source: chapter10/kernel.xml@ c8df034

11.1 11.1-rc1 11.2 11.2-rc1 11.3 11.3-rc1 12.0 12.0-rc1 12.1-rc1 arm bdubbs/gcc13 multilib renodr/libudev-from-systemd s6-init trunk xry111/arm64 xry111/arm64-12.0 xry111/clfs-ng xry111/lfs-next xry111/loongarch xry111/loongarch-12.0 xry111/pip3 xry111/rust-wip-20221008 xry111/update-glibc
Last change on this file since c8df034 was c8df034, checked in by Douglas R. Reno <renodr@…>, 2 years ago

Fix CVE-2021-3997 in systemd.

  • Property mode set to 100644
File size: 17.2 KB
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "" [
4 <!ENTITY % general-entities SYSTEM "../general.ent">
5 %general-entities;
8<sect1 id="ch-bootable-kernel" role="wrap">
9 <?dbhtml filename="kernel.html"?>
11 <sect1info condition="script">
12 <productname>kernel</productname>
13 <productnumber>&linux-version;</productnumber>
14 <address>&linux-url;</address>
15 </sect1info>
17 <title>Linux-&linux-version;</title>
19 <indexterm zone="ch-bootable-kernel">
20 <primary sortas="a-Linux">Linux</primary>
21 </indexterm>
23 <sect2 role="package">
24 <title/>
26 <para>The Linux package contains the Linux kernel.</para>
28 <segmentedlist>
29 <segtitle>&buildtime;</segtitle>
30 <segtitle>&diskspace;</segtitle>
32 <seglistitem>
33 <seg>&linux-knl-sbu;</seg>
34 <seg>&linux-knl-du;</seg>
35 </seglistitem>
36 </segmentedlist>
38 </sect2>
40 <sect2 role="installation">
41 <title>Installation of the kernel</title>
43 <para>Building the kernel involves a few steps&mdash;configuration,
44 compilation, and installation. Read the <filename>README</filename> file
45 in the kernel source tree for alternative methods to the way this book
46 configures the kernel.</para>
48 <para>Prepare for compilation by running the following command:</para>
50<screen><userinput remap="pre">make mrproper</userinput></screen>
52 <para>This ensures that the kernel tree is absolutely clean. The
53 kernel team recommends that this command be issued prior to each
54 kernel compilation. Do not rely on the source tree being clean after
55 un-tarring.</para>
57 <para>There are several ways to configure the kernel options. Usually,
58 This is done through a menu-driven interface, for example:</para>
60<screen role="nodump"><userinput>make menuconfig</userinput></screen>
62 <variablelist>
63 <title>The meaning of optional make environment variables:</title>
65 <varlistentry>
66 <term><parameter>LANG=&lt;host_LANG_value&gt; LC_ALL=</parameter></term>
67 <listitem>
68 <para>This establishes the locale setting to the one used on the
69 host. This may be needed for a proper menuconfig ncurses interface
70 line drawing on a UTF-8 linux text console.</para>
72 <para>If used, be sure to replace
73 <replaceable>&lt;host_LANG_value&gt;</replaceable> by the value of
74 the <envar>$LANG</envar> variable from your host. You can
75 alternatively use instead the host's value of <envar>$LC_ALL</envar>
76 or <envar>$LC_CTYPE</envar>.</para>
77 </listitem>
78 </varlistentry>
80 <varlistentry>
81 <term><command>make menuconfig</command></term>
82 <listitem>
83 <para>This launches an ncurses menu-driven interface. For other
84 (graphical) interfaces, type <command>make help</command>.</para>
85 </listitem>
86 </varlistentry>
87 </variablelist>
89 <!-- Support for compiling a keymap into the kernel is deliberately removed -->
91 <para>For general information on kernel configuration see <ulink
92 url="&hints-root;kernel-configuration.txt"/>. BLFS has some information
93 regarding particular kernel configuration requirements of packages outside
94 of LFS at <ulink
95 url="&blfs-book;longindex.html#kernel-config-index"/>. Additional
96 information about configuring and building the kernel can be found at
97 <ulink url=""/> </para>
99 <note>
100 <para>A good starting place for setting up the kernel configuration is to
101 run <command>make defconfig</command>. This will set the base
102 configuration to a good state that takes your current system architecture
103 into account.</para>
105 <para>Be sure to enable/disable/set the following features or the system might
106 not work correctly or boot at all:</para>
108 <screen role="nodump" revision="sysv">General setup -->
109 &lt; &gt; Enable kernel headers through /sys/kernel/kheaders.tar.xz [CONFIG_IKHEADERS]
110Device Drivers ---&gt;
111 Graphics support ---&gt;
112 Frame buffer Devices ---&gt;
113 [*] Support for frame buffer devices ----
114 Generic Driver Options ---&gt;
