# changelog

author: Paul Oehler <poehler@interworx.com>
changelog:
  - Upgrade to https://github.com/rfxn/advanced-policy-firewall/commit/93adac0e19f8e486826dda4c2706dbf294b4b2b8


author: Tim College <tcollege@interworx.com>
changelog:
  - Enumerate flush tables from iptables-save instead of
    /proc/net/ip_tables_names; the proc file is permanently empty on
    nft-backend systems with lazy x_tables registration (kernels >= 5.13),
    so apf --stop/-f silently left all rules active (IWX-15041)


author: Tim College <tcollege@interworx.com>
changelog:
  - Raise dnscache DATALIMIT to 8000000 and overwrite existing installs' env
    value in %post; kernels >= 4.7 enforce RLIMIT_DATA against mmap and the
    old values crash-loop dnscache on enforcing kernels (IWX-15038)


author: Tim College <tcollege@interworx.com>
changelog:
  - Add native systemd unit (enabled) so stop/status work after reboots;
    previously the sysv-generated unit went inactive on reboot and
    'systemctl stop djbdns' silently no-oped while daemons ran under svscan
    (IWX-15039)


author: Tim College <tcollege@interworx.com> - 6.18.38-1.iworx
changelog:
  - Graft the packaging body (BuildKernel staging, boot scriptlets, -devel
    subpackage) from the ELRepo kernel-ml 6.9.7-1.el7 SRPM; single default
    flavour, x86_64, per-OS %if branches.
  - InterWorx additions: EL7 host-tool shims (elf.h via HOSTCFLAGS, copy_file_range
    shim into gen_init_cpio) and the post-olddefconfig config-assertion gate
    (legacy xtables + virtio + ipset + NF_NAT + BBR/fq + XFS quota union).
  - EL8/EL9 config assembly and kernel-install boot integration remain TODO.


author: Tim College <tcollege@interworx.com> - 6.18.38-7.iworx
changelog:
  - Catch-up entry for builds 2 through 7: EL7 config rebased onto the broad
    ELRepo distro base (replacing the localmodconfig trim); EL8/EL9 fully enabled
    (Alma 8.10 / Rocky 9 config bases, gcc-toolset-13 on EL8, kernel-install/BLS
    boot integration, secure-boot infra disabled for vanilla source, nft AND
    legacy iptables backends per the APF posture); portable brp macros with EL7
    fallback definitions (rpm 4.11 predates __brp_*); kernel tarball fetched at
    build time via sources/REMOTE-SOURCES instead of manual placement.


author: Tim College <tcollege@interworx.com> - 6.18.38-8.iworx
changelog:
  - Fleet-parity subpackages (parity with the altarch 5.4 fleet kernel):
    headers (make headers_install), tools (cpupower + debug decoders, turbostat,
    x86_energy_perf_policy, tmon, gpio/iio utilities, intel-speed-select),
    tools-libs and tools-libs-devel (libcpupower); name Provides for the
    Fedora-style kernel-core/-modules split on the monolithic main package.
    EL7: turbostat needs a reallocarray shim (toolscompat.h, glibc 2.17);
    kvm_stat is skipped fleet-wide (python3 script, no python3 on EL7).


author: Tim College <tcollege@interworx.com> - 6.18.38-11.iworx
changelog:
  - Restore the legacy nat and raw table modules (iptable_nat, ip6table_nat,
    iptable_raw, ip6table_raw) plus the MASQUERADE targets, missing from every
    published build: the two-pass olddefconfig flow dropped them because they
    were never on the REQUIRED_M force list and have no legacy-gated Kconfig
    default. Field impact: boot-time ip6tables-restore failed with "unable to
    initialize table 'nat'" on fleet boxes with a *nat block in
    /etc/sysconfig/ip6tables, and iptables-save-based rewrites silently dropped
    *nat from the saved v4 ruleset.


author: Tim College <tcollege@interworx.com> - 6.18.38-13.iworx
changelog:
  - Force and assert the fleet's storage and NIC drivers in the config gate so a
    base-config rebase or localmodconfig slip cannot silently drop them:
    SATA_AHCI, MEGARAID_SAS, SCSI_AACRAID, SCSI_MPT3SAS (every RAID/SATA
    controller in the MH+MA hardware scrape, IWX-15066) plus TIGON3, BNXT, IGB,
    IXGBE, I40E, ICE, E1000, E1000E (every fleet NIC family). All are =m in the
    EL7/EL8/EL9 bases; the gate now fails the build if any goes missing.


