: An update that solves 13 vulnerabilities and has five fixes can now be installed.

Category: security (important)
Bug References: 1206418, 1207088, 1210584, 1211738, 1211867, 1212301, 1212741, 1212835, 1213059, 1213167, 1213286, 1213287, 1213546, 1213585, 1213586, 1213588, 1213970, 1214019
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-20593, CVE-2023-2985, CVE-2023-34319, CVE-2023-35001, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776, CVE-2023-4133, CVE-2023-4194
Sources used:
SUSE Linux Enterprise Live Patching 15-SP1 (src): kernel-livepatch-SLE15-SP1_Update_43-1-150100.3.3.1
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): kernel-source-4.12.14-150100.197.154.1, kernel-syms-4.12.14-150100.197.154.1, kernel-obs-build-4.12.14-150100.197.154.1
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): kernel-source-4.12.14-150100.197.154.1, kernel-syms-4.12.14-150100.197.154.1, kernel-obs-build-4.12.14-150100.197.154.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): kernel-source-4.12.14-150100.197.154.1, kernel-syms-4.12.14-150100.197.154.1, kernel-obs-build-4.12.14-150100.197.154.1
SUSE CaaS Platform 4.0 (src): kernel-source-4.12.14-150100.197.154.1, kernel-syms-4.12.14-150100.197.154.1, kernel-obs-build-4.12.14-150100.197.154.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

SUSE-SU-2023:3390-1: An update that solves 16 vulnerabilities and has eight fixes can now be installed.

Category: security (important)
Bug References: 1206418, 1207088, 1209342, 1210584, 1211738, 1211867, 1212301, 1212741, 1212835, 1212846, 1213059, 1213167, 1213245, 1213286, 1213287, 1213354, 1213543, 1213546, 1213585, 1213586, 1213588, 1213868, 1213970, 1214019
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-20593, CVE-2023-2985, CVE-2023-3117, CVE-2023-3390, CVE-2023-34319, CVE-2023-35001, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776, CVE-2023-3812, CVE-2023-4133, CVE-2023-4194
Sources used:
SUSE Linux Enterprise Live Patching 15-SP2 (src): kernel-livepatch-SLE15-SP2_Update_39-1-150200.5.3.2
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): kernel-obs-build-5.3.18-150200.24.160.2, kernel-syms-5.3.18-150200.24.160.1, kernel-default-base-5.3.18-150200.24.160.2.150200.9.79.2, kernel-source-5.3.18-150200.24.160.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): kernel-obs-build-5.3.18-150200.24.160.2, kernel-syms-5.3.18-150200.24.160.1, kernel-default-base-5.3.18-150200.24.160.2.150200.9.79.2, kernel-source-5.3.18-150200.24.160.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): kernel-obs-build-5.3.18-150200.24.160.2, kernel-syms-5.3.18-150200.24.160.1, kernel-default-base-5.3.18-150200.24.160.2.150200.9.79.2, kernel-source-5.3.18-150200.24.160.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

SUSE-SU-2023:3391-1: An update that solves 15 vulnerabilities, contains one feature and has nine fixes can now be installed.

Category: security (important)
Bug References: 1199304, 1206418, 1207270, 1210584, 1211131, 1211738, 1211867, 1212301, 1212741, 1212835, 1212846, 1213059, 1213061, 1213167, 1213245, 1213286, 1213287, 1213354, 1213543, 1213585, 1213586, 1213588, 1213653, 1213868
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-20593, CVE-2023-2156, CVE-2023-2985, CVE-2023-3117, CVE-2023-31248, CVE-2023-3390, CVE-2023-35001, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776, CVE-2023-3812
Jira References: PED-4567
Sources used:
SUSE Linux Enterprise Live Patching 15-SP3 (src): kernel-livepatch-SLE15-SP3_Update_35-1-150300.7.3.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): kernel-obs-build-5.3.18-150300.59.130.1, kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1, kernel-syms-5.3.18-150300.59.130.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): kernel-obs-build-5.3.18-150300.59.130.1, kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1, kernel-syms-5.3.18-150300.59.130.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): kernel-obs-build-5.3.18-150300.59.130.1, kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1, kernel-syms-5.3.18-150300.59.130.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): kernel-obs-build-5.3.18-150300.59.130.1, kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1, kernel-syms-5.3.18-150300.59.130.1
SUSE Manager Proxy 4.2 (src): kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1
SUSE Manager Retail Branch Server 4.2 (src): kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1
SUSE Manager Server 4.2 (src): kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1
SUSE Enterprise Storage 7.1 (src): kernel-obs-build-5.3.18-150300.59.130.1, kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1, kernel-source-5.3.18-150300.59.130.1, kernel-syms-5.3.18-150300.59.130.1
SUSE Linux Enterprise Micro 5.1 (src): kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1
SUSE Linux Enterprise Micro 5.2 (src): kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): kernel-default-base-5.3.18-150300.59.130.1.150300.18.76.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

SUSE-SU-2023:3421-1: An update that solves 15 vulnerabilities, contains one feature and has nine fixes can now be installed.

