[Packaging] Improve config annotations check on custom kernels

[Marcelo Cerri]

[Impact]

Currently for custom kernels, it's necessary to keep a separate annotations file that often gets out of sync with the corresponding file in debian.master/.

The "debian/scripts/config-check" script can be changed to allow additional annotations files to act as overlays over the original annotations file, allowing custom kernels to override the policies just for the relevant configs.

The proposal is to add support for an include directive in the annotations file so custom kernels can include the annotations file from its base kernel and override policies on a config basis.

[Test Case]

A kernel build should complete successfully after the change.

[Regression Potential]

Low regression potential since that's a change on the build process that doesn't affect the final kernel that is built.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-gcp - 4.18.0-1008.9

---------------
linux-gcp (4.18.0-1008.9) cosmic; urgency=medium

  * linux-gcp: 4.18.0-1008.9 -proposed tracker (LP: #1819620)

  * [Packaging] Improve config annotations check on custom kernels
    (LP: #1820075)
    - [Config] linux-gcp: Replace annotations symlink with overlay
    - [Config] linux-gcp: Include master annotations to linux-gcp annotations
    - [Config] linux-gcp: Update annotations file

  * tcm_loop.ko: move from modules-extra into main modules-gcp package
    (LP: #1817786)
    - [Packaging] move tcm_loop.lo to main linux-modules-gcp package

  [ Ubuntu: 4.18.0-17.18 ]

  * linux: 4.18.0-17.18 -proposed tracker (LP: #1819624)
  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis
    - [Packaging] update helper scripts
  * C++ demangling support missing from perf (LP: #1396654)
    - [Packaging] fix a mistype
  * arm-smmu-v3 arm-smmu-v3.3.auto: CMD_SYNC timeout (LP: #1818162)
    - iommu/arm-smmu-v3: Fix unexpected CMD_SYNC timeout
  * Crash in nvme_irq_check() when using threaded interrupts (LP: #1818747)
    - nvme-pci: fix out of bounds access in nvme_cqe_pending
  * CVE-2019-9003
    - ipmi: fix use-after-free of user->release_barrier.rda
  * CVE-2019-9162
    - netfilter: nf_nat_snmp_basic: add missing length checks in ASN.1 cbs
  * CVE-2019-9213
    - mm: enforce min addr even if capable() in expand_downwards()
  * CVE-2019-3460
    - Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt
  * tun/tap: unable to manage carrier state from userland (LP: #1806392)
    - tun: implement carrier change
  * CVE-2019-8980
    - exec: Fix mem leak in kernel_read_file
  * [Packaging] Allow overlay of config annotations (LP: #1752072)
    - [Packaging] config-check: Add an include directive
  * amdgpu with mst WARNING on blanking (LP: #1814308)
    - drm/amd/display: Fix MST dp_blank REG_WAIT timeout
  * CVE-2019-7308
    - bpf: move {prev_,}insn_idx into verifier env
    - bpf: move tmp variable into ax register in interpreter
    - bpf: enable access to ax register also from verifier rewrite
    - bpf: restrict map value pointer arithmetic for unprivileged
    - bpf: restrict stack pointer arithmetic for unprivileged
    - bpf: restrict unknown scalars of mixed signed bounds for unprivileged
    - bpf: fix check_map_access smin_value test when pointer contains offset
    - bpf: prevent out of bounds speculation on pointer arithmetic
    - bpf: fix sanitation of alu op with pointer / scalar type from different
      paths
    - bpf: add various test cases to test_verifier
    - bpf: add various test cases to selftests
  * CVE-2017-5753
    - bpf: fix inner map masking to prevent oob under speculation
  * Use memblock quirk instead of delayed allocation for GICv3 LPI tables
    (LP: #1816425)
    - efi/arm: Revert "Defer persistent reservations until after paging_init()"
    - arm64, mm, efi: Account for GICv3 LPI tables in static memblock reserve
      table
  * efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted (LP: #1814982)
    - efi/arm/arm64: Allow SetVirtualAddressMap() to be omitted
  * Update ENA driver to version 2.0.3K (L...

