Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stable Linux mainline builds for Ubuntu

stgraber.org

Post reply on HN
Print view View original

31–40 of 59 posts

Re: Stable Linux mainline builds for Ubuntu

#31

Post by rubicks »

TacticalCoder wrote: post #19
Filligree wrote: post #5

Earlier quoted context omitted.

You say that as though it's easy. I've yet to find an explanation that's shorter than a book.

Ideally signing and enrolling in the UEFI the key to a signed Unified Kernel Image (UKI) makes more sense: only having SecureBoot verifying the kernel is okay'ish (and it does work: I tried modifying a single bit from my kernel and the UEFI refused to boot it) but it's not that great if the attacker can still modify the initrd etc.

I thought "unified image" solved this?

https://wiki.archlinux.org/title/Unified_kernel_image#Prepar...

Re: Stable Linux mainline builds for Ubuntu

#32

Post by DHowett »

rubicks wrote: post #31
TacticalCoder wrote: post #19

Earlier quoted context omitted.

Ideally signing and enrolling in the UEFI the key to a signed Unified Kernel Image (UKI) makes more sense: only having SecureBoot verifying the kernel is okay'ish (and it does work: I tried modifying a single bit from my kernel and the UEFI refused to boot it) but it's not that great if the attacker can still modify the initrd etc.

I thought "unified image" solved this? https://wiki.archlinux.org/title/Unified_kernel_image#Prepar...

Indeed, that is what the parent is referring to when they say this:

> Ideally signing and enrolling in the UEFI the key to a signed Unified Kernel Image (UKI) makes more sense

(It's much more useful to have a link to it, so thank you!)

Re: Stable Linux mainline builds for Ubuntu

#35

Post by rubicks »

ploxiln wrote: post #20
vxNsr wrote: post #17

Coming from windows, I’m a little confused how this works, is he reinstalling Linux/Ubuntu every week on all his machines? Or is it possible to “upgrade in place” just the kernel and leave your files/data alone, if the latter, is there a good guide for how to do that and for a homelabber would that be a good idea to avoid security bugs?

In a classic Linux distro, various OS components are much less tightly coupled than in Windows. You can easily update the linux kernel, without updating all the system libraries, daemons, configs, tools, applications, much less your user configs and data. This is done every time "apt-get upgrade" installs an upgraded kernel package, which can be more often than monthly, depending on linux distro. And all the other co…

Same. A long time ago, I envied Windows and Mac users. For the past decade, I mostly just pity them.

Re: Stable Linux mainline builds for Ubuntu

#36

Post by simfree »

rubicks wrote: post #30
anvuong wrote: post #18

Earlier quoted context omitted.

Installing kernel in Ubuntu is simply, given that you already have a kernel deb, a single line "apt-get install". You can create your own package apt repo or use the one provided by the author https://github.com/zabbly/linux#installation Be aware that upgrading kernel usually mess with graphics driver, especially for Nvidia. In the best case you'll have to unload and reload the Nvidia driver, in the worst case your d…

In the _most common_ case (with nvidia), your graphics stops working entirely and you spend (at least) an hour in a virtual console trying to undo what you did. Fun times.

This case ain't very common anymore, just Nvidia proprietary driver users suffer with this commonly these days.

Intel and AMD don't have significant breakage when upgrading the Linux kernel.

Re: Stable Linux mainline builds for Ubuntu

#37

Post by predictabl3 »

schlarpc wrote: post #15
Filligree wrote: post #13

Earlier quoted context omitted.

It so happens I'm running NixOS... so thanks a lot for the reference! :D

Another option for NixOS is bootspec-secureboot, I'm using it with no real complaints: https://github.com/DeterminateSystems/bootspec-secureboot

Wait, wtf. There's this in addition to lanzaboote? But no mention of it? (And at one point there was another new list with bootspec support, maybe still is)

Please, people, if you release software that overlaps or competes with another existing in the space, take the 3 minutes to write a comparison note or "why this exists". Please.

Re: Stable Linux mainline builds for Ubuntu

#38

Post by rubicks »

simfree wrote: post #36
rubicks wrote: post #30

Earlier quoted context omitted.

In the _most common_ case (with nvidia), your graphics stops working entirely and you spend (at least) an hour in a virtual console trying to undo what you did. Fun times.

This case ain't very common anymore, just Nvidia proprietary driver users suffer with this commonly these days. Intel and AMD don't have significant breakage when upgrading the Linux kernel.

Yeah, I should have mentioned this is specific to nvidia. Update: fixed.

Re: Stable Linux mainline builds for Ubuntu

#40

Post by mise_en_place »

rubicks wrote: post #28

Can anyone see how these Debian packages are being built? Asking because the last time I looked at Canonical's packaging, it was a little hairy.

It's quite trivial actually. It's just `make deb-pkg`. It may complain about a cert. https://github.com/torvalds/linux/blob/master/scripts/packag...
Post reply on HN