Version : 2024.01

Dernière mise-à-jour :

LCF607 - Gestion du Noyau et des Quotas

Contenu du Module

LCF607 - Gestion du Noyau et des Quotas

Contenu du Module

Rôle du noyau

LAB #1 - Modules

LAB #2 - Compilation et installation du noyau et des modules

2.1 - Déplacer /home

2.2 - Préparer l'Environnement

2.3 - Préparer l'Arborescence Source du Noyau

Le Fichier .config

Le Fichier Makefile

2.4 - Paramétrage du noyau

2.5 - Compiler le Noyau

2.6 - Installer le Nouveau Noyau

LAB #3 - Gestion des Quotas

3.1 - La Commande quotacheck

3.2 - La Commande edquota

3.3 - La Commande quotaon

3.4 - La Commande repquota

3.5 - La Commande quota

3.6 - La Commande warnquota

Rôle du noyau

Le noyau ou kernel est la partie du système d'exploitation qui gère les entrées/sorties avec des périphériques. Dans certains cas il est préférable de recompiler le noyau de Linux. La motivation de cette recompilation peut être :

la diminution de la taille du noyau,

la prise en charge de nouveau matériel,

l'ajout de fonctionnalités,

l'optimisation du code,

la correction de bogues,

le besoin d'une fonctionnalité expérimentale.

Commencez par mettre à jour CentOS 8 :

[root@centos8 ~]# dnf update
...
[root@centos8 ~]# reboot

Identifiez ensuite le noyau utilisé par votre machine virtuelle :

[root@centos8 ~]# uname -r
4.18.0-305.7.1.el8_4.x86_64

LAB #1 - Modules

Dans le cas d'une utilisation courante de Linux, il est cependant préférable de faire appel aux modules. Les modules se trouvent dans le répertoire /lib/modules/<version-du-noyau> :

[root@centos8 ~]# ls /lib/modules/`uname -r`/
bls.conf modules.builtin modules.networking System.map
build modules.builtin.bin modules.order updates
config modules.dep modules.softdep vdso
kernel modules.dep.bin modules.symbols vmlinuz
modules.alias modules.devname modules.symbols.bin weak-updates
modules.alias.bin modules.drm source
modules.block modules.modesetting symvers.gz

Les commandes pour manipuler les modules sont :

insmod

rmmod

lsmod

modprobe

Par exemple :

[root@centos8 ~]# lsmod
Module Size Used by
xt_CHECKSUM 16384 1
ipt_MASQUERADE 16384 3
xt_conntrack 16384 1
ipt_REJECT 16384 2
nft_compat 20480 16
nf_nat_tftp 16384 0
nft_objref 16384 1
nf_conntrack_tftp 16384 3 nf_nat_tftp
nft_counter 16384 33
tun 53248 1
bridge 192512 0
stp 16384 1 bridge
llc 16384 2 bridge,stp
nft_fib_inet 16384 1
nft_fib_ipv4 16384 1 nft_fib_inet
nft_fib_ipv6 16384 1 nft_fib_inet
nft_fib 16384 3 nft_fib_ipv6,nft_fib_ipv4,nft_fib_inet
nft_reject_inet 16384 5
nf_reject_ipv4 16384 2 nft_reject_inet,ipt_REJECT
nf_reject_ipv6 16384 1 nft_reject_inet
nft_reject 16384 1 nft_reject_inet
nft_ct 20480 19
nf_tables_set 49152 21
nft_chain_nat 16384 12
nf_nat 45056 3 ipt_MASQUERADE,nf_nat_tftp,nft_chain_nat
nf_conntrack 172032 6 xt_conntrack,nf_nat,nf_conntrack_tftp,nft_ct,ipt_MASQUERADE,nf_nat_tftp
nf_defrag_ipv6 20480 1 nf_conntrack
nf_defrag_ipv4 16384 1 nf_conntrack
ip_set 49152 0
nf_tables 172032 414 nft_ct,nft_compat,nft_reject_inet,nft_fib_ipv6,nft_objref,nft_fib_ipv4,nft_counter,nft_chain_nat,nf_tables_set,nft_reject,nft_fib,nft_fib_inet
nfnetlink 16384 4 nft_compat,nf_tables,ip_set
sunrpc 540672 1
ext4 761856 1
mbcache 16384 1 ext4
jbd2 131072 1 ext4
virtio_balloon 20480 0
pcspkr 16384 0
i2c_piix4 24576 0
joydev 24576 0
ip_tables 28672 0
xfs 1515520 1
libcrc32c 16384 4 nf_conntrack,nf_nat,nf_tables,xfs
sr_mod 28672 0
sd_mod 53248 3
cdrom 65536 1 sr_mod
t10_pi 16384 1 sd_mod
sg 40960 0
ata_generic 16384 0
bochs_drm 16384 1
drm_vram_helper 28672 1 bochs_drm
drm_kms_helper 233472 4 drm_vram_helper,bochs_drm
syscopyarea 16384 1 drm_kms_helper
sysfillrect 16384 1 drm_kms_helper
sysimgblt 16384 1 drm_kms_helper
fb_sys_fops 16384 1 drm_kms_helper
drm_ttm_helper 16384 1 drm_vram_helper
ttm 114688 2 drm_vram_helper,drm_ttm_helper
drm 569344 7 drm_kms_helper,drm_vram_helper,bochs_drm,drm_ttm_helper,ttm
ahci 40960 2
libahci 40960 1 ahci
virtio_net 53248 0
net_failover 24576 1 virtio_net
ata_piix 36864 0
serio_raw 16384 0
failover 16384 1 net_failover
libata 270336 4 ata_piix,libahci,ahci,ata_generic
dm_mirror 28672 0
dm_region_hash 20480 1 dm_mirror
dm_log 20480 2 dm_region_hash,dm_mirror
dm_mod 151552 8 dm_log,dm_mirror
fuse 151552 3

Pour ajouter un module, on peut utiliser la commande insmod ou modprobe. Cette dernière ajoute non seulement le module passé en argument mais également ses dépendances :

[root@centos8 ~]# modprobe bonding
[root@centos8 ~]# lsmod | more
Module Size Used by
bonding 196608 0
xt_CHECKSUM 16384 1
ipt_MASQUERADE 16384 3
xt_conntrack 16384 1
ipt_REJECT 16384 2
nft_compat 20480 16
nf_nat_tftp 16384 0
nft_objref 16384 1
nf_conntrack_tftp 16384 3 nf_nat_tftp
nft_counter 16384 33
tun 53248 1
bridge 192512 0
stp 16384 1 bridge
llc 16384 2 bridge,stp
nft_fib_inet 16384 1
nft_fib_ipv4 16384 1 nft_fib_inet
nft_fib_ipv6 16384 1 nft_fib_inet
nft_fib 16384 3 nft_fib_ipv6,nft_fib_ipv4,nft_fib_inet
nft_reject_inet 16384 5
nf_reject_ipv4 16384 2 nft_reject_inet,ipt_REJECT
nf_reject_ipv6 16384 1 nft_reject_inet
--More--

Pour supprimer un module, on peut utiliser la commande rmmod ou modprobe -r. Cette dernière essaie de supprimer les dépendances non-utilisées :