115 [ ] Support for uevent helper [CONFIG_UEVENT_HELPER]
116 [*] Maintain a devtmpfs filesystem to mount at /dev [CONFIG_DEVTMPFS]</screen>
118 <screen role="nodump" revision="systemd">General setup -->
119 [ ] Auditing Support [CONFIG_AUDIT]
120 &lt; &gt; Enable kernel headers through /sys/kernel/kheaders.tar.xz [CONFIG_IKHEADERS]
121 [*] Control Group support [CONFIG_CGROUPS]
122 [ ] Enable deprecated sysfs features to support old userspace tools [CONFIG_SYSFS_DEPRECATED]
123 [*] Configure standard kernel features (expert users) [CONFIG_EXPERT] ---&gt;
124 [*] open by fhandle syscalls [CONFIG_FHANDLE]
125 CPU/Task time and stats accounting ---&gt;
126 [*] Pressure stall information tracking [CONFIG_PSI]
127Firmware Drivers ---&gt;
128 [*] Export DMI identification via sysfs to userspace [CONFIG_DMIID]
129General architecture-dependent options ---&gt;
130 [*] Enable seccomp to safely compute untrusted bytecode [CONFIG_SECCOMP]
131Networking support ---&gt;
132 Networking options ---&gt;
133 &lt;*&gt; The IPv6 protocol [CONFIG_IPV6]
134Device Drivers ---&gt;
135 Graphics support ---&gt;
136 Frame buffer Devices ---&gt;
137 [*] Support for frame buffer devices ----
138 Generic Driver Options ---&gt;
139 [ ] Support for uevent helper [CONFIG_UEVENT_HELPER]
140 [*] Maintain a devtmpfs filesystem to mount at /dev [CONFIG_DEVTMPFS]
141 Firmware Loader ---&gt;
142 [ ] Enable the firmware sysfs fallback mechanism [CONFIG_FW_LOADER_USER_HELPER]
143File systems ---&gt;
144 [*] Inotify support for userspace [CONFIG_INOTIFY_USER]
145 Pseudo filesystems ---&gt;
146 [*] Tmpfs POSIX Access Control Lists [CONFIG_TMPFS_POSIX_ACL]</screen>
147 </note>
149 <note revision="systemd">
150 <para>While "The IPv6 Protocol" is not strictly
151 required, it is highly recommended by the systemd developers.</para>
152 </note>
154 <para revision="sysv">There are several other options that may be desired
155 depending on the requirements for the system. For a list of options needed
156 for BLFS packages, see the <ulink
157 url="&lfs-root;blfs/view/&short-version;/longindex.html#kernel-config-index">BLFS
158 Index of Kernel Settings</ulink>
159 (&lfs-root;blfs/view/&short-version;/longindex.html#kernel-config-index).</para>
161 <note>
162 <para>If your host hardware is using UEFI and you wish to boot the
163 LFS system with it, you should adjust some kernel configuration
164 following <ulink url="&blfs-book;postlfs/grub-setup.html#uefi-kernel">
165 the BLFS page</ulink>.</para>
166 </note>
168 <variablelist>
169 <title>The rationale for the above configuration items:</title>
171 <varlistentry>
172 <term>
173 <parameter>
174 Enable kernel headers through /sys/kernel/kheaders.tar.xz
175 </parameter>
176 </term>
177 <listitem>
178 <para>This will require <command>cpio</command> building the kernel.
179 <command>cpio</command> is not installed by LFS.</para>
180 </listitem>
181 </varlistentry>
183 <varlistentry>
184 <term><parameter>Support for uevent helper</parameter></term>
185 <listitem>
186 <para>Having this option set may interfere with device
187 management when using Udev/Eudev. </para>
188 </listitem>
189 </varlistentry>
191 <varlistentry>
192 <term><parameter>Maintain a devtmpfs</parameter></term>
193 <listitem>
194 <para>This will create automated device nodes which are populated by the
195 kernel, even without Udev running. Udev then runs on top of this,
196 managing permissions and adding symlinks. This configuration
197 item is required for all users of Udev/Eudev.</para>
198 </listitem>
199 </varlistentry>
201 </variablelist>
203 <para>Alternatively, <command>make oldconfig</command> may be more
204 appropriate in some situations. See the <filename>README</filename>
205 file for more information.</para>
207 <para>If desired, skip kernel configuration by copying the kernel
208 config file, <filename>.config</filename>, from the host system
209 (assuming it is available) to the unpacked <filename
210 class="directory">linux-&linux-version;</filename> directory. However,
211 we do not recommend this option. It is often better to explore all the
212 configuration menus and create the kernel configuration from
213 scratch.</para>
215 <para>Compile the kernel image and modules:</para>
217<screen><userinput remap="make">make</userinput></screen>
219 <para>If using kernel modules, module configuration in <filename
220 class="directory">/etc/modprobe.d</filename> may be required.
