Kernel panic in gentoo-sources 5.4.11, 5.4.12 [Partly solved

[rickj]

Having built the gentoo-sources kernels 5.4.11 and 5.4.12 this week, I find that neither will boot. My present kernel 5.4.8 boots correctly. The error message is:

[Irre]

I had the same error!

But after updating genkernel it worked

My command was: time (emerge -1 gentoo-sources;genkernel --menuconfig --install --integrated-initramfs --kernel-config=/proc/config.gz all)

[rickj]

This is encouraging. I've never used genkernel, but perhaps I should give it a try.

I would still be interested to know what is going on, and what genkernel does that my build omits.

The full error screen is at https://postimg.cc/5X3QvngW. Sorry about the quality, 'phone does not like to focus so close.

[rickj]

Progress: I now have a bootable gentoo-sources-5.4.12 kernel.

Reviewing the dmesg in the old, bootable 5.4.8 kernel, there were kernel-lockdown complaints in the early stages of boot. These were not fatal, but in the later kernels they apparently are fatal. In my case the kernel-lockdown prevented ring_buffer_set_clock from operating, and the boot process ended. Disabling kernel lockdown in .config produced a bootable kernel.

Kernel lockdown is clearly a useful facility, but apparently it needs to be used with more care than I can manage at present. If some kind soul with a better understanding of this facility would write up some guidelines, I would be very grateful.

[Hu]

My understanding of the lockdown patches is that if you have to ask someone to explain them to you, you probably don't need them and will just turn them off after you read the explanation. They're targeted to situations where you want to have the root user still be unable to do certain things that would be bad for longterm security. For most home users, root is all-powerful and the owner of the system likes it that way, so disabling lockdown is the right choice.

[rickj]

Indeed, Hu, for most of my systems an omnipotent root is the appropriate choice. I run a work network, and I suspect that the firewall and the webserver might benefit from some degree of lockdown.