[root@centos8 ~]# modprobe -r bonding
[root@centos8 ~]# lsmod | more
Module Size Used by
xt_CHECKSUM 16384 1
ipt_MASQUERADE 16384 3
xt_conntrack 16384 1
ipt_REJECT 16384 2
nft_compat 20480 16
nf_nat_tftp 16384 0
nft_objref 16384 1
nf_conntrack_tftp 16384 3 nf_nat_tftp
nft_counter 16384 33
tun 53248 1
bridge 192512 0
stp 16384 1 bridge
llc 16384 2 bridge,stp
nft_fib_inet 16384 1
nft_fib_ipv4 16384 1 nft_fib_inet
nft_fib_ipv6 16384 1 nft_fib_inet
nft_fib 16384 3 nft_fib_ipv6,nft_fib_ipv4,nft_fib_inet
nft_reject_inet 16384 5
nf_reject_ipv4 16384 2 nft_reject_inet,ipt_REJECT
nf_reject_ipv6 16384 1 nft_reject_inet
nft_reject 16384 1 nft_reject_inet
--More--

Les dépendances des modules sont résolues par la commande modprobe grâce aux fichier /lib/modules/<version-du-noyau>/modules.dep. Ce dernier peut être créé manuellement grâce à la commande depmod :

[root@centos8 ~]# more /lib/modules/`uname -r`/modules.dep
kernel/arch/x86/events/amd/power.ko.xz:
kernel/arch/x86/events/intel/intel-uncore.ko.xz:
kernel/arch/x86/events/intel/intel-cstate.ko.xz:
kernel/arch/x86/events/rapl.ko.xz:
kernel/arch/x86/kernel/cpu/mce/mce-inject.ko.xz:
kernel/arch/x86/crypto/des3_ede-x86_64.ko.xz: kernel/crypto/des_generic.ko.xz
kernel/arch/x86/crypto/camellia-x86_64.ko.xz:
kernel/arch/x86/crypto/blowfish-x86_64.ko.xz: kernel/crypto/blowfish_common.ko.xz
kernel/arch/x86/crypto/twofish-x86_64.ko.xz: kernel/crypto/twofish_common.ko.xz
kernel/arch/x86/crypto/twofish-x86_64-3way.ko.xz: kernel/arch/x86/crypto/twofish-x86_64.ko.
xz kernel/crypto/twofish_common.ko.xz
kernel/arch/x86/crypto/chacha20-x86_64.ko.xz: kernel/crypto/chacha20_generic.ko.xz
kernel/arch/x86/crypto/serpent-sse2-x86_64.ko.xz: kernel/crypto/serpent_generic.ko.xz
kernel/arch/x86/crypto/ghash-clmulni-intel.ko.xz:
kernel/arch/x86/crypto/crc32c-intel.ko.xz:
kernel/arch/x86/crypto/crc32-pclmul.ko.xz:
kernel/arch/x86/crypto/sha512-ssse3.ko.xz: kernel/crypto/sha512_generic.ko.xz
kernel/arch/x86/crypto/crct10dif-pclmul.ko.xz:
kernel/arch/x86/crypto/poly1305-x86_64.ko.xz: kernel/crypto/poly1305_generic.ko.xz
kernel/arch/x86/crypto/camellia-aesni-avx-x86_64.ko.xz: kernel/arch/x86/crypto/camellia-x86
_64.ko.xz
kernel/arch/x86/crypto/cast5-avx-x86_64.ko.xz: kernel/crypto/cast5_generic.ko.xz kernel/cry
--More--(0%)

Il est possible d'obtenir des informations sur un module grâce à la commande modinfo :

[root@centos8 ~]# modinfo bonding
filename: /lib/modules/4.18.0-305.7.1.el8_4.x86_64/kernel/drivers/net/bonding/bonding.ko.xz
author: Thomas Davis, tadavis@lbl.gov and many others
description: Ethernet Channel Bonding Driver
license: GPL
alias: rtnl-link-bond
rhelversion: 8.4
srcversion: 445F4CC9A2F7E64E3A87FD0
depends:
intree: Y
name: bonding
vermagic: 4.18.0-305.7.1.el8_4.x86_64 SMP mod_unload modversions
sig_id: PKCS#7
signer: CentOS kernel signing key
sig_key: 3B:5A:0A:B8:8E:4A:51:C0:AA:FF:97:FD:CB:94:D6:B6:D2:46:B8:17
sig_hashalgo: sha256
signature: B2:3A:20:BE:2B:F3:E0:5A:1A:74:0E:69:76:40:2A:D4:80:10:2C:5A:
B7:F1:1E:7A:71:13:29:F0:0A:4A:28:EE:81:33:C8:C2:5C:BD:FF:E4:
3F:A9:15:A3:9A:0E:A7:98:9E:99:06:23:10:47:D3:B2:48:B3:F1:61:
BE:4B:B0:FC:62:B9:3B:D6:64:CC:E3:29:01:4D:91:92:32:FD:EB:54:
44:F1:2C:1B:23:30:F1:3E:EE:69:EA:94:54:D9:A0:8D:16:53:F5:20:
DE:38:A0:13:E8:2F:89:66:CB:11:D7:AA:30:37:7B:EC:DF:A1:69:29:
7F:4E:80:4D:34:6E:F2:07:01:FA:18:23:94:58:10:C6:97:27:68:B9:
D8:08:5E:9D:00:17:F4:1B:48:BE:CA:BF:5C:5A:A8:6D:36:EE:3F:95:
BA:BE:59:82:EE:7B:CA:BB:32:1E:E3:05:ED:C9:C2:C8:10:64:B9:29:
B8:09:4B:79:42:65:1A:FA:99:96:BA:7E:2D:6E:75:F1:91:0E:F4:9A:
8F:11:10:9F:70:BD:35:06:BE:F0:4C:D8:AB:D5:C4:E1:B3:A2:2A:CA:
58:CA:9E:16:1D:0C:BE:9C:37:A1:82:20:6F:24:CD:23:63:F7:F5:BC:
6E:81:14:F0:52:DA:04:0E:9D:CC:17:60:2D:B0:D8:BD:6E:2C:AD:E7:
50:48:49:B6:57:96:AC:FD:A4:29:33:01:43:92:32:88:A2:AC:CB:93:
2F:C3:29:F3:01:77:84:00:AB:AA:C8:59:43:F1:DA:90:7B:5F:9A:A9:
CA:60:97:34:85:5E:98:56:73:03:0D:D7:8D:A6:AB:51:D4:8C:92:91:
0C:0A:BA:6B:92:01:16:FE:8B:86:80:11:5F:8E:21:BD:C2:2F:02:58:
A6:CF:6C:E3:87:28:8B:4D:CE:54:8C:00:B3:F7:AE:9E:01:81:1E:83:
AE:6D:58:B0:10:98:36:D9:69:76:E2:C0:E2:15:94:3B:D4:14:19:D9:
59:86:75:31
parm: max_bonds:Max number of bonded devices (int)
parm: tx_queues:Max number of transmit queues (default = 16) (int)
parm: num_grat_arp:Number of peer notifications to send on failover event (alias of num_unsol_na) (int)
parm: num_unsol_na:Number of peer notifications to send on failover event (alias of num_grat_arp) (int)
parm: miimon:Link check interval in milliseconds (int)
parm: updelay:Delay before considering link up, in milliseconds (int)
parm: downdelay:Delay before considering link down, in milliseconds (int)
parm: use_carrier:Use netif_carrier_ok (vs MII ioctls) in miimon; 0 for off, 1 for on (default) (int)
parm: mode:Mode of operation; 0 for balance-rr, 1 for active-backup, 2 for balance-xor, 3 for broadcast, 4 for 802.3ad, 5 for balance-tlb, 6 for balance-alb (charp)
parm: primary:Primary network device to use (charp)
parm: primary_reselect:Reselect primary slave once it comes up; 0 for always (default), 1 for only if speed of primary is better, 2 for only on active slave failure (charp)
parm: lacp_rate:LACPDU tx rate to request from 802.3ad partner; 0 for slow, 1 for fast (charp)
parm: ad_select:802.3ad aggregation selection logic; 0 for stable (default), 1 for bandwidth, 2 for count (charp)
parm: min_links:Minimum number of available links before turning on carrier (int)
parm: xmit_hash_policy:balance-alb, balance-tlb, balance-xor, 802.3ad hashing method; 0 for layer 2 (default), 1 for layer 3+4, 2 for layer 2+3, 3 for encap layer 2+3, 4 for encap layer 3+4, 5 for vlan+srcmac (charp)
parm: arp_interval:arp interval in milliseconds (int)
parm: arp_ip_target:arp targets in n.n.n.n form (array of charp)
parm: arp_validate:validate src/dst of ARP probes; 0 for none (default), 1 for active, 2 for backup, 3 for all (charp)
parm: arp_all_targets:fail on any/all arp targets timeout; 0 for any (default), 1 for all (charp)
parm: fail_over_mac:For active-backup, do not set all slaves to the same MAC; 0 for none (default), 1 for active, 2 for follow (charp)
parm: all_slaves_active:Keep all frames received on an interface by setting active flag for all slaves; 0 for never (default), 1 for always. (int)
parm: resend_igmp:Number of IGMP membership reports to send on link failure (int)
parm: packets_per_slave:Packets to send per slave in balance-rr mode; 0 for a random slave, 1 packet per slave (default), >1 packets per slave. (int)
parm: lp_interval:The number of seconds between instances where the bonding driver sends learning packets to each slaves peer switch. The default is 1. (uint)

