PATCH: scripts/package/mkspec

PATCH: scripts/package/mkspec

[Kevin Fenzi]

This is a patch against 2.6.10's mkspec script. 
This patch adds %post and a %preun sections to the rpm spec that
mkspec generates for the kernel (for 'make rpm'). 

So, after installing the kernel rpm it checks for /sbin/mkinitrd and
makes an initrd file for the newly installed kernel rpm. It also
checks for a /sbin/new-kernel-package command and runs it on the new
kernel if it exists to add the new kernel/initrd to grub/lilo. 

For preun, before the kernel rpm is removed, /sbin/new-kernel-package
is called to remove the kernel from the lilo or grub config and to
remove the initrd (if any). 

I am using Fedora Core based machines, so I don't know how well these
translate to {mandrake|suse|connectiva|others}. Anyone using those
systems care to comment?

This patch works fine for me on Fedora based systems, and shouldn't
harm any machines without /sbin/mkinitrd and
/sbin/new-kernel-package. 

Comments?

kevin
--
diff -Nru linux-2.6.10.orig/scripts/package/mkspec linux-2.6.10/scripts/package/mkspec
--- linux-2.6.10.orig/scripts/package/mkspec    2004-12-24 14:33:49.000000000 -0700
+++ linux-2.6.10/scripts/package/mkspec 2004-12-30 20:19:04.954634842 -0700
@@ -73,6 +73,14 @@
 echo ""
 echo "%clean"
 echo '#echo -rf $RPM_BUILD_ROOT'
+
+echo "%post"
+echo '[ -x /sbin/mkinitrd ] && /sbin/mkinitrd /boot/initrd-'"$VERSION.$PATCHLEVEL.$SUBLEVEL$EXTRAVERSION"'.img '"$VERSION.$PATCHLEVEL.$SUBLEVEL$EXTRAVERSION"
+echo '[ -x /sbin/new-kernel-pkg ] && /sbin/new-kernel-pkg --install --initrdfile=/boot/initrd-'"$VERSION.$PATCHLEVEL.$SUBLEVEL$EXTRAVERSION"'.img --make-default '"$VERSION.$PATCHLEVEL.$SUBLEVEL$EXTRAVERSION"
+echo ""
+echo "%preun"
+echo '[ -x /sbin/new-kernel-pkg ] && /sbin/new-kernel-pkg --remove '"$VERSION.$PATCHLEVEL.$SUBLEVEL$EXTRAVERSION"
+
 echo ""
 echo "%files"
 echo '%defattr (-, root, root)'

Re: PATCH: scripts/package/mkspec

[Wichert Akkerman]

Previously Kevin Fenzi wrote:
> So, after installing the kernel rpm it checks for /sbin/mkinitrd and
> makes an initrd file for the newly installed kernel rpm. It also
> checks for a /sbin/new-kernel-package command and runs it on the new
> kernel if it exists to add the new kernel/initrd to grub/lilo. 

Why not use the same system as the Debian package uses? That runs
everything in /etc/kernel/postinst.d/ after installing and everything
in /etc/kernel/prerm.d/ before removing a package.

That is much more flexible than hardcoding something like mkinitrd or
new-kernel-package: it works on all architectures and gives the
administratie full freedom to hook into things.

Wichert.

-- 
Wichert Akkerman <wichert@wiggy.net>    It is simple to make things.
http://www.wiggy.net/                   It is hard to make things simple.

Re: PATCH: scripts/package/mkspec

[Kevin Fenzi]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>>>>> "Wichert" == Wichert Akkerman <wichert@wiggy.net> writes:

Wichert> Previously Kevin Fenzi wrote:
>> So, after installing the kernel rpm it checks for /sbin/mkinitrd
>> and makes an initrd file for the newly installed kernel rpm. It
>> also checks for a /sbin/new-kernel-package command and runs it on
>> the new kernel if it exists to add the new kernel/initrd to
>> grub/lilo.

Wichert> Why not use the same system as the Debian package uses? That
Wichert> runs everything in /etc/kernel/postinst.d/ after installing
Wichert> and everything in /etc/kernel/prerm.d/ before removing a
Wichert> package.

Wichert> That is much more flexible than hardcoding something like
Wichert> mkinitrd or new-kernel-package: it works on all architectures
Wichert> and gives the administratie full freedom to hook into things.

Humm... yeah, there would be some advantages to that kind of setup. 
Flexable, easier to add/remove things you want done on
install/uninstall. 

However, it seems like it would also be most vulnerable to security
issues. All an attacker needs to do is get a link/file into one of
those dirs and they could execute any commands they like. 

Also, seems like it would be harder to audit and see whats going to
happen on install/removal. 

Are a base set of commands/scripts provided by the kernel package? Or
do they come in some other package? 

Wichert> Wichert.

kevin
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Processed by Mailcrypt 3.5.8 <http://mailcrypt.sourceforge.net/>

iD8DBQFB1yGn3imCezTjY0ERAhJZAJ9J306nUzO03wXRrIjg5RCKptJbagCffKqV
3HIHMSWenBkhVSLlqictlUc=
=ccl2
-----END PGP SIGNATURE-----