From: Dinko Korunic Date: Thu, 28 Apr 2011 12:44:55 +0000 (+0200) Subject: - #14002: kernel-2.6-cn/lenny: koristiti /etc/sysctl.d/ X-Git-Tag: v2.6.32.1~11 X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=commitdiff_plain;h=9b2edd524c22426f9e0f3a8a3e870709679ce5c8;p=kernel-cn.git - #14002: kernel-2.6-cn/lenny: koristiti /etc/sysctl.d/ - update paketa za Squeeze - lintian fixevi - Grub2 kompatibilnost --- diff --git a/50-carnet.conf b/50-carnet.conf new file mode 100644 index 0000000..81d1682 --- /dev/null +++ b/50-carnet.conf @@ -0,0 +1,28 @@ +kernel.core_pattern=%e-%h-%p.core +kernel.maps_protect=1 +kernel.printk=4 4 1 7 +kernel.sysrq=1 +net.ipv4.conf.all.accept_redirects=0 +net.ipv4.conf.all.accept_source_route=0 +net.ipv4.conf.all.log_martians=1 +net.ipv4.conf.all.rp_filter=1 +net.ipv4.conf.all.secure_redirects=1 +net.ipv4.conf.all.send_redirects=0 +net.ipv4.conf.eth0.accept_redirects=0 +net.ipv4.conf.eth0.accept_source_route=0 +net.ipv4.conf.eth0.log_martians=1 +net.ipv4.conf.eth0.rp_filter=1 +net.ipv4.conf.eth0.secure_redirects=1 +net.ipv4.conf.eth0.send_redirects=0 +net.ipv4.icmp_echo_ignore_broadcasts=1 +net.ipv4.icmp_ignore_bogus_error_responses=1 +net.ipv4.tcp_congestion_control=cubic +net.ipv4.tcp_ecn=0 +net.ipv4.tcp_max_syn_backlog=2048 +net.ipv4.tcp_mtu_probing=1 +net.ipv4.tcp_retries1=2 +net.ipv4.tcp_rfc1337=1 +net.ipv4.tcp_syncookies=1 +vm.min_free_kbytes=10240 +vm.mmap_min_addr=65536 +vm.swappiness=61 diff --git a/NEWS.CARNet b/NEWS.CARNet index 5e49943..e4069c7 100644 --- a/NEWS.CARNet +++ b/NEWS.CARNet @@ -44,4 +44,4 @@ najbitnije: Vjerujemo da ce navedena promjena, zbog brzog odziva Debianovog sigurnosnog tima, znaciti i povecanu sigurnost nasih i vasih posluzitelja. - -- Dinko Korunic Tue, 23 Feb 2010 14:27:54 +0100 + -- Dinko Korunic Thu, 28 Apr 2011 09:40:26 +0200 diff --git a/README.CARNet b/README.CARNet index f3a2641..79e1a77 100644 --- a/README.CARNet +++ b/README.CARNet @@ -30,4 +30,4 @@ Datoteke koje se mijenjaju uvjetno ili bezuvjetno: /vmlinuz /vmlinuz.old /boot/vmlinuz.plain -> eliminacija starih i zaostalih symlinkova - -- Dinko Korunic Fri, 19 Feb 2010 16:34:30 +0100 + -- Dinko Korunic Thu, 28 Apr 2011 09:40:36 +0200 diff --git a/changelog.CARNet b/changelog.CARNet deleted file mode 120000 index 194579e..0000000 --- a/changelog.CARNet +++ /dev/null @@ -1 +0,0 @@ -changelog.Debian \ No newline at end of file diff --git a/debian/changelog b/debian/changelog index 3f9eec1..6e1c7fe 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,12 @@ +kernel-2.6-cn (3:2.6.32.1) stable; urgency=low + + * #14002: kernel-2.6-cn/lenny: koristiti /etc/sysctl.d/ + * update paketa za Squeeze + * lintian fixevi + * Grub2 kompatibilnost + + -- Dinko Korunic Thu, 28 Apr 2011 09:41:53 +0200 + kernel-2.6-cn (3:2.6.26.6) stable; urgency=low * #10170: ukloniti konflikte s prethodnim kernelom diff --git a/debian/compat b/debian/compat index b8626c4..7f8f011 100644 --- a/debian/compat +++ b/debian/compat @@ -1 +1 @@ -4 +7 diff --git a/debian/control b/debian/control index aa7646d..a0a36ff 100644 --- a/debian/control +++ b/debian/control @@ -2,13 +2,13 @@ Source: kernel-2.6-cn Section: base Priority: required Maintainer: Dinko Korunic -Build-Depends: debhelper (>= 4) -Standards-Version: 3.8.0 +Build-Depends: debhelper (>= 7), po-debconf +Standards-Version: 3.9.1 Package: kernel-2.6-cn Architecture: all Section: admin -Depends: grub (>= 0.97-47lenny2), procps (>= 1:3.2.7-11), udev (>= 0.125-7+lenny1), carnet-tools-cn (>= 2.8.2), module-init-tools (>= 3.4-1), mount (>= 2.13.1.1-1), e2fsprogs (>= 1.41.3-1), microcode.ctl (>= 1.17-9), irqbalance (>= 0.55-2.4lenny1), mdadm (>= 2.6.7.2-1), firmware-bnx2 (>= 0.14+lenny1), linux-image-686-bigmem | linux-image-amd64, debconf +Depends: grub (>= 0.97-64) | grub-pc (>= 1.98+20100804-14), procps (>= 1:3.2.8-9), udev (>= 164-3), carnet-tools-cn (>= 2.8.2), module-init-tools (>= 3.12-1), mount (>= 2.17.2-9), e2fsprogs (>= 1.41.12-2), microcode.ctl (>= 1.17-13), irqbalance (>= 0.56-1), mdadm (>= 3.1.4-1+8efb9d1), firmware-bnx2 (>= 0.28), linux-image-686-bigmem | linux-image-amd64, debconf, ${misc:Depends} Conflicts: iplogger, kernel-cn, kernel-2.4-cn (<< 2.4.33-2), linux-image-2.6.26-2+cn1-486, linux-image-2.6.26-2+cn1-686, linux-image-2.6.26-2+cn1-686-bigmem, linux-image-2.6.26-2+cn1-amd64 Replaces: kernel-cn, kernel-2.4-cn Provides: kernel-cn diff --git a/debian/docs b/debian/docs index 878b263..aeba979 100644 --- a/debian/docs +++ b/debian/docs @@ -1,3 +1,2 @@ -changelog.CARNet README.CARNet NEWS.CARNet diff --git a/debian/install b/debian/install index 07aa51a..b39c106 100644 --- a/debian/install +++ b/debian/install @@ -1 +1,2 @@ grub-functions.sh usr/share/kernel-2.6-cn +50-carnet.conf /etc/sysctl.d diff --git a/debian/postinst b/debian/postinst index e6d7b0a..7e0d953 100755 --- a/debian/postinst +++ b/debian/postinst @@ -74,7 +74,7 @@ echo "CN: Removed old symlinks in / and /boot." DIVERT_TO="grub grub-probe" -echo -n "CN: Undiverting binaries:" +echo -n "CN: Undiverting binaries if necessary:" for i in $DIVERT_TO; do if [ -e /usr/sbin/$i.real ]; then dpkg-divert --remove --rename --package 'kernel-2.6-cn' \ @@ -86,6 +86,21 @@ echo "." ################################################################################ +# detect existing Grub2 installation + +GRUB2="no" +if [ -e /boot/grub/grub.cfg ]; + echo "CN: Detected GRUB2 installation, will try to use it." + GRUB2="yes" + if [ -e /boot/grub/menu.lst ]; then + echo "CN: Oops, GRUB1 (Legacy) installation detected. Will try to upgrade to GRUB2." + fi +else + echo "CN: No GRUB2 detected, will continue with GRUB1 as default option." +fi + +################################################################################ + # intro msg echo -n "CN: Configuring system (this will take a while):" @@ -94,7 +109,7 @@ if [ ! -e /etc/kernel-img.conf ]; then touch /etc/kernel-img.conf fi -# update postinst_hook for grub +# update postinst_hook for grub/grub2 if grep -q postinst_hook /etc/kernel-img.conf; then cp_check_and_sed '^postinst_hook' \ 's;^postinst_hook[[:blank:]]*=.*;postinst_hook = /usr/sbin/update-grub;g' \ @@ -103,7 +118,7 @@ else echo "postinst_hook = /usr/sbin/update-grub" >> /etc/kernel-img.conf fi -# update postrm_hook for grub +# update postrm_hook for grub/grub2 if grep -q postrm_hook /etc/kernel-img.conf; then cp_check_and_sed '^postrm_hook' \ 's;^postrm_hook[[:blank:]]*=.