Dernièrement, les fichiers dans le repertoire /etc/modprobe.d sont utilisés pour spécifier les options éventuelles à passer aux modules lors de leur chargement ainsi que les alias utilisés pour leur faire référence :

[root@centos8 ~]# ls /etc/modprobe.d
firewalld-sysctls.conf lockd.conf nvdimm-security.conf tuned.conf
kvm.conf mlx4.conf truescale.conf vhost.conf
[root@centos8 ~]# cat /etc/modprobe.d/kvm.conf
# Setting modprobe kvm_intel/kvm_amd nested = 1
# only enables Nested Virtualization until the next reboot or
# module reload. Uncomment the option applicable
# to your system below to enable the feature permanently.
#
# User changes in this file are preserved across upgrades.
#
# For Intel
#options kvm_intel nested=1
#
# For AMD
#options kvm_amd nested=1

LAB #2 - Compilation et installation du noyau et des modules

Activez le dépôt CentOS-Stream-PowerTools en passant la directive enabled à 1 :

[root@centos8 ~]# vi /etc/yum.repos.d/CentOS-Stream-PowerTools.repo
[root@centos8 ~]# cat /etc/yum.repos.d/CentOS-Stream-PowerTools.repo
# CentOS-PowerTools.repo
#
# The mirror system uses the connecting IP address of the client and the
# update status of each mirror to pick mirrors that are updated to and
# geographically close to the client. You should use this for CentOS updates
# unless you are manually picking other mirrors.
#
# If the ###mirrorlist= does not work for you, as a fall back you can try the
# remarked out baseurl= line instead.
#
#
[Stream-PowerTools]
name=CentOS-Stream - PowerTools
###mirrorlist=http://###mirrorlist.centos.org/?release=$stream&arch=$basearch&repo=PowerTools&infra=$infra
baseurl=http://vault.centos.org/$contentdir/$stream/PowerTools/$basearch/os/
gpgcheck=1
enabled=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial

Installez maintenant les paquets necéssaires :

[root@centos8 ~]# dnf groupinstall "Development Tools"
...
[root@centos8 ~]# dnf install asciidoc audit-libs-devel bash bc binutils binutils-devel bison diffutils elfutils elfutils-devel elfutils-libelf-devel findutils flex gawk gcc gettext gzip hmaccalc hostname make module-init-tools ncurses-devel net-tools newt-devel numactl-devel openssl patch pciutils-devel perl perl-ExtUtils-Embed pesign redhat-rpm-config rpm-build rpmdevtools sh-utils tar xmlto xz zlib-devel rpmdevtools clang dwarves java-devel kabi-dw libbabeltrace-devel libbpf-devel libcap-devel libmnl-devel libnl3-devel libtraceevent-devel llvm python3-devel python3-docutils
...

2.1 - Déplacer /home

Important - Il n'est pas conseillé de compiler en tant que root pour des raisons de sécurité. Pour pouvoir utiliser le compte d'un utilisateur pour créer un nouveau noyau, celui-ci doit disposer de plus de 10 Go d'espace libre.

A faire - Déconnectez-vous de votre session CentOS8_SSH_10.0.2.45 et re-connectez-vous à la VM en tant que root en utilisant la connexion CentOS8_ROOT_10.0.2.45.

Créez ensuite une seule partition sur /dev/sdc :

[root@centos8 ~]# fdisk /dev/sdc
Welcome to fdisk (util-linux 2.32.1).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.
Device does not contain a recognized partition table.
Created a new DOS disklabel with disk identifier 0xc321702b.
Command (m for help): n
Partition type
p primary (0 primary, 0 extended, 4 free)
e extended (container for logical partitions)
Select (default p):
Using default response p.
Partition number (1-4, default 1):
First sector (2048-41943039, default 2048):
Last sector, +sectors or +size{K,M,G,T,P} (2048-41943039, default 41943039):
Created a new partition 1 of type 'Linux' and of size 20 GiB.
Command (m for help): w
The partition table has been altered.
Calling ioctl() to re-read partition table.
Syncing disks.

Créez maintenant un système de fichiers ext4 sur /dev/sdc1 :

[root@centos8 ~]# mkfs.ext4 /dev/sdc1
mke2fs 1.45.6 (20-Mar-2020)
Discarding device blocks: done
Creating filesystem with 16776960 4k blocks and 4194304 inodes
Filesystem UUID: dc92c0d7-919b-4fff-8719-53e9e7e628dd
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
4096000, 7962624, 11239424
Allocating group tables: done
Writing inode tables: done
Creating journal (65536 blocks): done
Writing superblocks and filesystem accounting information: done

Montez /dev/sdc1 sur /mnt :

[root@centos8 ~]# mount /dev/sdc1 /mnt

Copiez le contenu de /home vers /mnt :

[root@centos8 ~]# cp -a /home/* /mnt

Démontez /dev/sdc1 et déplacez /home vers /root :

[root@centos8 ~]# umount /mnt
[root@centos8 ~]# mv /home /root

Identifiez l'UUID de /dev/sdc1 :

[root@centos8 ~]# ls -l /dev/disk/by-uuid/ | grep sdc1
lrwxrwxrwx. 1 root root 10 Jul 19 12:02 f76d6b66-985b-4a91-af9c-4987e8c1443c -> ../../sdc
[root@centos8 ~]#

Editez le fichier /etc/fstab et ajoutez une ligne pour /dev/sdc1 :

