Sync with Arch vanilla kernel changes, various changes

4 files changed, 184 insertions, 24 deletions

diff --git a/.SRCINFO b/.SRCINFO
index feccde76e4ac..13c1444f3ecb 100755
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,4 +1,5 @@
 pkgbase = linux-bcachefs-git
+	pkgdesc = Linux
 	pkgver = 5.2.21.arch1.r844589.e96bfb9bc2c1
 	pkgrel = 1
 	url = https://github.com/koverstreet/bcachefs
@@ -25,7 +26,7 @@ pkgbase = linux-bcachefs-git
 	sha512sums = d9519955c66275dbb8a1b056eb799b97387fab4cadb96de3a400cef7ec39f6a3ad0228c6deb24401f4ad65ffb6ed6173b27f453a1edf9c5e2a36c3a46851d4a8
 
 pkgname = linux-bcachefs-git
-	pkgdesc = The Linux-bcachefs-git kernel and modules ~ featuring Kent Overstreet's bcachefs filesystem
+	pkgdesc = The Linux kernel and modules ~ featuring Kent Overstreet's bcachefs filesystem
 	depends = coreutils
 	depends = kmod
 	depends = initramfs
@@ -35,13 +36,13 @@ pkgname = linux-bcachefs-git
 	provides = linux-bcachefs-git=5.2.21.arch1.r844589.e96bfb9bc2c1
 
 pkgname = linux-bcachefs-git-headers
-	pkgdesc = Header files and scripts for building modules for Linux-bcachefs-git kernel ~ featuring Kent Overstreet's bcachefs filesystem
+	pkgdesc = Header files and scripts for building modules for Linux kernel ~ featuring Kent Overstreet's bcachefs filesystem
 	depends = linux-bcachefs-git=5.2.21.arch1.r844589.e96bfb9bc2c1
 	provides = linux-bcachefs-git-headers=5.2.21.arch1.r844589.e96bfb9bc2c1
 	provides = linux-headers=5.2.21.arch1.r844589.e96bfb9bc2c1
 
 pkgname = linux-bcachefs-git-docs
-	pkgdesc = Kernel hackers manual - HTML documentation that comes with the Linux-bcachefs-git kernel ~ featuring Kent Overstreet's bcachefs filesystem
+	pkgdesc = Kernel hacker's manual for the Linux kernel ~ featuring Kent Overstreet's bcachefs filesystem
 	depends = linux-bcachefs-git=5.2.21.arch1.r844589.e96bfb9bc2c1
 	provides = linux-bcachefs-git-docs=5.2.21.arch1.r844589.e96bfb9bc2c1
 	provides = linux-docs=5.2.21.arch1.r844589.e96bfb9bc2c1
diff --git a/7e6c7c0d56e1342b9ad5d8071736a5851d1ae1c7.patch b/7e6c7c0d56e1342b9ad5d8071736a5851d1ae1c7.patch
new file mode 100644
index 000000000000..07094b1db378
--- /dev/null
+++ b/7e6c7c0d56e1342b9ad5d8071736a5851d1ae1c7.patch
@@ -0,0 +1,57 @@
+From 7e6c7c0d56e1342b9ad5d8071736a5851d1ae1c7 Mon Sep 17 00:00:00 2001
+From: "Jan Alexander Steffens (heftig)" <jan.steffens@gmail.com>
+Date: Thu, 7 Dec 2017 13:50:48 +0100
+Subject: ZEN: Add CONFIG for unprivileged_userns_clone
+
+This way our default behavior continues to match the vanilla kernel.
+---
+ init/Kconfig            | 16 ++++++++++++++++
+ kernel/user_namespace.c |  4 ++++
+ 2 files changed, 20 insertions(+)
+
+diff --git a/init/Kconfig b/init/Kconfig
+index 4592bf7997c0..f3df02990aff 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1004,6 +1004,22 @@ config USER_NS
+ 
+ 	  If unsure, say N.
+ 
++config USER_NS_UNPRIVILEGED
++	bool "Allow unprivileged users to create namespaces"
++	default y
++	depends on USER_NS
++	help
++	  When disabled, unprivileged users will not be able to create
++	  new namespaces. Allowing users to create their own namespaces
++	  has been part of several recent local privilege escalation
++	  exploits, so if you need user namespaces but are
++	  paranoid^Wsecurity-conscious you want to disable this.
++
++	  This setting can be overridden at runtime via the
++	  kernel.unprivileged_userns_clone sysctl.
++
++	  If unsure, say Y.
++
+ config PID_NS
+ 	bool "PID Namespaces"
+ 	default y
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index 6b9dbc257e34..107b17f0d528 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -27,7 +27,11 @@
+ #include <linux/sort.h>
+ 
+ /* sysctl */
++#ifdef CONFIG_USER_NS_UNPRIVILEGED
++int unprivileged_userns_clone = 1;
++#else
+ int unprivileged_userns_clone;
++#endif
+ 
+ static struct kmem_cache *user_ns_cachep __read_mostly;
+ static DEFINE_MUTEX(userns_state_mutex);
+-- 
+cgit v1.2.1-1-g437b
+
diff --git a/PKGBUILD b/PKGBUILD
index 10121cd4ae29..71cfb98deb66 100755
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -61,7 +61,8 @@ _localmodcfg=
 pkgbase=linux-bcachefs-git
 pkgver=5.2.21.arch1.r844589.e96bfb9bc2c1
 pkgrel=1
-_srcver_tag=5.2.21-arch1
+pkgdesc="Linux"
+_srcver_tag=v5.2.21-arch1
 url="https://github.com/koverstreet/bcachefs"
 arch=(x86_64)
 license=(GPL2)
@@ -94,8 +95,8 @@ source=(
     config         # the main kernel config file
 )
 validpgpkeys=(
-    'ABAF11C65A2970B130ABE3C479BE3E4300411886'  # Linus Torvalds
-    '647F28654894E3BD457199BE38DBBDC86092693E'  # Greg Kroah-Hartman
+    "ABAF11C65A2970B130ABE3C479BE3E4300411886"  # Linus Torvalds
+    "647F28654894E3BD457199BE38DBBDC86092693E"  # Greg Kroah-Hartman
 )
 sha512sums=('SKIP'
             'SKIP'
@@ -103,7 +104,7 @@ sha512sums=('SKIP'
 