*;postrm_hook = /usr/sbin/update-grub;g' \ @@ -124,28 +139,45 @@ fi echo -n " kernel-img.conf" # generate initial grub loaders -if [ ! -d "$grub_dir" ]; then - mkdir -p "$grub_dir" - # x86 - if [ -d /usr/lib/grub/i386-pc ]; then - cp -a /usr/lib/grub/i386-pc/* "$grub_dir" - # x86_64 - elif [ -d /usr/lib/grub/x86_64-pc ]; then - cp -a /usr/lib/grub/x86_64-pc/* "$grub_dir" +if [ "x$GRUB2" = "xno" ]; then + # Grub1 part + if [ ! -d "$grub_dir" ]; then + mkdir -p "$grub_dir" + # x86 + if [ -d /usr/lib/grub/i386-pc ]; then + cp -a /usr/lib/grub/i386-pc/* "$grub_dir" + # x86_64 + elif [ -d /usr/lib/grub/x86_64-pc ]; then + cp -a /usr/lib/grub/x86_64-pc/* "$grub_dir" + fi + fi +else + # Grub2 part + if [ ! -d /boot/grub ]; then + mkdir -p /boot/grub + if [ -d /usr/lib/grub/i386-pc ]; then + cp -a /usr/lib/grub/i386-pc/* /boot/grub + fi fi fi echo -n " grub1" # create/update grub configuration -if [ -e "$menu_file" ]; then - # is there uncompatibile grub conf present? - if ! grep -q 'AUTOMAGIC KERNELS LIST' "$menu_file"; then - mv -f "$menu_file" "$menu_file.old" +if [ "x$GRUB2" = "xno" ]; then + # Grub1 part + if [ -e "$menu_file" ]; then + # is there uncompatibile grub conf present? + if ! grep -q 'AUTOMAGIC KERNELS LIST' "$menu_file"; then + mv -f "$menu_file" "$menu_file.old" + fi + fi + if [ ! -e "$menu_file" ]; then + yes | /usr/sbin/update-grub >/dev/null 2>&1 || true + else + /usr/sbin/update-grub >/dev/null 2>&1 || true fi -fi -if [ ! -e "$menu_file" ]; then - yes | /usr/sbin/update-grub >/dev/null 2>&1 || true else + # Grub2 part /usr/sbin/update-grub >/dev/null 2>&1 || true fi echo -n " grub2" @@ -182,19 +214,25 @@ udevsettle || true echo -n " udev" # update device map if possible -if [ -f "$device_map" ]; then - mv -f "$device_map" "$device_map.old" -fi -grub --batch --no-floppy --device-map="$device_map" <<'EOF' >/dev/null 2>&1 +if [ "x$GRUB2" = "xno" ]; then + # Grub1 part + if [ -f "$device_map" ]; then + mv -f "$device_map" "$device_map.old" + fi + grub --batch --no-floppy --device-map="$device_map" <<'EOF' >/dev/null 2>&1 quit EOF -if [ ! -s "$device_map" ]; then - if [ -f "$device_map.old" ]; then - mv -f "$device_map.old" "$device_map" - fi + if [ ! -s "$device_map" ]; then + if [ -f "$device_map.old" ]; then + mv -f "$device_map.old" "$device_map" + fi + else + rm -f "$device_map.old" + fi else - rm -f "$device_map.old" + # Grub2 part + grub-mkdevicemap -n fi echo -n " grub3" @@ -202,6 +240,10 @@ echo -n " grub3" . /usr/share/kernel-2.6-cn/grub-functions.sh # get install device (0x80 BIOS device) +# this will work for both Grub1 and Grub2 +if [ "x$GRUB2" = "xyes" ]; then + device_map=/boot/grub/device.map +fi install_device=$(grep '^(hd0)' "$device_map" | \ sed -e 's%[^[:space:]]*[[:space:]]*\([^[:space:]]*\)%\1%') if [ -z "$install_device" ]; then @@ -228,6 +270,7 @@ fi echo -n " grub4" # install GRUB loader +# this will work for both Grub1 and Grub2 if ! grub-install --no-floppy "$install_device" >/dev/null 2>&1; then echo "." echo "CN: FATAL ERROR while running grub-install!" @@ -237,37 +280,44 @@ fi echo -n " grub5" # fix possible wrong params in menu.lst -cp_check_and_sed '^# groot=' \ - "s;^# groot=.