[root@centos8 ~]# vi /etc/fstab
[root@centos8 ~]# cat /etc/fstab
#
# /etc/fstab
# Created by anaconda on Wed Jun 16 06:21:32 2021
#
# Accessible filesystems, by reference, are maintained under '/dev/disk/'.
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info.
#
# After editing this file, run 'systemctl daemon-reload' to update systemd
# units generated from this file.
#
/dev/mapper/cl_centos8-root / xfs defaults 0 0
UUID=1c04981e-5317-4b73-9695-3ce25246835d /boot ext4 defaults 1 2
/dev/mapper/cl_centos8-swap swap swap defaults 0 0
UUID=f76d6b66-985b-4a91-af9c-4987e8c1443c /home ext4 defaults 1 2

Créez le point de montage /home :

[root@centos8 ~]# mkdir /home

Montez /dev/sdc1 :

[root@centos8 ~]# mount -a
[root@centos8 ~]# mount
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime,seclabel)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
devtmpfs on /dev type devtmpfs (rw,nosuid,seclabel,size=1882880k,nr_inodes=470720,mode=755)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,seclabel)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,seclabel,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,nodev,seclabel,mode=755)
tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,seclabel,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,xattr,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime,seclabel)
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime,mode=700)
cgroup on /sys/fs/cgroup/hugetlb type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,hugetlb)
cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,memory)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,cpu,cpuacct)
cgroup on /sys/fs/cgroup/rdma type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,rdma)
cgroup on /sys/fs/cgroup/pids type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,pids)
cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,cpuset)
cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,perf_event)
cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,freezer)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,blkio)
cgroup on /sys/fs/cgroup/net_cls,net_prio type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,net_cls,net_prio)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,seclabel,devices)
none on /sys/kernel/tracing type tracefs (rw,relatime,seclabel)
configfs on /sys/kernel/config type configfs (rw,relatime)
/dev/mapper/cl_centos8-root on / type xfs (rw,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota)
selinuxfs on /sys/fs/selinux type selinuxfs (rw,relatime)
mqueue on /dev/mqueue type mqueue (rw,relatime,seclabel)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime,seclabel,pagesize=2M)
debugfs on /sys/kernel/debug type debugfs (rw,relatime,seclabel)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=40,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=6022)
fusectl on /sys/fs/fuse/connections type fusectl (rw,relatime)
/dev/sda1 on /boot type ext4 (rw,relatime,seclabel)
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw,relatime)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,seclabel,size=382500k,mode=700,uid=1000,gid=1000)
tmpfs on /run/user/42 type tmpfs (rw,nosuid,nodev,relatime,seclabel,size=382500k,mode=700,uid=42,gid=42)
gvfsd-fuse on /run/user/1000/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)
tmpfs on /run/user/0 type tmpfs (rw,nosuid,nodev,relatime,seclabel,size=382500k,mode=700)
gvfsd-fuse on /run/user/0/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=0,group_id=0)
/dev/sdc1 on /home type ext4 (rw,relatime,seclabel)

Notez la taille de /home :

[root@centos8 ~]# df -h
Filesystem Size Used Avail Use% Mounted on
devtmpfs 1.8G 0 1.8G 0% /dev
tmpfs 1.9G 0 1.9G 0% /dev/shm
tmpfs 1.9G 9.4M 1.9G 1% /run
tmpfs 1.9G 0 1.9G 0% /sys/fs/cgroup
/dev/mapper/cl_centos8-root 28G 5.2G 23G 19% /
/dev/sda1 976M 289M 620M 32% /boot
tmpfs 374M 16K 374M 1% /run/user/1000
tmpfs 374M 1.2M 373M 1% /run/user/42
/dev/sdc1 63G 67M 60G 1% /home

A faire - Déconnectez-vous de votre session CentOS8_ROOT_10.0.2.45 et re-connectez-vous à la VM en tant que trainee en utilisant la connexion CentOS8_SSH_10.0.2.45.

2.2 - Préparer l'Environnement

Pour créer l'arborescence de l'environnement de création de paquets dans /home/trainee, utilisez la commande rpmdev-setuptree :

[trainee@centos8 ~]$ rpmdev-setuptree
...>
[trainee@centos8 ~]$ ls -laR rpmbuild/
rpmbuild/:
total 28
drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 .
drwxr-xr-x. 17 trainee trainee 4096 Jul 19 12:10 ..
drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 BUILD
drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 RPMS
drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 SOURCES
drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 SPECS
drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 SRPMS
rpmbuild/BUILD:
total 8
drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 .
drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 ..
rpmbuild/RPMS:
total 8
drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 .
drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 ..
rpmbuild/SOURCES:
total 8
drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 .
drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 ..
rpmbuild/SPECS:
total 8
drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 .
drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 ..
rpmbuild/SRPMS:
total 8
drwxrwxr-x. 2 trainee trainee 4096 Jul 19 12:10 .
drwxrwxr-x. 7 trainee trainee 4096 Jul 19 12:10 ..

Téléchargez le rpm source du noyau :

[root@centos8 ~]# uname -a
Linux centos8.ittraining.loc 4.18.0-553.6.1.el8.x86_64 #1 SMP Thu May 30 04:13:58 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
[root@centos8 ~]# cat /etc/centos-release
CentOS Stream release 8
[trainee@centos8 ~]$ wget https://mirror.stream.centos.org/SIGs/8/kmods/source/kernels/kernel-4.18.0-553.16.1.el8_10.src.rpm

Installez maintenant les dépendances pour le rpm source en tant que root :

[trainee@centos8 ~]$ su -
Mot de passe : fenestros
[root@centos8 ~]# dnf install yum-utils
...
[root@centos8 ~]# yum-builddep /home/trainee/kernel-4.18.0-553.16.1.el8_10.src.rpm
...

Installez maintenant le paquet kernel-4.18.0-553.16.1.el8_10.src.rpm :

[root@centos8 ~]# exit
logout
[trainee@centos8 ~]$ rpm -Uvh kernel-4.18.0-553.16.1.el8_10.src.rpm
Updating / installing...
1:kernel-4.18.0-553.16.1.el8_10 warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
################################# [100%]
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root
warning: user mockbuild does not exist - using root
warning: group mockbuild does not exist - using root

Important - Les erreurs sont sans importance.

2.3 - Préparer l'Arborescence Source du Noyau

Naviguez vers le repertoire ~/rpmbuild/SPECS et utilisez la commande rpmbuild pour préparer l'arborescence source du noyau :

[trainee@centos7 ~]$ cd ~/rpmbuild/SPECS
[trainee@centos7 SPECS]$ rpmbuild -bp --target=$(uname -m) kernel.spec
...