author: Tim College <tcollege@interworx.com> - 6.18.39-1.iworx
changelog:
  - Bump to upstream 6.18.39 (longterm, released 2026-07-18). Notable for us: a
    futex/requeue revert that backs out commit 74e144274af39 (it leaked pi_state
    and broke the waiter==owner self-deadlock case), in the rtmutex/futex-PI path
    that GhostLock (CVE-2026-43499) lives in - 6.18.38 shipped that buggy commit.
    Nothing in .39 touches the asserted RAID/NIC driver set, so the config gate is
    unchanged. Ref IWX-15085.


author: Tim College <tcollege@interworx.com> - 6.18.40-1.iworx
changelog:
  - Bump to upstream 6.18.40 (longterm, released 2026-07-24). A stability bump,
    not a CVE response: 1,617 commits, no inline CVE tags. Taken for two things.
    First, a conntrack revert (d53eecbca16f) backing out a 6.18-base change that
    NULLed all ct extensions for unconfirmed conntracks, which upstream notes can
    crash callers that dereference them unchecked - .38 and .39 both shipped it,
    and conntrack runs on every APF/csf box. Second, a five-commit ipset race
    batch (gc not stopped on set destroy, add-vs-dump data race in all hash
    types, test_bit in lockless RCU readers). Also carried: the algif_skcipher
    AF_ALG async IV race, two procfs ptrace_may_access/exec_update_lock race
    fixes, an iomap io_size EOF-trim underflow, and the AMD LBR/BRS kernel
    address leak. Nothing in .40 touches the asserted RAID/NIC driver set, so the
    config gate is unchanged. Ref IWX-15114.


author: Tim College <tcollege@interworx.com> - 6.18.40-2.iworx
changelog:
  - Enable CONFIG_LIVEPATCH and ship debuginfo for self-built live patches
    (kpatch-build), per Nicholas Welch's request. EL8/EL9 already carried
    LIVEPATCH=y from their distro config bases; EL7 now gets it too, and all
    three OSes are pinned to one posture: LIVEPATCH=y + DWARF4 debuginfo,
    force-listed and covered by the config-assertion gate. DWARF4 rather than
    the toolchain default because gcc 11/13 default to DWARF5, which EL7/EL8
    gdb and crash cannot read. DEBUG_INFO_BTF pinned off before it can spring
    alive if pahole ever lands in the mock roots. New kernel-iwx-debuginfo
    subpackage carries the unstripped vmlinux plus per-module .ko.debug
    companions at the standard /usr/lib/debug layout; runtime modules are now
    explicitly stripped with a .gnu_debuglink (previously EL8/EL9 compiled
    debuginfo and brp-strip discarded it; EL7 built none). Ref IWX-15115.


author: Tim College <tcollege@interworx.com> - 6.18.43-1.iworx
changelog:
  - Bump to upstream 6.18.43 (longterm, released 2026-08-06), cumulative over .41
    and .42 since neither was taken on its own. Primary driver is SCTPhantom
    (CVE-2026-64564), fixed in .42: a use-after-free in SCTP ASCONF DEL-IP
    processing where a single chunk carrying [Address Param L][DEL-IP L][DEL-IP
    0.0.0.0] frees asconf->transport and the wildcard DEL-IP then reuses the
    dangling pointer, leaving primary_path/active_path pointing at freed memory.
    CVSS 8.5, demonstrated local privesc to root and container-to-host escape;
    IP_SCTP is =m and autoloadable here, so every kernel-iwx published to date is
    exposed. Also carried: .41's single fix for an unprivileged-local UAF in posix
    CPU timers (timer_delete vs non-leader exec, freeing a still-armed timer),
    .43's single fix hardening the SRSO Safe-RET sequence against interrupt
    injection (AMD-SB-7061, no CVE; ~647 fleet hosts run affected Zen 2/Zen 3
    parts), and .42's iomap zero-length bitmap_set OOB write reachable from an
    ordinary unprivileged write on XFS. Ref IWX-15151.
  - Force RHEL-grade hardening on EL7: FORTIFY_SOURCE, SLAB_FREELIST_HARDENED,
    SLAB_FREELIST_RANDOM, PAGE_POISONING and BPF_JIT_ALWAYS_ON are on in both
    RHEL-derived config bases and were off in ours, because the EL7 base is ELRepo
    kernel-ml tracking mainline defaults rather than Red Hat hardening. Now forced
    and covered by the config-assertion gate, giving all three OSes one posture.
    Compile-time or runtime-gated, so no measurable cost; EL7 is the deployed
    cohort and the slab pair raises the cost of exactly the heap-grooming UAF class
    above. Ref IWX-15152.