221 Information pertaining to modules and kernel configuration is
222 located in <xref linkend="ch-config-udev"/> and in the kernel
223 documentation in the <filename
224 class="directory">linux-&linux-version;/Documentation</filename> directory.
225 Also, <filename>modprobe.d(5)</filename> may be of interest.</para>
227 <para>Unless module support has been disabled in the kernel configuration,
228 install the modules with:</para>
230<screen><userinput remap="install">make modules_install</userinput></screen>
232 <para>After kernel compilation is complete, additional steps are
233 required to complete the installation. Some files need to be copied to
234 the <filename class="directory">/boot</filename> directory.</para>
236 <caution>
237 <para>If the host system has a separate /boot partition, the files copied
238 below should go there. The easiest way to do that is to bind /boot on the
239 host (outside chroot) to /mnt/lfs/boot before proceeding. As the root
240 user in the <emphasis>host system</emphasis>:</para>
242<screen role="nodump"><userinput>mount --bind /boot /mnt/lfs/boot</userinput></screen>
243 </caution>
245 <para>The path to the kernel image may vary depending on the platform being
246 used. The filename below can be changed to suit your taste, but the stem of
247 the filename should be <emphasis>vmlinuz</emphasis> to be compatible with
248 the automatic setup of the boot process described in the next section. The
249 following command assumes an x86 architecture:</para>
251<screen><userinput remap="install">cp -iv arch/x86/boot/bzImage /boot/vmlinuz-&linux-version;-lfs-&version;</userinput></screen>
253 <para><filename></filename> is a symbol file for the kernel.
254 It maps the function entry points of every function in the kernel API,
255 as well as the addresses of the kernel data structures for the running
256 kernel. It is used as a resource when investigating kernel problems.
257 Issue the following command to install the map file:</para>
259<screen><userinput remap="install">cp -iv /boot/;</userinput></screen>
261 <para>The kernel configuration file <filename>.config</filename>
262 produced by the <command>make menuconfig</command> step
263 above contains all the configuration selections for the kernel
264 that was just compiled. It is a good idea to keep this file for future
265 reference:</para>
267<screen><userinput remap="install">cp -iv .config /boot/config-&linux-version;</userinput></screen>
269 <para>Install the documentation for the Linux kernel:</para>
271<screen><userinput remap="install">install -d /usr/share/doc/linux-&linux-version;
272cp -r Documentation/* /usr/share/doc/linux-&linux-version;</userinput></screen>
274 <para>It is important to note that the files in the kernel source
275 directory are not owned by <emphasis>root</emphasis>. Whenever a
276 package is unpacked as user <emphasis>root</emphasis> (like we did
277 inside chroot), the files have the user and group IDs of whatever
278 they were on the packager's computer. This is usually not a problem
279 for any other package to be installed because the source tree is
280 removed after the installation. However, the Linux source tree is
281 often retained for a long time. Because of this, there is a chance
282 that whatever user ID the packager used will be assigned to somebody
283 on the machine. That person would then have write access to the kernel
284 source.</para>
286 <note>
287 <para>In many cases, the configuration of the kernel will need to be
288 updated for packages that will be installed later in BLFS. Unlike
289 other packages, it is not necessary to remove the kernel source tree
290 after the newly built kernel is installed.</para>
292 <para>If the kernel source tree is going to be retained, run
293 <command>chown -R 0:0</command> on the <filename
294 class="directory">linux-&linux-version;</filename> directory to ensure
295 all files are owned by user <emphasis>root</emphasis>.</para>
296 </note>
298 <warning>
299 <para>Some kernel documentation recommends creating a symlink from
300 <filename class="symlink">/usr/src/linux</filename> pointing to the kernel
301 source directory. This is specific to kernels prior to the 2.6 series and