A l'issu du processus, examinez l'arborescence :

[trainee@centos8 SPECS]$ ls -la ~/rpmbuild/BUILD/kernel-4.18.0-305.7.1.el8_4/linux-4.18.0-305.7.1.el8.x86_64/
total 812
drwxr-xr-x. 26 trainee trainee 4096 Jul 14 03:13 .
drwxr-xr-x. 3 trainee trainee 4096 Jul 14 03:12 ..
drwxr-xr-x. 27 trainee trainee 4096 Jul 14 03:13 arch
drwxr-xr-x. 3 trainee trainee 4096 Jun 14 10:33 block
drwxr-xr-x. 2 trainee trainee 4096 Jul 14 03:13 certs
-rw-r--r--. 1 trainee trainee 13079 Jun 14 10:33 .clang-format
-rw-r--r--. 1 trainee trainee 59 Jun 14 10:33 .cocciconfig
drwxr-xr-x. 2 trainee trainee 4096 Jul 14 03:13 configs
-rw-r--r--. 1 trainee trainee 423 Jun 14 10:33 COPYING-4.18.0
-rw-r--r--. 1 trainee trainee 98651 Jun 14 10:33 CREDITS
drwxr-xr-x. 4 trainee trainee 4096 Jun 14 10:33 crypto
drwxr-xr-x. 119 trainee trainee 4096 Jul 14 03:13 Documentation
drwxr-xr-x. 137 trainee trainee 4096 Jun 14 10:33 drivers
drwxr-xr-x. 2 trainee trainee 4096 Jul 14 03:13 firmware
drwxr-xr-x. 73 trainee trainee 4096 Jun 14 10:33 fs
-rw-r--r--. 1 trainee trainee 68 Jun 14 10:33 .get_maintainer.conf
-rw-r--r--. 1 trainee trainee 31 Jun 14 10:33 .get_maintainer.ignore
-rw-r--r--. 1 trainee trainee 76 Jun 14 10:33 .gitattributes
-rw-r--r--. 1 trainee trainee 1639 Jun 14 10:33 .gitlab-ci-private.yml
-rw-r--r--. 1 trainee trainee 1668 Jun 14 10:33 .gitlab-ci.yml
drwxr-xr-x. 30 trainee trainee 4096 Jun 14 10:33 include
drwxr-xr-x. 2 trainee trainee 4096 Jun 14 10:33 init
drwxr-xr-x. 2 trainee trainee 4096 Jun 14 10:33 ipc
-rw-r--r--. 1 trainee trainee 2245 Jun 14 10:33 Kbuild
-rw-r--r--. 1 trainee trainee 575 Jun 14 10:33 Kconfig
drwxr-xr-x. 19 trainee trainee 4096 Jul 14 03:13 kernel
drwxr-xr-x. 20 trainee trainee 12288 Jul 14 03:13 lib
drwxr-xr-x. 5 trainee trainee 4096 Jun 14 10:33 LICENSES
-rw-r--r--. 1 trainee trainee 9559 Jun 14 10:33 .mailmap
-rw-r--r--. 1 trainee trainee 471696 Jun 14 10:33 MAINTAINERS
-rw-r--r--. 1 trainee trainee 61558 Jun 14 10:33 Makefile
-rw-r--r--. 1 trainee trainee 1324 Jun 14 10:33 Makefile.rhelver
-rw-r--r--. 1 trainee trainee 0 Jul 14 03:13 .mismatches
drwxr-xr-x. 3 trainee trainee 4096 Jun 14 10:33 mm
drwxr-xr-x. 72 trainee trainee 4096 Jun 14 10:33 net
-rw-r--r--. 1 trainee trainee 800 Jun 14 10:33 README
drwxr-xr-x. 28 trainee trainee 4096 Jun 14 10:33 samples
-rw-r--r--. 1 trainee trainee 0 Jul 14 03:12 .scmversion
drwxr-xr-x. 14 trainee trainee 4096 Jul 14 03:13 scripts
drwxr-xr-x. 10 trainee trainee 4096 Jun 14 10:33 security
drwxr-xr-x. 26 trainee trainee 4096 Jun 14 10:33 sound
drwxr-xr-x. 33 trainee trainee 4096 Jun 14 10:33 tools
drwxr-xr-x. 2 trainee trainee 4096 Jul 14 03:13 usr
drwxr-xr-x. 4 trainee trainee 4096 Jun 14 10:33 virt

Le Fichier .config

Changez de répertoire de travail :

[trainee@centos8 SPECS]$ cd ~/rpmbuild/BUILD/kernel-*/linux-*/

Copiez le fichier configs/kernel-4.18.0-`uname -m`.config vers .config dans le répertoire courant :

[trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ cp configs/kernel-4.18.0-`uname -m`.config .config

Mettez à jour le fichier .config par rapport à la configuration actuelle du noyau :

[trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ make oldconfig
scripts/kconfig/conf --oldconfig Kconfig
#
# configuration written to .config
#

Important - Cette commande lit le fichier .config du noyau actuel et le compare avec celui des sources du noyau. S'il existent des nouvelles configurations à effectuer dans les sources du noyau, la commande vous pose des questions.

La configuration du noyau se trouve dans un fichier dénommé .config. Le fichier .config est généré par une des trois commandes suivantes et ne doit pas être édité manuellement :

make config

make menuconfig

make xconfig

Exécutez la commande make menuconfig :

[trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ make menuconfig
UPD scripts/kconfig/.mconf-cfg
HOSTCC scripts/kconfig/mconf.o
HOSTCC scripts/kconfig/lxdialog/checklist.o
HOSTCC scripts/kconfig/lxdialog/inputbox.o
HOSTCC scripts/kconfig/lxdialog/menubox.o
HOSTCC scripts/kconfig/lxdialog/textbox.o
HOSTCC scripts/kconfig/lxdialog/util.o
HOSTCC scripts/kconfig/lxdialog/yesno.o
HOSTLD scripts/kconfig/mconf
scripts/kconfig/mconf Kconfig

Dans l'interface, vous pouvez constater la présence de lignes correspondantes à des fonctionalités suivies par une lettre ou une valeur. Dans le cas d'une lettre, la signification est la suivante :

y,

la fonctionalité est incluse dans le noyau monolithique ou dans le cas d'une dépendance d'un module, dans le module concerné,

m,

la fonctionalité est incluse en tant que module,

n,

la fonctionalité n'est pas incluse.

Important - Cette commande permet la modification de la configuration du noyau.

Sauvegardez simplement la configuration actuelle et sortez de l'interface :

*** End of the configuration.
*** Execute 'make' to start the build or try 'make help'.

Vérifiez que le fichier .config a été“ créé par l'exécution de makeconfig :

[trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ ls -a
. .gitattributes Documentation Makefile.rhelver drivers lib tools
.. .gitlab-ci.yml Kbuild README firmware mm usr
.clang-format .mailmap Kconfig arch fs net virt
.cocciconfig .mismatches Kconfig.redhat block include samples
.config .scmversion LICENSES certs init scripts
.config.old COPYING-4.18.0 MAINTAINERS configs ipc security
.get_maintainer.ignore CREDITS Makefile crypto kernel sound

Consultez ce fichier :

[trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ more .config
#
# Automatically generated file; DO NOT EDIT.
# Linux/x86 4.18.0 Kernel Configuration
#
#
# Compiler: gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-22)
#
CONFIG_64BIT=y
CONFIG_X86_64=y
CONFIG_X86=y
CONFIG_INSTRUCTION_DECODER=y
CONFIG_OUTPUT_FORMAT="elf64-x86-64"
CONFIG_ARCH_DEFCONFIG="arch/x86/configs/x86_64_defconfig"
CONFIG_LOCKDEP_SUPPORT=y
CONFIG_STACKTRACE_SUPPORT=y
CONFIG_MMU=y
CONFIG_ARCH_MMAP_RND_BITS_MIN=28
CONFIG_ARCH_MMAP_RND_BITS_MAX=32
CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16
CONFIG_GENERIC_ISA_DMA=y
CONFIG_GENERIC_BUG=y
--More--(0%)

Le Fichier Makefile

Le fichier Makefile contient le nom du noyau et spécifie les informations suivantes :

VERSION,

PATCHLEVEL,

SUBLEVEL,

EXTRAVERSION.