 export KBUILD_BUILD_HOST=archlinux
 export KBUILD_BUILD_USER=$pkgbase
-export KBUILD_BUILD_TIMESTAMP="@${SOURCE_DATE_EPOCH:-$(date +%s)}"
+export KBUILD_BUILD_TIMESTAMP="$(date -Ru${SOURCE_DATE_EPOCH:+d @$SOURCE_DATE_EPOCH})"
 
 pkgver() {
     cd "$_reponame"
@@ -120,26 +121,26 @@ prepare() {
 
     msg2 "Adding patches from Linux upstream kernel repository..."
     git remote add upstream_stable "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git" || true
-    # git pull --no-edit -s recursive -X ours upstream_stable v${_srcver_tag//-arch*/}
-    git pull --no-edit upstream_stable v${_srcver_tag//-arch*/}
-
+    # git pull --no-edit -s recursive -X ours upstream_stable ${_srcver_tag//-arch*/}
+    git pull --no-edit upstream_stable ${_srcver_tag//-arch*/}
+    
+    # Revert broken commit for now, until bcachefs upstream fixes it
     # https://github.com/koverstreet/bcachefs/issues/74
-    git revert --no-edit c785529bebceeaf38db8ebf9b50ff3a173fb18c6
     # https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v5.2.1&id=c785529bebceeaf38db8ebf9b50ff3a173fb18c6
-    # block: fix .bi_size overflow    
+    # block: fix .bi_size overflow
+    git revert --no-edit c785529bebceeaf38db8ebf9b50ff3a173fb18c6
 
-    msg2 "Adding patches from Arch Linux kernel repository..."
-    git remote add arch_stable "https://git.archlinux.org/linux.git" || true
-    # git pull --no-edit arch_stable "v$_srcver_tag"
-    git fetch arch_stable v5.2.14-arch2
+    # msg2 "Pull stable releases from Arch vanilla kernel repository..."
+    # git remote add arch_stable "https://git.archlinux.org/linux.git" || true
+    # git pull --no-edit arch_stable "$_srcver_tag"
 
-    git cherry-pick 7097880bd7857294d2b91084a35d2211cef7dd8b
     # https://git.archlinux.org/linux.git/commit/?h=v5.1.16-arch1&id=fd0f4757ded3627edc883650941a26a21e435a7d
     # add sysctl to disallow unprivileged CLONE_NEWUSER by default
-
-    git cherry-pick de96c660ed1f470fed317e987444634cb6287d57
+    patch -Np1 -i "$srcdir/fd0f4757ded3627edc883650941a26a21e435a7d.patch"
+    
     # https://git.archlinux.org/linux.git/commit/?h=v5.1.16-arch1&id=7e6c7c0d56e1342b9ad5d8071736a5851d1ae1c7
     # ZEN: Add CONFIG for unprivileged_userns_clone
+    patch -Np1 -i "$srcdir/7e6c7c0d56e1342b9ad5d8071736a5851d1ae1c7.patch"
 
     msg2 "Fixing EXTRAVERSION..."
     sed -i 's/EXTRAVERSION =/EXTRAVERSION = -arch1/g' "$srcdir/$_reponame/Makefile"
@@ -187,7 +188,7 @@ build() {
 }
 
 _package() {
-    pkgdesc="The ${pkgbase/linux/Linux} kernel and modules $_pkgdesc_extra"
+    pkgdesc="The $pkgdesc kernel and modules $_pkgdesc_extra"
     depends=(
         coreutils
         kmod
@@ -223,7 +224,7 @@ _package() {
 }
 