[Marcelo Cerri (mhcerri)]

linux-azure: https://lists.ubuntu.com/archives/kernel-team/2019-May/101009.html

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-azure - 4.15.0-1049.54

---------------
linux-azure (4.15.0-1049.54) xenial; urgency=medium

  * linux-azure: 4.15.0-1049.54 -proposed tracker (LP: #1834091)

  * Upstream Commits Needed for DPDK on Azure (LP: #1812123)
    - uio: document uio_hv_generic regions
    - uio_hv_generic: create send and receive buffers
    - uio_hv_generic: add rescind support
    - uio_hv_generic: support sub-channels
    - uio_hv_generic: fix subchannel ring mmap
    - uio_hv_generic: use standard mmap for resources
    - vmbus: keep pointer to ring buffer page
    - uio: introduce UIO_MEM_IOVA
    - hv_uio_generic: map ringbuffer phys addr
    - uio_hv_generic: use ISR callback method
    - uio_hv_generic: use correct channel in isr
    - uio_hv_generic: make ring buffer attribute for primary channel
    - uio_hv_generic: defer opening vmbus until first use
    - uio_hv_generic: set callbacks on open
    - vmbus: pass channel to hv_process_channel_removal
    - vmbus: split ring buffer allocation from open
    - vmbus: fix subchannel removal

  * Enable eBPF JIT in the linux-azure kernels (LP: #1827916)
    - [Config] linux-azure: CONFIG_MLX{4,5}_INFINIBAND=m

  * [linux-azure] Please Include Mainline Commit ebaf39e6032f in the 16.04 and
    18.04 linux-azure kernels (LP: #1830266)
    - ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes

  * [linux-azure] Commits Requested in 16.04 for the Azure Kernel (LP: #1830242)
    - blk-mq: remove the request_list usage
    - nvme-pci: remove cq check after submission
    - nvme-pci: split the nvme queue lock into submission and completion locks

  * [Packaging] Improve config annotations check on custom kernels
    (LP: #1820075)
    - [Config] linux-azure: Include custom annotations files

  [ Ubuntu: 4.15.0-54.58 ]

  * linux: 4.15.0-54.58 -proposed tracker (LP: #1833987)
  * Remote denial of service (resource exhaustion) caused by TCP SACK scoreboard
    manipulation (LP: #1831638) // CVE-2019-11478
    - tcp: refine memory limit test in tcp_fragment()
  * CVE-2019-11479
    - SAUCE: tcp: add tcp_min_snd_mss sysctl
    - SAUCE: tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()

 -- Marcelo Henrique Cerri <email address hidden> Mon, 24 Jun 2019 17:44:20 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-azure - 5.0.0-1010.10

---------------
linux-azure (5.0.0-1010.10) disco; urgency=medium

  * linux-azure: 5.0.0-1010.10 -proposed tracker (LP: #1833924)

  * Enable eBPF JIT in the linux-azure kernels (LP: #1827916)
    - [Config] linux-azure: CONFIG_MLX{4,5}_INFINIBAND=m

  * linux-azure: Add the Catapult FPGA Driver (LP: #1824879)
    - SAUCE: linux-azure: Include Catapult FPGA PCI driver
    - [Config] linux-azure: CONFIG_CATAPULT_PCI=m

  * [Packaging] Improve config annotations check on custom kernels
    (LP: #1820075)
    - [Config] linux-azure: Include custom annotations files

  [ Ubuntu: 5.0.0-20.21 ]

  * linux: 5.0.0-20.21 -proposed tracker (LP: #1833934)
  * CVE-2019-11479
    - SAUCE: tcp: add tcp_min_snd_mss sysctl
    - SAUCE: tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()
  * Remote denial of service (resource exhaustion) caused by TCP SACK scoreboard
    manipulation (LP: #1831638) // CVE-2019-11478
    - tcp: refine memory limit test in tcp_fragment()

  [ Ubuntu: 5.0.0-19.20 ]

  * CVE-2019-12817
    - SAUCE: powerpc/mm/64s/hash: Reallocate context ids on fork

 -- Marcelo Henrique Cerri <email address hidden> Tue, 25 Jun 2019 10:36:47 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-azure - 4.18.0-1023.24

---------------
linux-azure (4.18.0-1023.24) cosmic; urgency=medium

  * linux-azure: 4.18.0-1023.24 -proposed tracker (LP: #1833946)

  * [linux-azure] XDP generic fixes (LP: #1831254)
    - netvsc: unshare skb in VF rx handler
    - net: convert rps_needed and rfs_needed to new static
    - net: core: support XDP generic on stacked devices.