Les trois premières informations sont gérées par kernel.org et Linus Torvalds en personne tandis que l'EXTRAVERSION est gérée par Red Hat :

[trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ more Makefile
# SPDX-License-Identifier: GPL-2.0
VERSION = 4
PATCHLEVEL = 18
SUBLEVEL = 0
EXTRAVERSION =
NAME = Merciless Moray
#
# DRM backport version
#
RHEL_DRM_VERSION = 6
RHEL_DRM_PATCHLEVEL = 3
RHEL_DRM_SUBLEVEL =
RHEL_DRM_EXTRAVERSION =
# *DOCUMENTATION*
# To see a list of typical targets execute "make help"
# More info can be located in ./README
# Comments in this file are targeted only to the developer, do not
# expect to learn how to build the kernel reading this file.
# That's our default target when none is given on the command line
PHONY := _all
--More--(0%)

Important - La version 2.6 du noyau a vu le jour en 2003. Les SUBLEVEL se suivaient régulièrement. Avec la version 2.6 du noyau, la valeur paire du PATCHLEVEL indiquait que le noyau était stable. Quand vous recompilez le noyau à partir des sources, vous devez modifier la valeur de l'EXTRAVERSION. Le passage à la version 3.0 fut décidé par Linus Torvalds à l'occasion des 20 ans du noyau Linux. Depuis l'arrivée de la version 3 du noyau, la signification de la valeur de PATCHLEVEL paire et impaire a été abondonnée.

2.4 - Paramétrage du noyau

Insérez la sortie de la commande uname -i sur la première ligne du fichier .config :

[trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ uname -i
x86_64
[trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ vi .config
[trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ head .config
# x86_64
#
# Automatically generated file; DO NOT EDIT.
# Linux/x86 4.18.0 Kernel Configuration
#
#
# Compiler: gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-22)
#
CONFIG_64BIT=y

Renommez le fichier .config en le plaçant dans le répertoire ~/rpmbuild/SOURCES/ :

[trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ cp .config ~/rpmbuild/SOURCES/config-`uname -m`-generic
[trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ ls ~/rpmbuild/SOURCES
Module.kabi_aarch64 filter-s390x.sh linux-4.18.0-553.16.1.el8_10.tar.xz
Module.kabi_dup_aarch64 filter-x86_64.sh linux-kernel-test.patch
Module.kabi_dup_ppc64le gating.yaml mod-blacklist.sh
Module.kabi_dup_s390x generate_all_configs.sh mod-extra.list
Module.kabi_dup_x86_64 generate_bls_conf.sh mod-internal.list
Module.kabi_ppc64le kernel-aarch64-debug.config mod-sign.sh
Module.kabi_s390x kernel-aarch64.config parallel_xz.sh
Module.kabi_x86_64 kernel-abi-stablelists-4.18.0-553.tar.bz2 process_configs.sh
centossecureboot201.cer kernel-kabi-dw-4.18.0-553.tar.bz2 redhatsecureboot302.cer
centossecurebootca2.cer kernel-ppc64le-debug.config redhatsecureboot303.cer
check-kabi kernel-ppc64le.config redhatsecureboot501.cer
config-x86_64-generic kernel-s390x-debug.config redhatsecurebootca3.cer
cpupower.config kernel-s390x-zfcpdump.config redhatsecurebootca7.cer
cpupower.service kernel-s390x.config rheldup3.x509
filter-aarch64.sh kernel-x86_64-debug.config rhelkpatch1.x509
filter-modules.sh kernel-x86_64.config rpminspect.yaml
filter-ppc64le.sh kvm_stat.logrotate x509.genkey

Copiez le contenu du répertoire configs vers le répertoire ~/rpmbuild/SOURCES/ :

[trainee@centos8 linux-4.18.0-553.16.1.el8.x86_64]$ cp configs/* ~/rpmbuild/SOURCES/

Editez la directive buildid dans le fichier ~/rpmbuild/SPECS/kernel.spec :

[trainee@centos8 linux-4.18.0-305.7.1.el8.x86_64]$ cd ~/rpmbuild/SPECS
[trainee@centos8 SPECS]$ vi kernel.spec
[trainee@centos8 SPECS]$ head -n 50 kernel.spec
# We have to override the new %%install behavior because, well... the kernel is special.
%global __spec_install_pre %{___build_pre}
# At the time of this writing (2019-03), RHEL8 packages use w2.xzdio
# compression for rpms (xz, level 2).
# Kernel has several large (hundreds of mbytes) rpms, they take ~5 mins
# to compress by single-threaded xz. Switch to threaded compression,
# and from level 2 to 3 to keep compressed sizes close to "w2" results.
#
# NB: if default compression in /usr/lib/rpm/redhat/macros ever changes,
# this one might need tweaking (e.g. if default changes to w3.xzdio,
# change below to w4T.xzdio):
%define _binary_payload w3T.xzdio
%global distro_build 553
# Sign the x86_64 kernel for secure boot authentication
%ifarch x86_64 aarch64 s390x ppc64le
%global signkernel 1
%else
%global signkernel 0
%endif
# Sign modules on all arches
%global signmodules 1
# Compress modules only for architectures that build modules
%ifarch noarch
%global zipmodules 0
%else
%global zipmodules 1
%endif
%if %{zipmodules}
%global zipsed -e 's/\.ko$/\.ko.xz/'
%endif
%define buildid .ittraining
%define specversion 4.18.0
%define pkgrelease 553.16.1.el8_10
# allow pkg_release to have configurable %%{?dist} tag
%define specrelease 553.16.1%{?dist}
%define pkg_release %{specrelease}%{?buildid}
# libexec dir is not used by the linker, so the shared object there
# should not be exported to RPM provides
%global __provides_exclude_from ^%{_libexecdir}/kselftests

2.5 - Compiler le Noyau

La compilation du noyau peut prendre beaucoup de temps (~5 heures). La commande utilisée est la suivante :

[trainee@centos8 SPECS]$ rpmbuild -bb --target=`uname -m` kernel.spec 2> build-err.log | tee build-out.log &
[1] 96990
[trainee@centos8 SPECS]$ Building target platforms: x86_64
Building for target x86_64
...

Important - La compilation peut prendre des heures.

A l'issu du processus, les RPMs se trouvent dans le répertoire /home/trainee/rpmbuild/RPMS/x86_64/ :

...
Wrote: /home/trainee/rpmbuild/RPMS/x86_64/kernel-4.18.0-553.16.1.el8.ittraining.x86_64.rpm
...
[1]+ Done rpmbuild -bb --target=`uname -m` kernel.spec 2> build-err.log | tee build-out.log

Notez que la génération du nouveau noyau peut consommer jusqu'à 21 Go d'espace disque :

[trainee@centos8 x86_64]$ df -h
Filesystem Size Used Avail Use% Mounted on
devtmpfs 1.8G 0 1.8G 0% /dev
tmpfs 1.9G 0 1.9G 0% /dev/shm
tmpfs 1.9G 9.4M 1.9G 1% /run
tmpfs 1.9G 0 1.9G 0% /sys/fs/cgroup
/dev/mapper/cl_centos8-root 28G 5.5G 23G 20% /
/dev/sda1 976M 289M 620M 32% /boot
tmpfs 374M 24K 374M 1% /run/user/1000
tmpfs 374M 1.2M 373M 1% /run/user/42
/dev/sdc1 63G 21G 39G 35% /home

2.6 - Installer le Nouveau Noyau

Installez maintenant les paquets kernel*. L'installation du noyau peut prendre beaucoup de temps (~2 heures). La commande utilisée est la suivante : :

