On 14-08-22 12:02 PM, Sona Sarmadi wrote:
Bruce,
Thanks for quick response. See inline my comments.
Have a nice weekend
/Sona
Please let me know if this is the correct way. And also let me know if I upstream
this kernel patch to yocto, will yocto accept it (if the patch looks correct >
of course). Please let me know if you prefer to apply security patches to kernels
in some different way.
If this is for your own local builds, a layer with a bbappend and the patches
is a better idea.
Sona: No this is not local, I wanted to backport a security patch from 3.15 to
lLinux Yoctp 3.14 and upstreamed to Yocto.
For the main linux-yocto recipes, everything is maintained in the git
repositories, not patched at build time, so changes go to the linux-yocto
mailing list, and I merge them from there.
On this particular topic, I already track all the -stable updates for our
linux-yocto kernels, and CVEs are picked up by -stable. So there's a process in
place to get security related fixes into the linux-yocto trees.
Sona: very good :)
I'm a few releases behind at the moment, due to a 2 week vacation, but 3.4,
3.10 and 3.14 will all be updated shortly.
Sona: So if a security patch is only fixed in later versions, you don't want to
backport the fix to older yocto versions (e.g.3.10, 3.14) even if the bug is
present in these versions. You rather prefer to inherit these from k.org.
We are at a slight advantage in this area, since we've moved to a model
of releasing and supporting the LTSI kernel versions. As such, they
continue to get korg stable maintenance for a cycle that matches our
Yocto support window.
That means there are few, if any, CVEs that don't get addressed via
the flow I described.
That being said, if there's a linux-yocto kernel version that isn't
LTSI and isn't get standard korg -stable updates (i.e. the non-LTSI
kernel version that will be released with Yocto 1.7), then backported
fixes to that version can come to the linux-yocto list, and I can
apply them to the tree.
Cheers,
Bruce
If you do notice a CVE that isn't part of the k.org -stable updates, that is or
more interest, and we should nominate it for -stable upstream and have it >
flow to all kernels via that process.
Sona: I see, this would be a better approach.
Bruce
--
_______________________________________________
yocto mailing list
[email protected]
https://lists.yoctoproject.org/listinfo/yocto