  * Enable eBPF JIT in the linux-azure kernels (LP: #1827916)
    - [Config] linux-azure: CONFIG_MLX{4,5}_INFINIBAND=m

  * Azure: Backport vIOMMU driver (increase vCPU limits) (LP: #1826447)
    - PCI: hv: Replace hv_vp_set with hv_vpset
    - PCI: hv: Refactor hv_irq_unmask() to use cpumask_to_vpset()
    - x86/Hyper-V: Set x2apic destination mode to physical when x2apic is
      available
    - iommu/hyper-v: Add Hyper-V stub IOMMU driver
    - [Config] linux-azure: CONFIG_HYPERV_IOMMU=y

  * [linux-azure] Please Include Mainline Commit ebaf39e6032f in the 16.04 and
    18.04 linux-azure kernels (LP: #1830266)
    - ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes

  * [Packaging] Improve config annotations check on custom kernels
    (LP: #1820075)
    - [Config] linux-azure: Include custom annotations files

  [ Ubuntu: 4.18.0-25.26 ]

  * linux: 4.18.0-25.26 -proposed tracker (LP: #1833952)
  * CVE-2019-11479
    - SAUCE: tcp: add tcp_min_snd_mss sysctl
    - SAUCE: tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()
  * Remote denial of service (resource exhaustion) caused by TCP SACK scoreboard
    manipulation (LP: #1831638) // CVE-2019-11478
    - tcp: refine memory limit test in tcp_fragment()

  [ Ubuntu: 4.18.0-24.25 ]

  * CVE-2019-12817
    - SAUCE: powerpc/mm/64s/hash: Reallocate context ids on fork

 -- Stefan Bader <email address hidden> Tue, 25 Jun 2019 12:46:06 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-azure - 4.18.0-1023.24~18.04.1

---------------
linux-azure (4.18.0-1023.24~18.04.1) bionic; urgency=medium

  * linux-azure: 4.18.0-1023.24~18.04.1 -proposed tracker (LP: #1833945)

  [ Ubuntu: 4.18.0-1023.24 ]

  * linux-azure: 4.18.0-1023.24 -proposed tracker (LP: #1833946)
  * [linux-azure] XDP generic fixes (LP: #1831254)
    - netvsc: unshare skb in VF rx handler
    - net: convert rps_needed and rfs_needed to new static
    - net: core: support XDP generic on stacked devices.
  * Enable eBPF JIT in the linux-azure kernels (LP: #1827916)
    - [Config] linux-azure: CONFIG_MLX{4,5}_INFINIBAND=m
  * Azure: Backport vIOMMU driver (increase vCPU limits) (LP: #1826447)
    - PCI: hv: Replace hv_vp_set with hv_vpset
    - PCI: hv: Refactor hv_irq_unmask() to use cpumask_to_vpset()
    - x86/Hyper-V: Set x2apic destination mode to physical when x2apic is
      available
    - iommu/hyper-v: Add Hyper-V stub IOMMU driver
    - [Config] linux-azure: CONFIG_HYPERV_IOMMU=y
  * [linux-azure] Please Include Mainline Commit ebaf39e6032f in the 16.04 and
    18.04 linux-azure kernels (LP: #1830266)
    - ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes
  * [Packaging] Improve config annotations check on custom kernels
    (LP: #1820075)
    - [Config] linux-azure: Include custom annotations files
  * linux: 4.18.0-25.26 -proposed tracker (LP: #1833952)
  * CVE-2019-11479
    - SAUCE: tcp: add tcp_min_snd_mss sysctl
    - SAUCE: tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()
  * Remote denial of service (resource exhaustion) caused by TCP SACK scoreboard
    manipulation (LP: #1831638) // CVE-2019-11478
    - tcp: refine memory limit test in tcp_fragment()
  * CVE-2019-12817
    - SAUCE: powerpc/mm/64s/hash: Reallocate context ids on fork