*;# groot=$grub_root_device;g" \ - "$menu_file" || true -cp_check_and_sed '^# kopt=' \ - "s;^# kopt=\(.*\)root=[^[:space:]]*\(.*\);# kopt=\1root=$root_device\2;g" \ - "$menu_file" || true +if [ "x$GRUB2" = "xno" ]; then + # Grub1 part + cp_check_and_sed '^# groot=' \ + "s;^# groot=.*;# groot=$grub_root_device;g" \ + "$menu_file" || true + cp_check_and_sed '^# kopt=' \ + "s;^# kopt=\(.*\)root=[^[:space:]]*\(.*\);# kopt=\1root=$root_device\2;g" \ + "$menu_file" || true +fi /usr/sbin/update-grub >/dev/null 2>&1 || true echo -n " grub6" -# and final stage of devfs/udev brokeness fix -if [ "x$install_device_resolved" != "x$install_device" ]; then - # get original (symlinked device) - root_device=$(find_device_nonresolved "/") - if [ -z "$root_device" ]; then - root_device=$(find_root_device) - fi +# fix possible wrong params in menu.lst +if [ "x$GRUB2" = "xno" ]; then + # Grub1 part + # ... and final stage of devfs/udev brokeness fix + if [ "x$install_device_resolved" != "x$install_device" ]; then + # get original (symlinked device) + root_device=$(find_device_nonresolved "/") + if [ -z "$root_device" ]; then + root_device=$(find_root_device) + fi - # fix (hd0) mapping - cp_check_and_sed '^\(hd0\)' \ - "s;^(hd0).*;(hd0) $install_device;" "$device_map" \ - || true + # fix (hd0) mapping + cp_check_and_sed '^\(hd0\)' \ + "s;^(hd0).*;(hd0) $install_device;" "$device_map" \ + || true - # fix global root= invocation - cp_check_and_sed '^# kopt=' \ - "s;^# kopt=\(.*\)root=[^[:space:]]*\(.*\);# kopt=\1root=$root_device\2;g" \ - "$menu_file" || true + # fix global root= invocation + cp_check_and_sed '^# kopt=' \ + "s;^# kopt=\(.*\)root=[^[:space:]]*\(.*\);# kopt=\1root=$root_device\2;g" \ + "$menu_file" || true - # fix root= invocation for individual kernel profiles - cp_check_and_sed '^kernel' \ - "s;\(^kernel.*\)root=[^[:space:]]*\(.*\);\1root=$root_device\2;g" \ - "$menu_file" || true + # fix root= invocation for individual kernel profiles + cp_check_and_sed '^kernel' \ + "s;\(^kernel.*\)root=[^[:space:]]*\(.*\);\1root=$root_device\2;g" \ + "$menu_file" || true + fi fi echo -n " grub7" @@ -327,27 +377,6 @@ fi # default kernel parameters rm -f /etc/sysctl.conf.$$ -cat > /etc/sysctl.conf.$$ <<'EOF' -kernel.maps_protect=1 -net.core.rmem_default=1048576 -net.core.wmem_default=1048576 -net.ipv4.conf.all.accept_redirects=0 -net.ipv4.conf.all.accept_source_route=0 -net.ipv4.conf.all.log_martians=1 -net.ipv4.conf.all.rp_filter=1 -net.ipv4.conf.all.secure_redirects=1 -net.ipv4.conf.all.send_redirects=0 -net.ipv4.icmp_echo_ignore_broadcasts=1 -net.ipv4.icmp_ignore_bogus_error_responses=1 -net.ipv4.ip_forward=0 -net.ipv4.ip_local_port_range=10000 65000 -net.ipv4.tcp_ecn=0 -net.ipv4.tcp_max_syn_backlog=1024 -net.ipv4.tcp_retries1=2 -net.ipv4.tcp_rfc1337=1 -net.ipv4.tcp_syncookies=1 -vm.mmap_min_addr=65536 -EOF # old kernel params (skipping some of the obsolete or overrided entries) if [ -e /etc/sysctl.conf ]; then @@ -355,39 +384,6 @@ if [ -e /etc/sysctl.conf ]; then /etc/sysctl.conf >> /etc/sysctl.conf.