302 <emphasis>must not</emphasis> be created on an LFS system as it can cause
303 problems for packages you may wish to build once your base LFS system is
304 complete.</para>
305 </warning>
307 <warning>
308 <para>The headers in the system's <filename
309 class="directory">include</filename> directory (<filename
310 class="directory">/usr/include</filename>) should
311 <emphasis>always</emphasis> be the ones against which Glibc was compiled,
312 that is, the sanitised headers installed in <xref
313 linkend="ch-tools-linux-headers"/>. Therefore, they should
314 <emphasis>never</emphasis> be replaced by either the raw kernel headers
315 or any other kernel sanitized headers.</para>
316 </warning>
318 </sect2>
320 <sect2 id="conf-modprobe" role="configuration">
321 <title>Configuring Linux Module Load Order</title>
323 <indexterm zone="conf-modprobe">
324 <primary sortas="e-/etc/modprobe.d/usb.conf">/etc/modprobe.d/usb.conf</primary>
325 </indexterm>
327 <para>Most of the time Linux modules are loaded automatically, but
328 sometimes it needs some specific direction. The program that loads
329 modules, <command>modprobe</command> or <command>insmod</command>, uses
330 <filename>/etc/modprobe.d/usb.conf</filename> for this purpose. This file
331 needs to be created so that if the USB drivers (ehci_hcd, ohci_hcd and
332 uhci_hcd) have been built as modules, they will be loaded in the correct
333 order; ehci_hcd needs to be loaded prior to ohci_hcd and uhci_hcd in order
334 to avoid a warning being output at boot time.</para>
336 <para>Create a new file <filename>/etc/modprobe.d/usb.conf</filename> by running
337 the following:</para>
339<screen><userinput>install -v -m755 -d /etc/modprobe.d
340cat &gt; /etc/modprobe.d/usb.conf &lt;&lt; "EOF"
341<literal># Begin /etc/modprobe.d/usb.conf
343install ohci_hcd /sbin/modprobe ehci_hcd ; /sbin/modprobe -i ohci_hcd ; true
344install uhci_hcd /sbin/modprobe ehci_hcd ; /sbin/modprobe -i uhci_hcd ; true
346# End /etc/modprobe.d/usb.conf</literal>
349 </sect2>
351 <sect2 id="contents-kernel" role="content">
352 <title>Contents of Linux</title>
354 <segmentedlist>
355 <segtitle>Installed files</segtitle>
356 <segtitle>Installed directories</segtitle>
358 <seglistitem>
359 <seg>config-&linux-version;,
360 vmlinuz-&linux-version;-lfs-&version;,
361 and;</seg>
362 <seg>/lib/modules, /usr/share/doc/linux-&linux-version;</seg>
363 </seglistitem>
364 </segmentedlist>
366 <variablelist>
367 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
368 <?dbfo list-presentation="list"?>
369 <?dbhtml list-presentation="table"?>
371 <varlistentry id="config">
372 <term><filename>config-&linux-version;</filename></term>
373 <listitem>
374 <para>Contains all the configuration selections for the kernel</para>
375 <indexterm zone="ch-bootable-kernel config">
376 <primary sortas="e-/boot/config">/boot/config-&linux-version;</primary>
377 </indexterm>
378 </listitem>
379 </varlistentry>
381 <varlistentry id="lfskernel">
382 <term><filename>vmlinuz-&linux-version;-lfs-&version;</filename></term>
383 <listitem>
384 <para>The engine of the Linux system. When turning on the computer,
385 the kernel is the first part of the operating system that gets loaded.
386 It detects and initializes all components of the computer's hardware,
387 then makes these components available as a tree of files to the
388 software and turns a single CPU into a multitasking machine capable
389 of running scores of programs seemingly at the same time</para>
390 <indexterm zone="ch-bootable-kernel lfskernel">
391 <primary sortas="b-lfskernel">lfskernel-&linux-version;</primary>
392 </indexterm>
393 </listitem>
394 </varlistentry>
396 <varlistentry id="">
397 <term><filename>;</filename></term>
398 <listitem>
399 <para>A list of addresses and symbols; it maps the entry points and
400 addresses of all the functions and data structures in the
401 kernel</para>
402 <indexterm zone="ch-bootable-kernel">
403 <primary sortas="e-/boot/">/boot/;</primary>
404 </indexterm>
405 </listitem>
406 </varlistentry>
408 </variablelist>
410 </sect2>
Note: See TracBrowser for help on using the repository browser.