# kernel-iwx test repository

`kernel-iwx` is a mainline Linux **6.18.39** kernel packaged by InterWorx for the
Enterprise Linux fleet. It carries the GhostLock fix (CVE-2026-43499) and is
configured to run the full InterWorx stack (APF/iptables, disk quota, virtio,
mail/ftp/web). This repository is for **testing only**.

The repo also carries fixed **djbdns (1.05-192)** and **apf (1.7.6-3.65.1)**
builds, both required alongside the kernel:

- djbdns: 6.18 enforces RLIMIT_DATA against mmap allocations, and older
  DATALIMIT values crash-loop dnscache the moment the new kernel boots (dead
  resolver). -192 fixes that and ships a native systemd unit so the panel's
  DNS stop works after reboots (IWX-15038, IWX-15039).
- apf: older builds enumerate flush tables from /proc/net/ip_tables_names,
  which is permanently empty on 6.18 - `apf --stop`/`-f` exit 0 while leaving
  every rule active. 3.65.1 enumerates from iptables-save (IWX-15041).

Supported: EL7 (IW6), EL8 (IW8), EL9 (IW8), x86_64.

> **The kernel only takes effect after a reboot.** Installing the package does
> not switch the running kernel. You must reboot to boot into 6.18.39.

## 1. Add the repository

Drop the repo file into `/etc/yum.repos.d/`:

```
curl -o /etc/yum.repos.d/kernel-iwx.repo \
  http://updates.interworx.com/_internal/kernel-iwx/kernel-iwx.repo
```

The correct OS build is selected automatically (the baseurl uses `$releasever`),
so the same repo file works on EL7, EL8, and EL9. The packages are unsigned
(`gpgcheck=0`) as this is a test repo.

## 2. Update djbdns and apf (required, do this before the reboot)

```
yum upgrade djbdns apf      # (dnf on EL8/EL9)
```

Everything else is automatic: the djbdns RPM rewrites dnscache's DATALIMIT to
8000000, bounces dnscache, and installs + enables the native djbdns systemd
unit; the apf RPM replaces the flush table enumeration. No manual steps.

Order doesn't strictly matter - if a box already rebooted onto 6.18 with the
old packages (dnscache crash-looping, apf stop no-oping), this same upgrade
heals both in place - but upgrading first avoids the outage window entirely.

## 3. Install the kernel

EL8 / EL9:

```
dnf install kernel-iwx
```

EL7:

```
yum install kernel-iwx
```

The install builds the initramfs and adds a boot entry. On EL8/EL9 the new
kernel is set as the default automatically.

## 4. Make it the default and reboot

Confirm the default, and on EL7 set it if needed:

```
grubby --default-kernel        # should print .../vmlinuz-6.18.39-...iworx...
# EL7 only, if it is not already the default:
grubby --set-default /boot/vmlinuz-6.18.39-*.iworx.x86_64
```

Then reboot to apply:

```
reboot
```

## 5. Verify

After the box comes back up:

```
uname -r                          # expect: 6.18.39-<build>.el<7|8|9>.iworx.x86_64
svstat /service/dnscache          # expect: up, uptime climbing (not 0-1 seconds)
dig @127.0.0.1 interworx.com mx   # expect: NOERROR
systemctl is-active djbdns        # expect: active (enabled unit survives reboots)
```

You are now running the test kernel. Proceed with your testing.

## Rolling back

Reboot and pick your previous distro kernel from the boot menu, or set it as the
default and reboot:

```
grubby --info=ALL | grep -E '^kernel='     # list installed kernels
grubby --set-default /boot/vmlinuz-<your-previous-kernel>
reboot
```

To remove the package entirely (do this while booted on another kernel):

```
dnf remove kernel-iwx      # (yum remove on EL7)
```

## Known caveats (test kernel)

- Packages are unsigned; `gpgcheck=0` in the repo file.
- kdump may not arm on EL7 with this non-distro kernel (crash dumps unavailable).
- Secure Boot is not supported (module signing is disabled).
- APF older than 1.7.6-3.65.1 cannot flush rules on 6.18 (`apf --stop`/`-f`
  exit 0 while all rules stay active). Fixed by the apf build in this repo -
  step 2 covers it. If you skipped step 2, upgrade apf and the problem is
  gone; no other workaround needed.