diff --git a/SPECS/90/linux/linux.spec b/SPECS/90/linux/linux.spec index e66bcb3446..0cb6404acb 100644 --- a/SPECS/90/linux/linux.spec +++ b/SPECS/90/linux/linux.spec @@ -47,10 +47,19 @@ %global fips 0 %endif +# acvp_build and kat_build are x86_64-only: the canister they certify is +# arch/x86 crypto and the only ACVP config is config_x86_64_acvp. Refuse them +# on any other architecture instead of building with x86_64 inputs. +%ifnarch x86_64 +%if 0%{?acvp_build} || 0%{?kat_build} +%{error:acvp_build and kat_build are x86_64-only; refusing to build for %{_target_cpu}} +%endif +%endif + Summary: Kernel Name: linux Version: 6.1.190 -Release: 2%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} +Release: 3%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} URL: http://www.kernel.org/ Group: System Environment/Kernel Vendor: VMware, Inc. @@ -995,6 +1004,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %{_datadir}/bash-completion/completions/bpftool %changelog +* Fri Oct 30 2026 Daniel Casota 6.1.190-3 +- Refuse acvp_build and kat_build on architectures other than x86_64 * Thu Oct 29 2026 Brennan Lamoreaux 6.1.190-2 - Fixes CVE-2026-80668, CVE-2026-90037 * Mon Oct 19 2026 Gerrit Photon 6.1.190-1 diff --git a/SPECS/91/linux/canister_builder/crypto/gen_canister_relocs.c b/SPECS/91/linux/canister_builder/crypto/gen_canister_relocs.c index 8f8b4095e1..8366b1ea93 100644 --- a/SPECS/91/linux/canister_builder/crypto/gen_canister_relocs.c +++ b/SPECS/91/linux/canister_builder/crypto/gen_canister_relocs.c @@ -228,6 +228,15 @@ static void process_section(Elf *elf, Elf_Scn *s, int sndx, struct symbol_entry unsigned int offset = 0; Elf64_Rela *rels; struct _relocation *r; + /* + * The output relocation names its section by ondx in an unsigned + * char; an unmeasured section has none (-1). + */ + if (section_symbols[sndx]->ondx < 0 || + section_symbols[sndx]->ondx > ONE_BYTE_UNSIGNED_MAX_VALUE) + error("Relocations in section %s with no valid index (%d)", + section_symbols[sndx]->name, section_symbols[sndx]->ondx); + data = elf_getdata(s, NULL); rels = (Elf64_Rela *)data->d_buf; n_entries = data->d_size / sizeof (Elf64_Rela); @@ -399,8 +408,19 @@ static void parse_sections(Elf *elf, size_t shstrndx, int *n_syms, size_t *strnd /* * ndx - section index in inout file. * ondx - section index in generated .c file + * + * ondx is what fips_integrity_init() uses to index its si[] + * array, and si[] is built from canister_sections[], which + * holds only the sections that have both markers. A section + * with no end marker - .bss - is not measured and therefore + * not in si[], so it must not consume an ondx. If it does, + * every section that follows it is numbered one too high and + * its reverse relocations are applied to the wrong section. */ - section_symbols[ndx]->ondx = ondx++; + if (section_symbols[ndx]->end) + section_symbols[ndx]->ondx = ondx++; + else + section_symbols[ndx]->ondx = -1; } if (!symtab) error("Unable to find .symtab section"); diff --git a/SPECS/91/linux/canister_builder/patches/1000-FIPS-canister-creation.patch b/SPECS/91/linux/canister_builder/patches/1000-FIPS-canister-creation.patch index bd146c99d7..3ab2afe23d 100644 --- a/SPECS/91/linux/canister_builder/patches/1000-FIPS-canister-creation.patch +++ b/SPECS/91/linux/canister_builder/patches/1000-FIPS-canister-creation.patch @@ -322,7 +322,7 @@ index b0dd83555..55ed01a67 100644 skcipher_walk_done(&walk, 0); return err; diff --git a/crypto/Makefile b/crypto/Makefile -index 768f24db5..b4cb9f756 100644 +index 26e9e21cb..ab3d6fff0 100644 --- a/crypto/Makefile +++ b/crypto/Makefile @@ -18,9 +18,11 @@ crypto_algapi-y := algapi.o scatterwalk.o $(crypto_algapi-y) @@ -413,7 +413,7 @@ index 768f24db5..b4cb9f756 100644 obj-$(CONFIG_CRYPTO_POLYVAL) += polyval-generic.o obj-$(CONFIG_CRYPTO_USER_API) += af_alg.o obj-$(CONFIG_CRYPTO_USER_API_HASH) += algif_hash.o -@@ -164,11 +182,14 @@ obj-$(CONFIG_CRYPTO_USER_API_SKCIPHER) += algif_skcipher.o +@@ -164,8 +182,10 @@ obj-$(CONFIG_CRYPTO_USER_API_SKCIPHER) += algif_skcipher.o obj-$(CONFIG_CRYPTO_USER_API_RNG) += algif_rng.o obj-$(CONFIG_CRYPTO_USER_API_AEAD) += algif_aead.o obj-$(CONFIG_CRYPTO_ZSTD) += zstd.o @@ -422,13 +422,17 @@ index 768f24db5..b4cb9f756 100644 obj-$(CONFIG_CRYPTO_CURVE25519) += curve25519-generic.o +canister += drbg.o + # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124949 + ifeq ($(CONFIG_ARM)$(CONFIG_KASAN_STACK)$(CONFIG_CC_IS_GCC),yyy) +@@ -174,6 +194,7 @@ endif + ecdh_generic-y += ecdh.o ecdh_generic-y += ecdh_helper.o +canister += $(ecdh_generic-y) $(obj)/ecrdsa_params.asn1.o: $(obj)/ecrdsa_params.asn1.c $(obj)/ecrdsa_params.asn1.h $(obj)/ecrdsa_pub_key.asn1.o: $(obj)/ecrdsa_pub_key.asn1.c $(obj)/ecrdsa_pub_key.asn1.h -@@ -192,6 +213,97 @@ obj-$(CONFIG_CRYPTO_SIMD) += crypto_simd.o +@@ -197,6 +218,97 @@ obj-$(CONFIG_CRYPTO_SIMD) += crypto_simd.o # Key derivation function # obj-$(CONFIG_CRYPTO_KDF800108_CTR) += kdf_sp800108.o diff --git a/SPECS/91/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch b/SPECS/91/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch index dafa0d351f..1e323e8eba 100644 --- a/SPECS/91/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch +++ b/SPECS/91/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch @@ -290,8 +290,8 @@ index bfde0f28c..a631b4905 100644 const unsigned int digest_size = req->dst_len; int err; -- if (WARN_ON(req->dst) || WARN_ON(!digest_size) || -+ if (fcw_warn_on(req->dst) || fcw_warn_on(!digest_size) || +- if (WARN_ON(req->dst) || !digest_size || ++ if (fcw_warn_on(req->dst) || !digest_size || !ctx->key_size || sig_size != ctx->key_size) return -EINVAL; diff --git a/SPECS/91/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch b/SPECS/91/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch index 7ab805cffc..12032503ba 100644 --- a/SPECS/91/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch +++ b/SPECS/91/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch @@ -86,7 +86,7 @@ index 9cac0a06b..d9b6d7d1d 100644 const unsigned int digest_size = req->dst_len; int err; - if (fcw_warn_on(req->dst) || fcw_warn_on(!digest_size) || + if (fcw_warn_on(req->dst) || !digest_size || - !ctx->key_size || sig_size != ctx->key_size) + !ctx->key_size || sig_size != ctx->key_size || + pkcs1pad_invalid_hash_len(digest_size, digest_info)) diff --git a/SPECS/91/linux/canister_config.inc b/SPECS/91/linux/canister_config.inc new file mode 100644 index 0000000000..0b2706a7ad --- /dev/null +++ b/SPECS/91/linux/canister_config.inc @@ -0,0 +1,35 @@ +%dnl Shared canister/.config manipulation for the Photon kernel flavours. +%dnl +%dnl Included by both SPECS/linux/linux.spec and SPECS/linux/linux-esx.spec so +%dnl that the FIPS canister Kconfig handling cannot diverge between the two +%dnl flavours again. linux.spec had no fips=0 branch at all, so an x86_64 build +%dnl with fips set to 0 left the canister "is not set" comments of config_x86_64 +%dnl in .config; "make olddefconfig" silently drops symbols that do not exist in +%dnl the tree and the check_for_config_applicability.inc diff guard then failed. +%dnl The aarch64 configs never carried those lines. +%dnl +%dnl Expects, from the including spec: +%dnl fips 1 => build a FIPS kernel carrying the crypto canister +%dnl canister_build 1 => the canister is built from source in this build +%dnl canister_usage 1 => link against a prebuilt canister object file +%dnl (derived: !canister_build when fips=1, else 0) +%dnl +%dnl Expects .config to be in place already (cp of the flavour config Source). +%dnl +%dnl The GCC_PLUGIN_MATCH_CANISTER_STRUCTS / GCC_PLUGIN_PAD_CANISTER_STRUCTS +%dnl Kconfig symbols only exist once the fips canister plugin patches have been +%dnl applied, i.e. only when fips=1. +%if 0%{?canister_build} +sed -i "s/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS=y/" .config +sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config +%endif + +%if 0%{?canister_usage} +sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config +%endif + +%if 0%{?fips} == 0 +# Clean up .config of FIPS related configs +sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config +sed -i "/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/d" .config +%endif diff --git a/SPECS/91/linux/linux-esx.spec b/SPECS/91/linux/linux-esx.spec index 015d69550d..7f9ca73e9d 100644 --- a/SPECS/91/linux/linux-esx.spec +++ b/SPECS/91/linux/linux-esx.spec @@ -26,10 +26,21 @@ %global fips 0 %endif +# The esx flavour never builds the canister itself, it always links against the +# prebuilt canister object file. Mirror linux.spec's derived flag model so the +# shared canister_config.inc behaves identically for both flavours. +%if 0%{?fips} +%global canister_build 0 +%global canister_usage 1 +%else +%global canister_build 0 +%global canister_usage 0 +%endif + Summary: Kernel Name: linux-esx Version: 6.12.111 -Release: 3%{?dist} +Release: 4%{?dist} URL: http://www.kernel.org Group: System Environment/Kernel Vendor: VMware, Inc. @@ -44,6 +55,8 @@ Source2: initramfs.trigger # contains pre, postun, filetriggerun tasks Source3: scriptlets.inc Source4: check_for_config_applicability.inc +# shared canister/.config handling, also included by linux.spec +Source5: canister_config.inc Source19: spec_install_post.inc @@ -439,20 +452,15 @@ tar -xvf /usr/lib/fips-canister/fips-canister-%{fips_canister_version}.tar.bz2 # corresponding .cmd file. Empty content is ok, since we are not going # to rebuild it. touch crypto/.fips_canister.o.cmd - -sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config %else -# Clean up .config of FIPS related configs -sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config -sed -i "/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/d" .config - sed -i "s/# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2 is not set/CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y/" .config sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_32=y/# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_32 is not set/" .config sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=128/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64/" .config sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=256/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=32/" .config %endif - +%dnl canister/.config handling, shared with linux.spec +%include %{SOURCE5} %ifarch x86_64 sed -e "s,@@NAME@@,%{name},g" \ -e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" \ @@ -582,6 +590,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %{_usrsrc}/linux-headers-%{uname_r} %changelog +* Fri Oct 30 2026 Daniel Casota 6.12.111-4 +- Share canister/.config handling via canister_config.inc * Wed Sep 30 2026 Srinidhi Rao 6.12.111-3 - Fix jent mem free. * Mon Sep 28 2026 Shreenidhi Shedi 6.12.111-2 diff --git a/SPECS/91/linux/linux.spec b/SPECS/91/linux/linux.spec index 328b70479d..5c745e36e4 100644 --- a/SPECS/91/linux/linux.spec +++ b/SPECS/91/linux/linux.spec @@ -57,9 +57,20 @@ %global canister_build 1 %endif +%ifarch x86_64 %if 0%{?acvp_build} %global fips 1 %endif +%endif + +# acvp_build and kat_build