[trainee@centos8 SPECS]$ cd ../RPMS/x86_64
[root@centos8 x86_64]# dnf localinstall kernel-*.rpm

A l'issu de l'installation, re-démarrez la VM :

[root@centos7 ~]# reboot

Connectez-vous en tant que trainee et devenez root. Constatez l'entrée saved-entry du fichier /boot/grub2/grubenv :

[root@centos8 ~]# grep ittraining /boot/grub2/grubenv
saved_entry=95bd69e34a7444a7b58cb74fbfb86df2-4.18.0-553.16.1.el8.ittraining.x86_64

Dernièrement, vérifiez l'utilisation du nouveau noyau :

[root@centos8 ~]# uname -r
4.18.0-553.16.1.el8.ittraining.x86_64

LAB #3 - Gestion des Quotas

Sous Linux il est possible de mettre en place des quotas par utilisateur et par groupe. Ceci étant, Linux ne sait pas gérer des quotas par répertoire, uniquement des quotas par partition. L'administrateur met souvent des quotas en place sur l'arborescence de /home pour limiter l'espace de stockage occupé par les utilisateurs.

Déconnectez-vous et reconnectez-vous directement en tant que root :

root@computeXX:~# ssh -l root 10.0.2.45
root@10.0.2.45's password: fenestros
Activate the web console with: systemctl enable --now cockpit.socket
Last login: Wed Jul 21 11:14:31 2021
[root@centos8 ~]#

Avant de mettre en place des quotas, configurer SELINUX en mode permissive afin de ne pas avoir d'erreurs de ce dernier :

[root@centos8 ~]# getenforce
Enforcing
[root@centos8 ~]# setenforce permissive
[root@centos8 ~]# getenforce
Permissive
[root@centos8 ~]#

Editez ensuite le fichier /etc/sysconfig/selinux ainsi :

[root@centos8 ~]# vi /etc/sysconfig/selinux
[root@centos8 ~]# cat /etc/sysconfig/selinux
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
SELINUX=permissive
# SELINUXTYPE= can take one of these three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted

Commencez par vérifiez que le paquet quota est bien installé :

[root@centos8 ~]# rpm -qa | grep quota
quota-4.04-12.el8.x86_64
quota-nls-4.04-12.el8.noarch

Editez le fichier /etc/fstab en ajoutant les options usrquota et grpquota à la ligne /home :

[root@centos8 ~]# vi /etc/fstab
[root@centos8 ~]# cat /etc/fstab
#
# /etc/fstab
# Created by anaconda on Wed Jun 16 06:21:32 2021
#
# Accessible filesystems, by reference, are maintained under '/dev/disk/'.
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info.
#
# After editing this file, run 'systemctl daemon-reload' to update systemd
# units generated from this file.
#
/dev/mapper/cl_centos8-root / xfs defaults 0 0
UUID=1c04981e-5317-4b73-9695-3ce25246835d /boot ext4 defaults 1 2
/dev/mapper/cl_centos8-swap swap swap defaults 0 0
UUID=f76d6b66-985b-4a91-af9c-4987e8c1443c /home ext4 defaults,usrquota,grpquota 1 2

Redémarrez la VM :

[root@centos8 ~]# reboot

Reconnectez-vous directement en tant que root :

root@computeXX:~# ssh -l root 10.0.2.45
root@10.0.2.45's password: fenestros
Activate the web console with: systemctl enable --now cockpit.socket
Last login: Wed Jul 21 11:19:46 2021
[root@centos8 ~]#

Vérifiez ensuite que les options usrquota et grpquota soient prises en compte :

[root@centos8 ~]# cat /etc/mtab | grep /home
/dev/sdc1 /home ext4 rw,seclabel,relatime,quota,usrquota,grpquota 0 0

3.1 - La Commande quotacheck

Pour activer les quotas sur /home, il convient d'utiliser la commande quotacheck :

[root@centos8 ~]# quotacheck -cugvm -f /dev/sdc1
quotacheck: Your kernel probably supports journaled quota but you are not using it. Consider switching to journaled quota to avoid running quotacheck after an unclean shutdown.
quotacheck: Scanning /dev/sdc1 [/home] done
quotacheck: Cannot stat old user quota file /home/aquota.user: No such file or directory. Usage will not be subtracted.
quotacheck: Cannot stat old group quota file /home/aquota.group: No such file or directory. Usage will not be subtracted.
quotacheck: Cannot stat old user quota file /home/aquota.user: No such file or directory. Usage will not be subtracted.
quotacheck: Cannot stat old group quota file /home/aquota.group: No such file or directory. Usage will not be subtracted.
quotacheck: Checked 6763 directories and 129772 files
quotacheck: Old file not found.
quotacheck: Old file not found.

Les options de la commande quotacheck sont :

[root@centos8 ~]# quotacheck --help
Utility for checking and repairing quota files.
quotacheck [-gucbfinvdmMR] [-F <quota-format>] filesystem|-a
-u, --user check user files
-g, --group check group files
-c, --create-files create new quota files
-b, --backup create backups of old quota files
-f, --force force check even if quotas are enabled
-i, --interactive interactive mode
-n, --use-first-dquot use the first copy of duplicated structure
-v, --verbose print more information
-d, --debug print even more messages
-m, --no-remount do not remount filesystem read-only
-M, --try-remount try remounting filesystem read-only,
continue even if it fails
-R, --exclude-root exclude root when checking all filesystems
-F, --format=formatname check quota files of specific format
-a, --all check all filesystems
-h, --help display this message and exit
-V, --version display version information and exit
Bugs to jack@suse.cz

Les quotas ont été activés et les fichier aquota.user et aquota.group ont été créés dans le répertoire /home :

[root@centos8 ~]# ls -la /home
total 40
drwxr-xr-x. 4 root root 4096 Jul 21 11:27 .
dr-xr-xr-x. 17 root root 224 Jul 19 12:05 ..
-rw-------. 1 root root 7168 Jul 21 11:27 aquota.group
-rw-------. 1 root root 7168 Jul 21 11:27 aquota.user
drwx------. 2 root root 16384 Jul 19 12:02 lost+found
drwxr-xr-x. 17 trainee trainee 4096 Jul 21 11:22 trainee

Créez maintenant un utilisateur fenestros avec le mot de passe fenestros :

[root@centos8 ~]# groupadd fenestros && useradd fenestros -c FenestrOs -d /home/fenestros -g fenestros -s /bin/bash
[root@centos8 ~]# passwd fenestros
Changing password for user fenestros.
New password:
BAD PASSWORD: The password contains the user name in some form
Retype new password:
passwd: all authentication tokens updated successfully.

3.2 - La Commande edquota

Mettez en place maintenant un quota de 10Mo pour l'utilisateur fenestros :

[root@centos8 ~]# edquota -u fenestros -f /home

L'éditeur vi se lance et vous obtiendrez un résultat similaire à celui-ci :

Disk quotas for user fenestros (uid 1001):
Filesystem blocks soft hard inodes soft hard
/dev/sdc1 0 0 0 0 0 0

Modifiez ce fichier ainsi :

Disk quotas for user fenestros (uid 1001):
Filesystem blocks soft hard inodes soft hard
/dev/sdc1 0 8000 10000 0 0 0

Sauvegardez et quittez le fichier.