 -- Marcelo Henrique Cerri <email address hidden> Tue, 25 Jun 2019 11:42:46 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-azure - 5.0.0-1010.10

---------------
linux-azure (5.0.0-1010.10) disco; urgency=medium

  * linux-azure: 5.0.0-1010.10 -proposed tracker (LP: #1833924)

  * Enable eBPF JIT in the linux-azure kernels (LP: #1827916)
    - [Config] linux-azure: CONFIG_MLX{4,5}_INFINIBAND=m

  * linux-azure: Add the Catapult FPGA Driver (LP: #1824879)
    - SAUCE: linux-azure: Include Catapult FPGA PCI driver
    - [Config] linux-azure: CONFIG_CATAPULT_PCI=m

  * [Packaging] Improve config annotations check on custom kernels
    (LP: #1820075)
    - [Config] linux-azure: Include custom annotations files

  [ Ubuntu: 5.0.0-20.21 ]

  * linux: 5.0.0-20.21 -proposed tracker (LP: #1833934)
  * CVE-2019-11479
    - SAUCE: tcp: add tcp_min_snd_mss sysctl
    - SAUCE: tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()
  * Remote denial of service (resource exhaustion) caused by TCP SACK scoreboard
    manipulation (LP: #1831638) // CVE-2019-11478
    - tcp: refine memory limit test in tcp_fragment()

  [ Ubuntu: 5.0.0-19.20 ]

  * CVE-2019-12817
    - SAUCE: powerpc/mm/64s/hash: Reallocate context ids on fork

 -- Marcelo Henrique Cerri <email address hidden> Tue, 25 Jun 2019 10:36:47 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-gcp - 5.0.0-1020.20~18.04.1

---------------
linux-gcp (5.0.0-1020.20~18.04.1) bionic; urgency=medium

  * bionic/linux-gcp: 5.0.0-1020.20~18.04.1 -proposed tracker (LP: #1846012)

  [ Ubuntu: 5.0.0-1020.20 ]

  * disco/linux-gcp: 5.0.0-1020.20 -proposed tracker (LP: #1846015)
  * disco/linux: 5.0.0-31.33 -proposed tracker (LP: #1846026)
  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts
  * /proc/self/maps paths missing on live session (was vlc won't start; eoan
    19.10 & bionic 18.04 ubuntu/lubuntu/kubuntu/xubuntu/ubuntu-mate dailies)
    (LP: #1842382)
    - SAUCE: Revert "UBUNTU: SAUCE: shiftfs: enable overlayfs on shiftfs"

 -- Khalid Elmously <email address hidden> Fri, 04 Oct 2019 04:26:12 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-oracle - 5.0.0-1004.8

---------------
linux-oracle (5.0.0-1004.8) disco; urgency=medium

  * disco/linux-oracle: 5.0.0-1004.8 -proposed tracker (LP: #1846019)

  * 5.0-based linux-oracle kernels can't run ADT (LP: #1845434)
    - [config] CONFIG_VIRTIO=y

  [ Ubuntu: 5.0.0-31.33 ]

  * disco/linux: 5.0.0-31.33 -proposed tracker (LP: #1846026)
  * Packaging resync (LP: #1786013)
    - [Packaging] update helper scripts
  * /proc/self/maps paths missing on live session (was vlc won't start; eoan
    19.10 & bionic 18.04 ubuntu/lubuntu/kubuntu/xubuntu/ubuntu-mate dailies)
    (LP: #1842382)
    - SAUCE: Revert "UBUNTU: SAUCE: shiftfs: enable overlayfs on shiftfs"

 -- Khalid Elmously <email address hidden> Mon, 30 Sep 2019 20:23:48 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-oracle - 5.3.0-1002.2

---------------
linux-oracle (5.3.0-1002.2) eoan; urgency=medium

  * eoan/linux-oracle: 5.3.0-1002.2 -proposed tracker (LP: #1847295)

  * Miscellaneous Ubuntu changes
    - update dkms package versions

  [ Ubuntu: 5.3.0-18.19 ]