 _package-headers() {
-    pkgdesc="Header files and scripts for building modules for ${pkgbase/linux/Linux} kernel $_pkgdesc_extra"
+    pkgdesc="Header files and scripts for building modules for $pkgdesc kernel $_pkgdesc_extra"
     depends=("$pkgbase=$pkgver")
     provides=(
         "$pkgbase-headers=$pkgver"
@@ -306,7 +307,7 @@ _package-headers() {
 }
 
 _package-docs() {
-    pkgdesc="Kernel hackers manual - HTML documentation that comes with the ${pkgbase/linux/Linux} kernel $_pkgdesc_extra"
+    pkgdesc="Kernel hacker's manual for the $pkgdesc kernel $_pkgdesc_extra"
     depends=("$pkgbase=$pkgver")
     provides=(
         "$pkgbase-docs=$pkgver"
@@ -320,8 +321,8 @@ _package-docs() {
     mkdir -p "$builddir"
     cp -t "$builddir" -a Documentation
 
-    msg2 "Removing doctrees..."
-    rm -r "$builddir/Documentation/output/.doctrees"
+    msg2 "Removing unneeded files..."
+    rm -rv "$builddir"/Documentation/{,output/}.[^.]*
 
     msg2 "Moving HTML docs..."
     local src dst
diff --git a/fd0f4757ded3627edc883650941a26a21e435a7d.patch b/fd0f4757ded3627edc883650941a26a21e435a7d.patch
new file mode 100644
index 000000000000..a7e77401ed6c
--- /dev/null
+++ b/fd0f4757ded3627edc883650941a26a21e435a7d.patch
@@ -0,0 +1,101 @@
+From fd0f4757ded3627edc883650941a26a21e435a7d Mon Sep 17 00:00:00 2001
+From: Serge Hallyn <serge.hallyn@canonical.com>
+Date: Fri, 31 May 2013 19:12:12 +0100
+Subject: add sysctl to disallow unprivileged CLONE_NEWUSER by default
+
+Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
+[bwh: Remove unneeded binary sysctl bits]
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ kernel/fork.c           | 15 +++++++++++++++
+ kernel/sysctl.c         | 12 ++++++++++++
+ kernel/user_namespace.c |  3 +++
+ 3 files changed, 30 insertions(+)
+
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 2628f3773ca8..a2da35b446a6 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -103,6 +103,11 @@
+ 
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/task.h>
++#ifdef CONFIG_USER_NS
++extern int unprivileged_userns_clone;
++#else
++#define unprivileged_userns_clone 0
++#endif
+ 
+ /*
+  * Minimum number of threads to boot the kernel
+@@ -1719,6 +1724,10 @@ static __latent_entropy struct task_struct *copy_process(
+ 	if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
+ 		return ERR_PTR(-EINVAL);
+ 
++	if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone)
++		if (!capable(CAP_SYS_ADMIN))
++			return ERR_PTR(-EPERM);
++
+ 	/*
+ 	 * Thread groups must share signals as well, and detached threads
+ 	 * can only be started up within the thread group.
+@@ -2554,6 +2563,12 @@ int ksys_unshare(unsigned long unshare_flags)
+ 	if (unshare_flags & CLONE_NEWNS)
+ 		unshare_flags |= CLONE_FS;
+ 
++	if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) {
++		err = -EPERM;
++		if (!capable(CAP_SYS_ADMIN))
++			goto bad_unshare_out;
++	}
++
+ 	err = check_unshare_flags(unshare_flags);
+ 	if (err)
+ 		goto bad_unshare_out;
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 387efbaf464a..b393beb76f34 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -108,6 +108,9 @@ extern int core_uses_pid;
+ extern char core_pattern[];
+ extern unsigned int core_pipe_limit;
+ #endif
++#ifdef CONFIG_USER_NS
++extern int unprivileged_userns_clone;
++#endif
+ extern int pid_max;
+ extern int pid_max_min, pid_max_max;
+ extern int percpu_pagelist_fraction;
+@@ -535,6 +538,15 @@ static struct ctl_table kern_table[] = {
+ 		.proc_handler	= proc_dointvec,
+ 	},
+ #endif
++#ifdef CONFIG_USER_NS
++	{
++		.procname	= "unprivileged_userns_clone",
++		.data		= &unprivileged_userns_clone,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec,
++	},
++#endif
+ #ifdef CONFIG_PROC_SYSCTL
+ 	{
+ 		.procname	= "tainted",
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index 923414a246e9..6b9dbc257e34 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -26,6 +26,9 @@
+ #include <linux/bsearch.h>
+ #include <linux/sort.h>
+ 
++/* sysctl */
++int unprivileged_userns_clone;
++
+ static struct kmem_cache *user_ns_cachep __read_mostly;
+ static DEFINE_MUTEX(userns_state_mutex);
+ 
+-- 
+cgit v1.2.1-1-g437b
+