are x86_64-only: the canister they certify is +# arch/x86 crypto and the only ACVP config is config_x86_64_acvp. Refuse them +# on any other architecture instead of building with x86_64 inputs. +%ifnarch x86_64 +%if 0%{?acvp_build} || 0%{?kat_build} +%{error:acvp_build and kat_build are x86_64-only; refusing to build for %{_target_cpu}} +%endif +%endif # Set default FIPS flags %if 0%{?fips} @@ -80,7 +91,7 @@ Summary: Kernel Name: linux Version: 6.12.111 -Release: 3%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} +Release: 4%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} URL: http://www.kernel.org/ Group: System Environment/Kernel Vendor: VMware, Inc. @@ -99,6 +110,8 @@ Source3: https://github.com/amzn/amzn-drivers/archive/refs/tags/ena_linux %define efa_version 3.1.0 Source4: https://github.com/amzn/amzn-drivers/archive/refs/tags/efa_linux_%{efa_version}.tar.gz +# shared canister/.config handling, also included by linux-esx.spec +Source5: canister_config.inc # contains pre, postun, filetriggerun tasks Source6: scriptlets.inc Source7: check_for_config_applicability.inc @@ -707,14 +720,7 @@ sed -i '/CONFIG_ARCH_HAS_RELR=y/a CONFIG_RELR=y' .config %endif %endif -%if 0%{?canister_build} -sed -i "s/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS=y/" .config -sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config -%endif - -%if 0%{?canister_usage} -sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config -%endif +%include %{SOURCE5} %ifarch x86_64 sed -e "s,@@NAME@@,%{name},g" \ @@ -1028,6 +1034,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %endif %changelog +* Fri Oct 30 2026 Daniel Casota 6.12.111-4 +- Share canister_config.inc; build the canister against the current kernel * Wed Sep 30 2026 Srinidhi Rao 6.12.111-3 - Fix jent mem free. * Mon Sep 28 2026 Shreenidhi Shedi 6.12.111-2 diff --git a/SPECS/92/linux/canister_builder/crypto/gen_canister_relocs.c b/SPECS/92/linux/canister_builder/crypto/gen_canister_relocs.c index 8f8b4095e1..8366b1ea93 100644 --- a/SPECS/92/linux/canister_builder/crypto/gen_canister_relocs.c +++ b/SPECS/92/linux/canister_builder/crypto/gen_canister_relocs.c @@ -228,6 +228,15 @@ static void process_section(Elf *elf, Elf_Scn *s, int sndx, struct symbol_entry unsigned int offset = 0; Elf64_Rela *rels; struct _relocation *r; + /* + * The output relocation names its section by ondx in an unsigned + * char; an unmeasured section has none (-1). + */ + if (section_symbols[sndx]->ondx < 0 || + section_symbols[sndx]->ondx > ONE_BYTE_UNSIGNED_MAX_VALUE) + error("Relocations in section %s with no valid index (%d)", + section_symbols[sndx]->name, section_symbols[sndx]->ondx); + data = elf_getdata(s, NULL); rels = (Elf64_Rela *)data->d_buf; n_entries = data->d_size / sizeof (Elf64_Rela); @@ -399,8 +408,19 @@ static void parse_sections(Elf *elf, size_t shstrndx, int *n_syms, size_t *strnd /* * ndx - section index in inout file. * ondx - section index in generated .c file + * + * ondx is what fips_integrity_init() uses to index its si[] + * array, and si[] is built from canister_sections[], which + * holds only the sections that have both markers. A section + * with no end marker - .bss - is not measured and therefore + * not in si[], so it must not consume an ondx. If it does, + * every section that follows it is numbered one too high and + * its reverse relocations are applied to the wrong section. */ - section_symbols[ndx]->ondx = ondx++; + if (section_symbols[ndx]->end) + section_symbols[ndx]->ondx = ondx++; + else + section_symbols[ndx]->ondx = -1; } if (!symtab) error("Unable to find .symtab section"); diff --git a/SPECS/92/linux/canister_builder/patches/1000-FIPS-canister-creation.patch