Category: security (important)
Bug References: 1199304, 1206418, 1207270, 1210584, 1211131, 1211738, 1211867, 1212301, 1212741, 1212835, 1212846, 1213059, 1213061, 1213167, 1213245, 1213286, 1213287, 1213354, 1213543, 1213585, 1213586, 1213588, 1213653, 1213868
CVE References: CVE-2022-40982, CVE-2023-0459, CVE-2023-20569, CVE-2023-20593, CVE-2023-2156, CVE-2023-2985, CVE-2023-3117, CVE-2023-31248, CVE-2023-3390, CVE-2023-35001, CVE-2023-3567, CVE-2023-3609, CVE-2023-3611, CVE-2023-3776, CVE-2023-3812
Jira References: PED-4567
Sources used:

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

I am still having problems building the kernel.

The file: "/usr/share/doc/packages/kmod/README.usrmerge" suggest using the MODLIB parameter.

Using the following command:
> make MODLIB='$(INSTALL_MOD_PATH)/usr/lib/modules/$(KERNELRELEASE)' -j12 binrpm-pkg

on the 6.1.52 kernel just published, gives the following errors:

ln: failed to create symbolic link '/home/seppe/rpmbuild/BUILDROOT/kernel-6.1.52.A6-2.x86_64/lib/modules/99.98.6.1.52.A6': No such file or directory
depmod: ERROR: could not open directory /home/seppe/rpmbuild/BUILDROOT/kernel-6.1.52.A6-2.x86_64/usr/lib/modules/99.98.6.1.52.A6: No such file or directory
depmod: FATAL: could not search modules: No such file or directory


The Tumbleweed version i use is:

> cat /etc/os-release
NAME="openSUSE Tumbleweed"
# VERSION="20230906"

Do you have a suggestion how to solve this?

Update (kernel) past this
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4d15c9fa058e6dee09324cfc93f48858d429601

> git log 

This gives:

>commit 6aecceccf5aa626b0af203e54ca62cbf308c53d8
>Merge: dfb863a714b8 5d61b9fd19d9
>Author: Linus Torvalds <torvalds@linux-foundation.org>
>Date:   Thu Jun 9 16:27:42 2011 -0700
>    Merge branch 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6
>    
>    * 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6:
>      perf: Use make kernelversion instead of parsing the Makefile
> >>   kbuild: Hack for depmod not handling X.Y versions
>      kbuild: Move depmod call to a separate script
>      kbuild: Fix <linux/version.h> for empty SUBLEVEL or PATCHLEVEL
>      kbuild: Fix KERNELVERSION for empty SUBLEVEL or PATCHLEVEL
>      kbuild: silence Nothing to be done for 'all' message


note the output at ">>"

But by looking at the scripts/depmod.sh file, the change was indeed not in the 6.1.52 version. I therefore applied the patch myself.

The new error is:

RPM build errors:
    File not found: /home/seppe/rpmbuild/BUILDROOT/kernel-6.1.52.A6-3.x86_64/lib/modules/6.1.52.A6

Note the missing "/usr/" in the path. 

Is there something in the Makefiles that also has to change? Or some rpmbuild spec file somewhere?

The error above was raised after:
> make MODLIB='$(INSTALL_MOD_PATH)/usr/lib/modules/$(KERNELRELEASE)' -j12 binrpm-pkg


When using:
> make -j12 binrpm-pkg

The error now is:
depmod: ERROR: could not open directory /home/seppe/rpmbuild/BUILDROOT/kernel-6.1.52.A6-4.x86_64/usr/lib/modules/6.1.52.A6: No such file or directory

The reference you may find hints in is the specfile for openSUSE kernel [1].
And possibly a kmod-matching fixup [2].

Out of curiosity -- why cannot you use a newer kernel? (E.g. the stable 6.5.2 distributed in openSUSE)?

[1] https://github.com/SUSE/kernel-source/blob/stable/rpm/kernel-binary.spec.in
[2] https://github.com/SUSE/kernel-source/blob/stable/patches.rpmify/usrmerge-Adjust-module-path-in-the-kernel-sources.patch

I am building kernels to make booting faster. I use a stripped down .config and a compression which works fastest on my computer. It takes time to make a dictated one for newer kernel versions. I usually make one for the LST versions and use that. Is just easy. I update only is there is a change in the kernel i really need or are nice features.

The new 6.5.2 kernel give the same error though. I was hoping this would be better. 

I will read your suggestions ans proceed from there.

I tried the Tumbleweed approach with the .spec file, but ended up making lots of adjustments and not a working build. I stopped following that path. This was to difficult for me.

I found that the 'scripts/package/mkspec' file has hard coded '/lib/modules/' directories. That makes the binrpm-pkg target fail in my case, when using a changed MODLIB parameter. This is a new bug in my opinion.

