- up to 4.9.176; workaround zombieload intel cpu vulnerability: https://www.kernel...

diff --git a/kernel-vserver-2.3.patch b/kernel-vserver-2.3.patch
index e2db62d5c82b9faee85eb4b658a773527055f0dc..b79866894ca4ffd21dd459c507f12f0f3aa59ec8 100644 (file)
--- a/kernel-vserver-2.3.patch
+++ b/kernel-vserver-2.3.patch
@@ -13568,14 +13568,15 @@ diff -NurpP --minimal linux-4.9.135/kernel/ptrace.c linux-4.9.135-vs2.3.9.8/kern
  #include <linux/hw_breakpoint.h>
  #include <linux/cn_proc.h>
  #include <linux/compat.h>
-@@ -325,6 +326,11 @@ ok:
-            !ptrace_has_cap(mm->user_ns, mode)))
-           return -EPERM;
+@@ -331,6 +331,12 @@ ok:
  
+       if (mode & PTRACE_MODE_SCHED)
+               return 0;
++
 +      if (!vx_check(task->xid, VS_ADMIN_P|VS_WATCH_P|VS_IDENT))
 +              return -EPERM;
 +      if (!vx_check(task->xid, VS_IDENT) &&
-+              !task_vx_flags(task, VXF_STATE_ADMIN, 0))
++                      !task_vx_flags(task, VXF_STATE_ADMIN, 0))
 +              return -EACCES;
        return security_ptrace_access_check(task, mode);
  }

diff --git a/kernel.spec b/kernel.spec
index ac28380102f9ec87d79b04a3755a44f045896343..427abd5b0a50cd056e16fcad5cebbb5fd66f890d 100644 (file)
--- a/kernel.spec
+++ b/kernel.spec
@@ -73,7 +73,7 @@
 
 %define                rel             1
 %define                basever         4.9
-%define                postver         .174
+%define                postver         .176
 
 # define this to '-%{basever}' for longterm branch
 %define                versuffix       -%{basever}
@@ -125,7 +125,7 @@ Source0:    https://www.kernel.org/pub/linux/kernel/v4.x/linux-%{basever}.tar.xz
 # Source0-md5: 0a68ef3615c64bd5ee54a3320e46667d
 %if "%{postver}" != ".0"
 Patch0:                https://www.kernel.org/pub/linux/kernel/v4.x/patch-%{version}.xz
-# Patch0-md5:  275268f5ec9a8b055e975ae881752491
+# Patch0-md5:  b287fed45c4a5ff4f26eb87a0eba7c85
 %endif
 Source1:       kernel.sysconfig