b/SPECS/92/linux/canister_builder/patches/1000-FIPS-canister-creation.patch index bd146c99d7..3ab2afe23d 100644 --- a/SPECS/92/linux/canister_builder/patches/1000-FIPS-canister-creation.patch +++ b/SPECS/92/linux/canister_builder/patches/1000-FIPS-canister-creation.patch @@ -322,7 +322,7 @@ index b0dd83555..55ed01a67 100644 skcipher_walk_done(&walk, 0); return err; diff --git a/crypto/Makefile b/crypto/Makefile -index 768f24db5..b4cb9f756 100644 +index 26e9e21cb..ab3d6fff0 100644 --- a/crypto/Makefile +++ b/crypto/Makefile @@ -18,9 +18,11 @@ crypto_algapi-y := algapi.o scatterwalk.o $(crypto_algapi-y) @@ -413,7 +413,7 @@ index 768f24db5..b4cb9f756 100644 obj-$(CONFIG_CRYPTO_POLYVAL) += polyval-generic.o obj-$(CONFIG_CRYPTO_USER_API) += af_alg.o obj-$(CONFIG_CRYPTO_USER_API_HASH) += algif_hash.o -@@ -164,11 +182,14 @@ obj-$(CONFIG_CRYPTO_USER_API_SKCIPHER) += algif_skcipher.o +@@ -164,8 +182,10 @@ obj-$(CONFIG_CRYPTO_USER_API_SKCIPHER) += algif_skcipher.o obj-$(CONFIG_CRYPTO_USER_API_RNG) += algif_rng.o obj-$(CONFIG_CRYPTO_USER_API_AEAD) += algif_aead.o obj-$(CONFIG_CRYPTO_ZSTD) += zstd.o @@ -422,13 +422,17 @@ index 768f24db5..b4cb9f756 100644 obj-$(CONFIG_CRYPTO_CURVE25519) += curve25519-generic.o +canister += drbg.o + # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124949 + ifeq ($(CONFIG_ARM)$(CONFIG_KASAN_STACK)$(CONFIG_CC_IS_GCC),yyy) +@@ -174,6 +194,7 @@ endif + ecdh_generic-y += ecdh.o ecdh_generic-y += ecdh_helper.o +canister += $(ecdh_generic-y) $(obj)/ecrdsa_params.asn1.o: $(obj)/ecrdsa_params.asn1.c $(obj)/ecrdsa_params.asn1.h $(obj)/ecrdsa_pub_key.asn1.o: $(obj)/ecrdsa_pub_key.asn1.c $(obj)/ecrdsa_pub_key.asn1.h -@@ -192,6 +213,97 @@ obj-$(CONFIG_CRYPTO_SIMD) += crypto_simd.o +@@ -197,6 +218,97 @@ obj-$(CONFIG_CRYPTO_SIMD) += crypto_simd.o # Key derivation function # obj-$(CONFIG_CRYPTO_KDF800108_CTR) += kdf_sp800108.o diff --git a/SPECS/92/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch b/SPECS/92/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch index dafa0d351f..b6ec95a8fa 100644 --- a/SPECS/92/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch +++ b/SPECS/92/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch @@ -204,16 +204,16 @@ index c0a8e4f66..78341ecbb 100644 } while (outlen) { -@@ -2089,14 +2089,14 @@ static inline int __init drbg_healthcheck_sanity(void) +@@ -2088,14 +2088,14 @@ static inline int __init drbg_healthcheck_sanity(void) drbg_string_fill(&addtl, buf, max_addtllen + 1); - /* overflow addtllen with additonal info string */ - len = drbg_generate(drbg, buf, OUTBUFLEN, &addtl); -- BUG_ON(0 < len); -+ fcw_bug_on(0 < len); + /* overflow addtllen with additional info string */ + ret = drbg_generate(drbg, buf, OUTBUFLEN, &addtl); +- BUG_ON(ret == 0); ++ fcw_bug_on(ret == 0); /* overflow max_bits */ - len = drbg_generate(drbg, buf, (max_request_bytes + 1), NULL); -- BUG_ON(0 < len); -+ fcw_bug_on(0 < len); + ret = drbg_generate(drbg, buf, max_request_bytes + 1, NULL); +- BUG_ON(ret == 0); ++ fcw_bug_on(ret == 0); /* overflow max addtllen with personalization string */ ret = drbg_seed(drbg, &addtl, false); @@ -290,8 +290,8 @@ index bfde0f28c..a631b4905 100644 const unsigned int digest_size = req->dst_len; int err; -- if (WARN_ON(req->dst) || WARN_ON(!digest_size) || -+ if (fcw_warn_on(req->dst) || fcw_warn_on(!digest_size) || +- if (WARN_ON(req->dst) || !digest_size || ++ if (fcw_warn_on(req->dst) || !digest_size || !ctx->key_size || sig_size != ctx->key_size) return -EINVAL; diff --git a/SPECS/92/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch b/SPECS/92/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch index 7ab805cffc..12032503ba 100644 --- a/SPECS/92/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch +++ b/SPECS/92/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch @@ -86,7 +86,7 @@ index 9cac0a06b..d9b6d7d1d 100644 const unsigned int digest_size = req->dst_len; int err; - if (fcw_warn_on(req->dst) || fcw_warn_on(!digest_size) || + if (fcw_warn_on(req->dst) || !digest_size || - !ctx->key_size || sig_size != ctx->key_size) + !ctx->key_size || sig_size != ctx->key_size || + pkcs1pad_invalid_hash_len(digest_size, digest_info)) diff --git a/SPECS/92/linux/canister_config.inc b/SPECS/92/linux/canister_config.inc new file mode 100644 index 0000000000..0b2706a7ad --- /dev/null +++ b/SPECS/92/linux/canister_config.inc @@ -0,0 +1,35 @@ +%dnl Shared canister/.config manipulation for the Photon kernel flavours. +%dnl +%dnl Included by both SPECS/linux/linux.spec and SPECS/linux/linux-esx.spec so +%dnl that the FIPS canister Kconfig handling cannot diverge between the two +%dnl flavours again. linux.spec had no fips=0 branch at all, so an x86_64 build +%dnl with fips set to 0 left the canister "is not set" comments of config_x86_64 +%dnl in .config; "make olddefconfig" silently drops symbols that do not exist in +%dnl the tree and the check_for_config_applicability.inc diff guard then failed. +%dnl The aarch64 configs never carried those lines. +%dnl +%dnl Expects, from the including spec: +%dnl fips 1 => build a FIPS kernel carrying the crypto canister +%dnl canister_build 1 => the canister is built from source in this build +%dnl canister_usage 1 => link against a prebuilt canister object file +%dnl (derived: !canister_build when fips=1, else 0) +%dnl +%dnl Expects .config to be in place already (cp of the flavour config Source). +%dnl +%dnl The GCC_PLUGIN_MATCH_CANISTER_STRUCTS / GCC_PLUGIN_PAD_CANISTER_STRUCTS +%dnl Kconfig symbols only exist once the fips canister plugin patches have been +%dnl applied, i.e. only when fips=1. +%if 0%{?canister_build} +sed -i "s/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS=y/" .config +sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config +%endif + +%if 0%{?canister_usage} +sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config +%endif + +%if 0%{?fips} == 0 +# Clean up .config of FIPS related configs +sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config +sed -i "/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/d" .config +%endif diff --git a/SPECS/92/linux/linux-esx.spec b/SPECS/92/linux/linux-esx.spec index 72fcd9f64b..d330c0bbac 100644 --- a/SPECS/92/linux/linux-esx.spec +++ b/SPECS/92/linux/linux-esx.spec @@ -26,10 +26,21 @@ %global fips 0 %endif +# The esx flavour never builds the canister itself, it always links against the +# prebuilt canister object file. Mirror linux.spec's derived flag model so the +# shared canister_config.inc behaves identically for both flavours. +%if 0%{?fips} +%global canister_build 0 +%global canister_usage 1 +%else +%global canister_build 0 +%global canister_usage 0 +%endif + Summary: Kernel Name: linux-esx Version: 6.12.114 -Release: 1%{?dist} +Release: 2%{?dist} URL: http://www.kernel.org Group: System Environment/Kernel Vendor: VMware, Inc. @@ -44,6 +55,8 @@ Source2: initramfs.trigger # contains pre, postun, filetriggerun tasks Source3: scriptlets.inc Source4: check_for_config_applicability.inc +# shared canister/.config handling, also included by linux.spec +Source5: canister_config.inc Source19: spec_install_post.inc @@ -460,20 +473,15 @@ tar -xvf /usr/lib/fips-canister/fips-canister-%{fips_canister_version}.tar.bz2 # corresponding .cmd file. Empty content is ok, since we are not going # to rebuild it. touch crypto/.fips_canister.o.cmd - -sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config %else -# Clean up .config of FIPS related configs -sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config -sed -i "/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/d" .config - sed -i "s/# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2 is not set/CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y/" .config sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_32=y/# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_32 is not set/" .config sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=128/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64/" .config sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=256/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=32/" .config %endif - +%dnl canister/.config handling, shared with linux.spec +%include %{SOURCE5} %ifarch x86_64 sed -e "s,@@NAME@@,%{name},g" \ -e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" \ @@ -603,6 +611,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %{_usrsrc}/linux-headers-%{uname_r} %changelog +* Fri Oct 30 2026 Daniel Casota 6.12.114-2 +- Share canister/.config handling via canister_config.inc * Wed Oct 28 2026 Brennan Lamoreaux 6.12.114-1 - Update to version 6.12.114 * Wed Oct 28 2026 Brennan Lamoreaux 6.12.113-6 diff --git a/SPECS/92/linux/linux.spec b/SPECS/92/linux/linux.spec index 0e173ee862..3b68a4118e 100644 --- a/SPECS/92/linux/linux.spec +++ b/SPECS/92/linux/linux.spec @@ -57,9 +57,20 @@ %global canister_build 1 %endif +%ifarch x86_64 %if 0%{?acvp_build} %global fips 1 %endif +%endif + +# acvp_build and kat_build are x86_64-only: the canister they certify is +# arch/x86 crypto and the only ACVP config is config_x86_64_acvp. Refuse them +# on any other architecture instead of building with x86_64 inputs. +%ifnarch x86_64 +%if 0%{?acvp_build} || 0%{?kat_build} +%{error:acvp_build and kat_build are x86_64-only; refusing to build for %{_target_cpu}} +%endif +%endif # Set default FIPS flags %if 0%{?fips} @@ -80,7 +91,7 @@ Summary: Kernel Name: linux Version: 6.12.114 -Release: 1%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} +Release: 2%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} URL: http://www.kernel.org/ Group: System Environment/Kernel Vendor: VMware, Inc. @@ -99,6 +110,8 @@ Source3: https://github.com/amzn/amzn-drivers/archive/refs/tags/ena_linux %define efa_version 3.1.0 Source4: https://github.com/amzn/amzn-drivers/archive/refs/tags/efa_linux_%{efa_version}.tar.gz +# shared canister/.config handling, also included by linux-esx.spec +Source5: canister_config.inc # contains pre, postun, filetriggerun tasks Source6: scriptlets.inc Source7: check_for_config_applicability.inc @@ -710,14 +723,7 @@ sed -i '/CONFIG_ARCH_HAS_RELR=y/a CONFIG_RELR=y' .config %endif %endif -%if 0%{?canister_build} -sed -i "s/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS=y/" .config -sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config -%endif - -%if 0%{?canister_usage} -sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config -%endif +%include %{SOURCE5} %ifarch x86_64 sed -e "s,@@NAME@@,%{name},g" \ @@ -1031,6 +1037,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %endif %changelog +* Fri Oct 30 2026 Daniel Casota 6.12.114-2 +- Share canister_config.inc; build the canister against the current kernel * Wed Oct 28 2026 Brennan Lamoreaux 6.12.114-1 - Update to version 6.12.114 * Wed Oct 28 2026 Brennan Lamoreaux 6.12.113-6 @@ -2329,4 +2337,4 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg * Mon May 18 2015 Touseef Liaqat 3.13.3-2 - Update according to UsrMove. * Wed Nov 5 2014 Divya Thaluru 3.13.3-1 -- Initial build. First version \ No newline at end of file +- Initial build. First version