To point where the bug is, i made a patch which will add a MODULE_PATH parameter. Then compiling with this parameter set to '/usr' results in a correct build with the modules at /'usr/lib/modules' in the resulting .rpm file. This patch is at the bottom of this commend. 

The Makefile and scripts/package/mkspec are both changed by the patch.

> make MODULE_PATH='/usr' binrpm-pkg
This command will then complete and the resulting .rpm can be installed correct.

I find it complex to find a nice and correct solution which will use a MODLIB or  INSTALL_MOD_PATH parameter in a correct way in the 'scripts/package/mkspec'. The path to use has to be equal to $MODLIB, but without the $(INSTALL_MOD_PATH) in the beginning and $(KERNELRELEASE) in the end.  
 

Any suggestions about how to proceed? I can just use my patch, but others might find the same errors i found earlier. But nobody has found this so far, so i guess i am (nearly?) the only one using the binrpm-pkg target anyway.     


The patch (generated by a "git log -p -2" command:

diff --git a/Makefile b/Makefile
index 82aaa3ae7395..558e686bef38 100644
--- a/Makefile
+++ b/Makefile
@@ -1166,7 +1166,7 @@ export INSTALL_DTBS_PATH ?= $(INSTALL_PATH)/dtbs/$(KERNELRELEASE)
 # makefile but the argument can be passed to make if needed.
 #
 
-MODLIB = $(INSTALL_MOD_PATH)/lib/modules/$(KERNELRELEASE)
+MODLIB = $(INSTALL_MOD_PATH)$(MODULE_PATH)/lib/modules/$(KERNELRELEASE)
 export MODLIB
 
 PHONY += prepare0
diff --git a/scripts/package/mkspec b/scripts/package/mkspec
index 70392fd2fd29..4eb3e027c68f 100755
--- a/scripts/package/mkspec
+++ b/scripts/package/mkspec
@@ -97,11 +97,11 @@ $M  $MAKE %{?_smp_mflags} INSTALL_MOD_PATH=%{buildroot} modules_install
        $MAKE %{?_smp_mflags} INSTALL_HDR_PATH=%{buildroot}/usr headers_install
        cp System.map %{buildroot}/boot/System.map-$KERNELRELEASE
        cp .config %{buildroot}/boot/config-$KERNELRELEASE
-$S$M   rm -f %{buildroot}/lib/modules/$KERNELRELEASE/build
-$S$M   rm -f %{buildroot}/lib/modules/$KERNELRELEASE/source
+$S$M   rm -f %{buildroot}$MODULE_PATH/lib/modules/$KERNELRELEASE/build
+$S$M   rm -f %{buildroot}$MODULE_PATH/lib/modules/$KERNELRELEASE/source
 $S$M   mkdir -p %{buildroot}/usr/src/kernels/$KERNELRELEASE
 $S$M   tar cf - $EXCLUDES . | tar xf - -C %{buildroot}/usr/src/kernels/$KERNELRELEASE
-$S$M   cd %{buildroot}/lib/modules/$KERNELRELEASE
+$S$M   cd %{buildroot}$MODULE_PATH/lib/modules/$KERNELRELEASE
 $S$M   ln -sf /usr/src/kernels/$KERNELRELEASE build
 $S$M   ln -sf /usr/src/kernels/$KERNELRELEASE source
 
@@ -131,9 +131,9 @@ $S$M        ln -sf /usr/src/kernels/$KERNELRELEASE source
 
        %files
        %defattr (-, root, root)
-$M     /lib/modules/$KERNELRELEASE
-$M     %exclude /lib/modules/$KERNELRELEASE/build
-$M     %exclude /lib/modules/$KERNELRELEASE/source
+$M     $MODULE_PATH/lib/modules/$KERNELRELEASE
+$M     %exclude $MODULE_PATH/lib/modules/$KERNELRELEASE/build
+$M     %exclude $MODULE_PATH/lib/modules/$KERNELRELEASE/source
        /boot/*
 
        %files headers
@@ -143,6 +143,6 @@ $S$M
 $S$M   %files devel
 $S$M   %defattr (-, root, root)
 $S$M   /usr/src/kernels/$KERNELRELEASE
-$S$M   /lib/modules/$KERNELRELEASE/build
-$S$M   /lib/modules/$KERNELRELEASE/source
+$S$M   $MODULE_PATH/lib/modules/$KERNELRELEASE/build
+$S$M   $MODULE_PATH/lib/modules/$KERNELRELEASE/source
 EOF

Created attachment 869417 [details]
patch for stable kernel before 49c803cd919d ("kbuild: rpm-pkg: split out the body of spec file")

Please try the attached patch

Created attachment 869418 [details]
patch for mainline

This works!

This works!

with the command:
> make MODLIB='$(INSTALL_MOD_PATH)/usr/lib/modules/$(KERNELRELEASE)' -j12 binrpm-pkg