$$ fi -# add sysctl.conf Debian headers -rm -f /etc/sysctl.conf-head -cat > /etc/sysctl.conf-head <<'EOF' -# -# /etc/sysctl.conf - Configuration file for setting system variables -# See sysctl.conf (5) for information. -# -EOF - -# merge old and new in one conf, primarily respecting old -script=' -my %confhash = (); -my ($key, $value); -while (<>) -{ - chomp(); - if (/^\s*(\S+)\s*=\s*(.+)\s*$/o) - { - my ($key, $value) = ($1, $2); - $key =~ s/\//./go; - $confhash{$key} = $value; - } -} -for (sort { $a cmp $b } keys %confhash) -{ - print $_, "=", $confhash{$_}, "\n"; -} -' -rm -f /etc/sysctl.conf-new -perl -e "$script" < /etc/sysctl.conf.$$ > /etc/sysctl.conf-new -cat /etc/sysctl.conf-head /etc/sysctl.conf-new > /etc/sysctl.conf.$$ -rm -f /etc/sysctl.conf-head /etc/sysctl.conf-new - # finished with merging, move into sysctl.conf cp_mv /etc/sysctl.conf.$$ /etc/sysctl.conf echo -n " sysctl.conf" @@ -405,9 +401,11 @@ if [ -e /etc/security/limits.conf ]; then rm -f /etc/security/limits.conf.$$ cp /etc/security/limits.conf /etc/security/limits.conf.$$ cp-update kernel-2.6-cn /etc/security/limits.conf.$$ <<'EOF' -* soft core 0 -* hard nofile 4096 -* soft nofile 4096 +* soft core 0 +* hard nofile 16384 +* soft nofile 16384 +@users soft nproc 100 +@users hard nproc 150 EOF cp_mv /etc/security/limits.conf.$$ /etc/security/limits.conf echo -n " limits" diff --git a/debian/rules b/debian/rules index cbd1df2..cbe925d 100755 --- a/debian/rules +++ b/debian/rules @@ -1,74 +1,3 @@ #!/usr/bin/make -f -# Sample debian/rules that uses debhelper. -# This file is public domain software, originally written by Joey Hess. -# -# This version is for packages that are architecture independent. - -# Uncomment this to turn on verbose mode. -#export DH_VERBOSE=1 - -build: build-stamp -build-stamp: - dh_testdir - - # Add here commands to compile the package. - #$(MAKE) - - touch build-stamp - -clean: - dh_testdir - dh_testroot - rm -f build-stamp - - # Add here commands to clean up after the build process. - #-$(MAKE) clean - #-$(MAKE) distclean - - dh_clean - -install: build - dh_testdir - dh_testroot - dh_clean -k - dh_installdirs - - # Add here commands to install the package into debian/. - #$(MAKE) prefix=`pwd`/debian/`dh_listpackages`/usr install - -# Build architecture-independent files here. -binary-indep: build install - dh_testdir - dh_testroot - dh_installchangelogs - dh_installdocs -# dh_installexamples - dh_install -# dh_installmenu - dh_installdebconf -# dh_installlogrotate -# dh_installemacsen -# dh_installcatalogs -# dh_installpam -# dh_installmime -# dh_installinit -# dh_installcron -# dh_installinfo -# dh_undocumented - dh_installman - dh_link - dh_compress - dh_fixperms -# dh_perl -# dh_python - dh_installdeb - dh_gencontrol - dh_md5sums - dh_builddeb - -# Build architecture-dependent files here. -binary-arch: build install -# We have nothing to do by default. - -binary: binary-indep binary-arch -.PHONY: build clean binary-indep binary-arch binary install +%: + dh $@