The only reason I’d use Ubuntu these days is their shipped kernels coke with ZFS. Otherwise I’m a Fedora/CentOS boy.
Stable Linux mainline builds for Ubuntu
11–20 of 59 posts
Re: Stable Linux mainline builds for Ubuntu
#12It would be great if he gave some examples which issues he encountered. I just used the standard ubuntu out of box experience and had no issues ever.
Re: Stable Linux mainline builds for Ubuntu
#13Earlier quoted context omitted.
You say that as though it's easy. I've yet to find an explanation that's shorter than a book.
The truth is, it doesn't necessarily have to be a book long, but much like setting up PKI, it certainly can be. What we really need is simple tooling that handles just the case of "I want to sign kernels for my own machine(s)". Of course, some tools do exist for this case, but I'm not aware of one that is totally generic. Lanzaboote for NixOS seems interesting (disclaimer: have not tried.)
It so happens I'm running NixOS... so thanks a lot for the reference! :D
Re: Stable Linux mainline builds for Ubuntu
#14I think he means stable rather than mainline?
I run the stable kernel, which I build myself. There is still the occasional regression. About a year ago it had a regression in the Intel graphics driver which broke graphics for my Haswell chip. A patch was available but this wasn't merged for months. Luckily Gentoo makes it super easy to apply custom patches so I did. IMO if you want to run a stable or mainline kernel yourself you might as well build it yourself too.
Re: Stable Linux mainline builds for Ubuntu
#15Earlier quoted context omitted.
The truth is, it doesn't necessarily have to be a book long, but much like setting up PKI, it certainly can be. What we really need is simple tooling that handles just the case of "I want to sign kernels for my own machine(s)". Of course, some tools do exist for this case, but I'm not aware of one that is totally generic. Lanzaboote for NixOS seems interesting (disclaimer: have not tried.)
It so happens I'm running NixOS... so thanks a lot for the reference! :D
Another option for NixOS is bootspec-secureboot, I'm using it with no real complaints: https://github.com/DeterminateSystems/bootspec-secureboot
Re: Stable Linux mainline builds for Ubuntu
#16You can install mainline builds natively from here: https://wiki.ubuntu.com/Kernel/MainlineBuilds
Re: Stable Linux mainline builds for Ubuntu
#17Coming from windows, I’m a little confused how this works, is he reinstalling Linux/Ubuntu every week on all his machines? Or is it possible to “upgrade in place” just the kernel and leave your files/data alone, if the latter, is there a good guide for how to do that and for a homelabber would that be a good idea to avoid security bugs?
Re: Stable Linux mainline builds for Ubuntu
#18Coming from windows, I’m a little confused how this works, is he reinstalling Linux/Ubuntu every week on all his machines? Or is it possible to “upgrade in place” just the kernel and leave your files/data alone, if the latter, is there a good guide for how to do that and for a homelabber would that be a good idea to avoid security bugs?
Installing kernel in Ubuntu is simply, given that you already have a kernel deb, a single line "apt-get install". You can create your own package apt repo or use the one provided by the author https://github.com/zabbly/linux#installation
Be aware that upgrading kernel usually mess with graphics driver, especially for Nvidia. In the best case you'll have to unload and reload the Nvidia driver, in the worst case your driver just stops working.
Re: Stable Linux mainline builds for Ubuntu
#19If I wanted to keep Secureboot enabled, would signing with a MOK and enrolling that key be sufficient?
You say that as though it's easy. I've yet to find an explanation that's shorter than a book.
Ideally signing and enrolling in the UEFI the key to a signed Unified Kernel Image (UKI) makes more sense: only having SecureBoot verifying the kernel is okay'ish (and it does work: I tried modifying a single bit from my kernel and the UEFI refused to boot it) but it's not that great if the attacker can still modify the initrd etc.
Re: Stable Linux mainline builds for Ubuntu
#20Coming from windows, I’m a little confused how this works, is he reinstalling Linux/Ubuntu every week on all his machines? Or is it possible to “upgrade in place” just the kernel and leave your files/data alone, if the latter, is there a good guide for how to do that and for a homelabber would that be a good idea to avoid security bugs?
In a classic Linux distro, various OS components are much less tightly coupled than in Windows. You can easily update the linux kernel, without updating all the system libraries, daemons, configs, tools, applications, much less your user configs and data. This is done every time "apt-get upgrade" installs an upgraded kernel package, which can be more often than monthly, depending on linux distro. And all the other components can be updated separately, like openssl libraries, init system binaries, tools like git, etc. You can swap in your own alternative for any component, if you know how. The linux kernel is one of the easiest components to swap because the linux syscall ABI is very backwards compatible. (Linux compatibility challenges are about user-land libraries which are all separate and up to the development policy of those library authors, modulated by the update policy of the distro.)
I find modern Windows and macOS updates to be frustratingly opaque and slow. Linux distro updates, on the popular/common distros like debian and arch, are one of my favorite parts of using the system. It'll just install updates for like 200 separate packages (libraries, tools, etc) bang, bang, bang, less than a minute, done. And with the absurdly high speed of todays CPUs and storage, why should it take longer? What are Windows and macOS even doing? I will accept linux has some drawbacks and disadvantages, but the system package managers have been fantastic, for about 2 decades now.