Les options de la commande edquota sont :

[root@centos8 ~]# edquota --help
edquota: Usage:
edquota [-rm] [-u] [-F formatname] [-p username] [-f filesystem] username ...
edquota [-rm] -g [-F formatname] [-p groupname] [-f filesystem] groupname ...
edquota [-rm] -P [-F formatname] [-p projectname] [-f filesystem] projectname ...
edquota [-u|g|-P] [-F formatname] [-f filesystem] -t
edquota [-u|g|-P] [-F formatname] [-f filesystem] -T username|groupname|projectname ...
-u, --user edit user data
-g, --group edit group data
-P, --project edit project data
-r, --remote edit remote quota (via RPC)
-m, --no-mixed-pathnames trim leading slashes from NFSv4 mountpoints
-F, --format=formatname edit quotas of a specific format
-p, --prototype=name copy data from a prototype user/group
--always-resolve always try to resolve name, even if it is
composed only of digits
-f, --filesystem=filesystem edit data only on a specific filesystem
-t, --edit-period edit grace period
-T, --edit-times edit grace time of a user/group
-h, --help display this help text and exit
-V, --version display version information and exit
Bugs to: jack@suse.cz

Important - Pour mettre en place un quota par group, la procédure est similaire. Il suffit d'utiliser l'option -g de la commande edquota.

3.3 - La Commande quotaon

Appliquez maintenant les quotas :

[root@centos8 ~]# quotaon -a

Les options de la commande quotaon sont :

[root@centos8 ~]# quotaon --help
quotaon: Usage:
quotaon [-guPvp] [-F quotaformat] [-x state] -a
quotaon [-guPvp] [-F quotaformat] [-x state] filesys ...
-a, --all turn quotas on for all filesystems
-f, --off turn quotas off
-u, --user operate on user quotas
-g, --group operate on group quotas
-P, --project operate on project quotas
-p, --print-state print whether quotas are on or off
-x, --xfs-command=cmd perform XFS quota command
-F, --format=formatname operate on specific quota format
-v, --verbose print more messages
-h, --help display this help text and exit
-V, --version display version information and exit

De cette manière vous avez mis en place un quota souple pour fenestros de 8 000 Ko et un quota stricte de 10 000 Ko.

Quand l'utilisateur fenestros aura dépassé le quota souple, il recevra un message d'avertissement. Quand il dépasse le quota stricte, il ne pourra plus enregistrer dans /home, sauf dans le cas où il supprime des fichiers pour retomber en dessous de la limite stricte.

Il est à noter que vous pouvez soit mettre en place un quota en taille, soit mettre en place un quota basé sur le nombre d'inodes utilisés par l'utilisateur.

important - La commande pour désactivez les quotas est quotaoff.

3.4 - La Commande repquota

Pour visualiser les quotas utilisez la commande repquota :

[root@centos8 ~]# repquota /home
*** Report for user quotas on device /dev/sdc1
Block grace time: 7days; Inode grace time: 7days
Block limits File limits
User used soft hard grace used soft hard grace
----------------------------------------------------------------------
root -- 20 0 0 2 0 0
trainee -- 21495888 0 0 136532 0 0

Important - Notez que l'utilisateur fenestros ne figure pas dans la liste. Sous RHEL / CentOS, le quota n'est pas visible tant que l'utilisateur ne s'est pas connecté pour la première fois.

Les options de la commande repquota sont :

[root@centos8 ~]# repquota --help
repquota: Utility for reporting quotas.
Usage:
repquota [-vugsi] [-c|C] [-t|n] [-F quotaformat] [-O (default | xml | csv)] (-a | mntpoint)
-v, --verbose display also users/groups without any usage
-u, --user display information about users
-g, --group display information about groups
-P, --project display information about projects
-s, --human-readable show numbers in human friendly units (MB, GB, ...)
-t, --truncate-names truncate names to 9 characters
-p, --raw-grace print grace time in seconds since epoch
-n, --no-names do not translate uid/gid to name
-i, --no-autofs avoid autofs mountpoints
-c, --cache translate big number of ids at once
-C, --no-cache translate ids one by one
-F, --format=formatname report information for specific format
-O, --output=format format output as xml or csv
-a, --all report information for all mount points with quotas
-h, --help display this help message and exit
-V, --version display version information and exit
Bugs to jack@suse.cz

3.5 - La Commande quota

Pour visualiser les quotas d'un utilisateur spécifique, il convient d'utiliser la commande quota :

[root@centos8 ~]# quota fenestros
Disk quotas for user fenestros (uid 1001): no limited resources used
[root@centos8 ~]# su - fenestros
[fenestros@centos8 ~]$ touch test
[fenestros@centos8 ~]$ exit
logout
[root@centos8 ~]# quota fenestros
Disk quotas for user fenestros (uid 1001):
Filesystem blocks quota limit grace files quota limit grace
/dev/sdc1 8 8000 10000 3 0 0

Les options de la commande quota sont :

[root@centos8 ~]# quota --help
quota: Usage: quota [-guPqvswim] [-l | [-Q | -A]] [-F quotaformat]
quota [-qvswim] [-l | [-Q | -A]] [-F quotaformat] -u username ...
quota [-qvswim] [-l | [-Q | -A]] [-F quotaformat] -g groupname ...
quota [-qvswugPQm] [-F quotaformat] -f filesystem ...
-u, --user display quota for user
-g, --group display quota for group
-P, --project display quota for project
-q, --quiet print more terse message
-v, --verbose print more verbose message
-s, --human-readable display numbers in human friendly units (MB, GB...)
--always-resolve always try to translate name to id, even if it is
composed of only digits
-w, --no-wrap do not wrap long lines
-p, --raw-grace print grace time in seconds since epoch
-l, --local-only do not query NFS filesystems
-Q, --quiet-refuse do not print error message when NFS server does
not respond
-i, --no-autofs do not query autofs mountpoints
-F, --format=formatname display quota of a specific format
-f, --filesystem-list display quota information only for given filesystems
-A, --all-nfs display quota for all NFS mountpoints
-m, --no-mixed-pathnames trim leading slashes from NFSv4 mountpoints
--show-mntpoint show mount point of the file system in output
--hide-device do not show file system device in output
-h, --help display this help message and exit
-V, --version display version information and exit
Bugs to: jack@suse.cz

3.6 - La Commande warnquota

La commande warnquota vérifie le ou les disques et envoie un message par mail à tout utilisateur qui a dépassé la limite soft. Elle est enrègle générale appelée par un job cron. Cependant elle peut aussi est appelée d'une manière intéractive.

Sous RHEL/CentOS, warnquota n'est pas installé par défaut :

[root@centos8 ~]# which warnquota
/usr/bin/which: no warnquota in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/bin)

Installez donc le paquet quota-warnquota :

[root@centos7 ~]# dnf install quota-warnquota
...

Les options de la commande warnquota sont :

[root@centos8 ~]# warnquota --help
warnquota: Usage:
warnquota [-ugsid] [-F quotaformat] [-c configfile] [-q quotatabfile] [-a adminsfile] [filesystem...]
-u, --user warn users
-g, --group warn groups
-s, --human-readable send information in more human friendly units
-i, --no-autofs avoid autofs mountpoints
-d, --no-details do not send quota information itself
-F, --format=formatname use quotafiles of specific format
-c, --config=config-file non-default config file
-q, --quota-tab=quotatab-file non-default quotatab
-a, --admins-file=admins-file non-default admins file
-h, --help display this help message and exit
-v, --version display version information and exit
warnquota: Bugs to jack@suse.cz

Copyright © 2024 Hugh Norris.