Re: Question on CVE-2017-5754 on Debian 8.9

[Michael Fothergill <michael.fothergill@gmail.com>]

On 25 January 2018 at 15:59, Michael Fothergill <michael.fothergill@gmail.com> wrote:

On 25 January 2018 at 13:14, Michael Fothergill <michael.fothergill@gmail.com> wrote:

On 25 January 2018 at 13:01, Greg Wooledge <wooledg@eeg.ccf.org> wrote:

On Thu, Jan 25, 2018 at 12:36:46PM +0000, Michael Fothergill wrote:
> ​If I become sid and install the kernel correctly, could I go back to being
> just buster (sounds like an energy drink) and carry on using the new kernel?

No.

​It seems I have to become sid here.

​I have become sid and installed a ton of dependencies from the experimental respository and finally installed gcc 8.

After some rehab I will study the web page on compiling kernels in debian.

I need to get the set up to use the GCC 8 compiler I have just installed.

Cheers

MF​

​OK, I went through the dependency detox program (and had some electrodes hooked up to my ears etc) and made a good recovery.

I looked at some web pages on the debian way of compiling kernels etc.

My general strategy is as follows:

1. Download the latest stable kernel from the kernel archives; this is 4.14.15 - I have done this.

2. Use the  tar xf /usr/src/linux-source-4.14.15.tar.xz command to unpack the kernel source file.

​3. cd to the directory where the kernel source lives

4.  Reuse the config file from the 4.14.15 rc8 kernel I already have installed e.g. cp /boot/config-3.16.0-4-amd64 ~/kernel/linux-source-3.16/.config

5. run make menuconfig (I do this in gentoo) I will make sure libncurses5-dev (or does it need to be newer?) is installed to configure it using the recycled config file from 4 above.

6. Run make-kpkg clean.

7. Then run fakeroot make-kpkg --initrd --revision=1.0.custom kernel_image.

8. Then install the kernel as follows: dpkg -i ../linux-image-4.14.15-subarchitecture_1.0.custom_i386.deb.

9. Reboot and look for new kernel in grub menu and log in.

10. Run the patch checker to see that KPTI and retpoline patched are turned on properly.

Please critique the above list.   I am going to read more documentation and improve it before going ahead with this.

Cheers

MF




 

 

MF​