  * eoan/linux: 5.3.0-18.19 -proposed tracker (LP: #1847298)
  * Enable the Dragonboards out of Eoan/master arm64 kernel (LP: #1846704)
    - [Packaging] arm64: snapdragon: introduce a snapdragon flavour
    - [Packaging] arm64: snapdragon: switch kernel format to Image
    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8916=y
    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8994=y
    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8996=y
    - [Config] arm64: snapdragon: CONFIG_PINCTRL_MSM8998=y
    - [Config] arm64: snapdragon: CONFIG_REGULATOR_QCOM_RPMH=y
    - [Config] arm64: snapdragon: CONFIG_QCOM_BAM_DMA=y
    - [Config] arm64: snapdragon: CONFIG_QCOM_HIDMA_MGMT=y
    - [Config] arm64: snapdragon: CONFIG_QCOM_HIDMA=y
    - [Config] arm64: snapdragon: CONFIG_COMMON_CLK_QCOM=y
    - [Config] arm64: snapdragon: CONFIG_QCOM_CLK_RPMH=y
    - [Config] arm64: snapdragon: CONFIG_MSM_GCC_8916=y
    - [Config] arm64: snapdragon: CONFIG_MSM_GCC_8994=y
    - [Config] arm64: snapdragon: CONFIG_MSM_MMCC_8996=y
    - [Config] arm64: snapdragon: CONFIG_MSM_GCC_8998=y
    - [Config] arm64: snapdragon: CONFIG_HWSPINLOCK_QCOM=y
    - [Config] arm64: snapdragon: CONFIG_QCOM_APCS_IPC=y
    - [Config] arm64: snapdragon: CONFIG_RPMSG_QCOM_GLINK_RPM=y
    - [Config] arm64: snapdragon: CONFIG_QCOM_GENI_SE=y
    - [Config] arm64: snapdragon: CONFIG_QCOM_SMEM=y
    - [Config] arm64: snapdragon: CONFIG_QCOM_SMD_RPM=y
    - [Config] arm64: snapdragon: CONFIG_QCOM_SMP2P=y
    - [Config] arm64: snapdragon: CONFIG_QCOM_SMSM=y
    - [Config] arm64: snapdragon: CONFIG_QCOM_QFPROM=y
    - [Config] arm64: snapdragon: CONFIG_SERIAL_QCOM_GENI=y
    - [Config] arm64: snapdragon: CONFIG_QCOM_TSENS=y
    - [Config] arm64: snapdragon: CONFIG_REGULATOR_QCOM_SMD_RPM=y
    - [Config] arm64: snapdragon: CONFIG_QCOM_CLK_SMD_RPM=y
    - [Config] arm64: snapdragon: CONFIG_RPMSG_QCOM_SMD=y
    - [Config] arm64: snapdragon: CONFIG_MFD_QCOM_RPM=y
    - [Config] arm64: snapdragon: CONFIG_SCSI_UFSHCD=y
    - [Config] arm64: snapdragon: CONFIG_SCSI_UFSHCD_PLATFORM=y
    - [Config] arm64: snapdragon: CONFIG_SCSI_UFS_HISI=y
    - [Config] arm64: snapdragon: CONFIG_MMC_SDHCI=y
    - [Config] arm64: snapdragon: CONFIG_MMC_SDHCI_PLTFM=y
    - [Config] arm64: snapdragon: CONFIG_MMC_SDHCI_MSM=y
    - [Config] arm64: snapdragon: CONFIG_REGULATOR_QCOM_SPMI=y
    - [Config] arm64: snapdragon: CONFIG_PINCTRL_QCOM_SPMI_PMIC=y
    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_USB_HS=y
    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_QMP=y
    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_UFS=y
    - [Config] arm64: snapdragon: CONFIG_PHY_QCOM_USB_HSIC=y
    - [Config] arm64: snapdragon: CONFIG_USB_CHIPIDEA_OF=y
    - [Config] arm64: snapdragon: CONFIG_USB_EHCI_HCD_PLATFORM=y
    - [Config] arm64: snapdragon: CONFIG_EXTCON_USB_GPIO=y
    - [Config] arm64: snapdragon: CONFIG_REGULATOR_FIXED_VOLTAGE=y
    - [C...