Yahoo! 360° News | Beta Feedback
Start your own Yahoo! 360° page

Bryan J Smith < Y! ID: redhat.br... >

Top Page  |  Blog  |  Feeds  |  Friends

No Image
  • Work: Red Hat, Inc.
  • School: University Of Central Florida

Add

Bryan J Smith is not connected to you in Yahoo! 360°.

Last updated Wed Dec 26, 2007 Member since October 2007

Total Page Views

28,657

1 - 4 of 4 First | < Prev | Next > | Last

Bryan J Smith's Blog Full Post View | List View

Red Hat, Inc. - Global Professoinal Services (GPS) Vertical/Financial

The increasing demonization of Canonical (Ubuntu)
For the past couple of years, the Ubuntu distribution from Canonical has been the the "cool" or, allegedly, "community-focused" distro. It is not the first distro to hold this title. It will not be the last. But there is one consistency that goes along with that title, it does not last. Why does it not last? People forget there is no such thing as a "free lunch."

Linux Distribution Duality

Free development and release, with less restrictive trademark controls, is a great way to drive adoption. It's how Red Hat(R) Linux dominated in the '90s when SuSE(R) and many other distributions had very strict, legal restriction on everything from trademarks to packages. Although OpenSUSE(TM) has become far more open with the acquisition by Novell(R), and Red Hat(R) has made various moves over the years, virtually every major distro breaks into two (2) different forms.

1. Community-focused, feature-focused version
2. Enterprise-focused, ABI/API-centric version

While Red Hat started to offer a three (3) year Service Level Agreement (SLA) on its single release of Red Hat Linux 6.2, SuSE released a separate "enteprise" product in SuSE Linux Enterprise Server (SLES), with a fixed ABI (e.g., patched backports, etc...) and a five (5) year SLA. Enterprises responded, especially the newer crop of database and related vertical products that required ABI compatibility for 5+ years. Sales caused Red Hat to quickly follow suit with its own, initial Red Hat Advanced Server (RHAS) 2.1 product based on the Red Hat Linux 7 series, which has expanded into a three (3) tier Red Hat Enterprise Linux (RHEL) line with 7+ years of support.

Unlike SuSE(R), who vehemently defended their trademarks, Red Hat(R)'s community adoption caused mass redistribution. With no good deed going unpunished, select corporations started abusing the goodwill of Red Hat -- probably the most specific, Cobalt and their Linux/MIPS port (which Red Hat never released), which was blatantly labeled "Red Hat(R) Linux" to extensive misnomers that I still run into today. With Sun's purchase of Cobalt, no trademark usage guidelines could end the misuse (let alone demonizations), and Red Hat introduced another trademark, Fedora(TM), that is now used for all community software redistribution (typically unchanged from its enterprise re-packaged offerings).

Every major Linux distribution has undergone this duality. Mandrake, now Mandriva, in years past and, more recently, the Ubuntu distribution from Canonical.

Canonical Ubuntu: From LTS to Branding and SLAs

Ubuntu has a slightly different beginning than most other distributions, as its initial development and eventually fork from Debian was made with funding from wealthy Mark Shuttleworth. The "Spaceman Endowment," as I have called it (playing on his voyage to the International Space Station, ISS, at his own cost), has resulted in a distribution that was funded by the charity of income from Mr. Shuttleworth's wealth. I will be the first to thank Mr. Shuttleworth, among others, who have used their wealth to fund further Linux development, and his Ubuntu project is no exception -- and I hope others do as well.

Unfortunately, some people tend to be a bit rabid in their praise (see later sections). Endowments can fund projects and fund them well, as long as the endowment is sizable enough so the resulting income, interest, gains, etc... can afford the expenses involved. When they do not, new sources of income are required. The reality is that a popularity of a distro can outgrow the sheer charity to support it, especially when issues of ABI compatibility and service level agreements (SLAs) start to become the focus. Some distributions decide to ignore these, while others embrace them. Canonical very much embraces them.

Ubuntu first started to offer a three (3) year Long Term Support (LTS) version. Although it's backport and ABI foundation was (and still is) debated (and I will not introduce any FUD here, as I clearly have a conflict of interest), Canonical is focusing on a full ABI compatible release of five (5) years now, with Service Level Agreements (SLAs). I have now professionally dealt with several Canonical service personnel, and I would not categorize them anything less than knowledgeable peers, as I would expect a commercial Linux entity to hire (although I would more subjectively argue server support mindshare and resulting knowledge may be more proportional to experience and duration of strict ABI product offerings -- but that's clearly my bias, I just wanted to point out they hire experienced professionals). Unfortunately, people seem to think such talent is free (again, see next sections).

"More Expensive than Red Hat" and other Demonizations

The newer moves by Canonical are starting to get their own set of demonizations. Canonical now charges $150/node for unsupported updates (not even e-mail support) in their Ubuntu LTS version of five (5) years. There is already some notes of ambiguity of where the "free updates" end, as the latest clarifications are "at least eighteen (18) months," with different LTS versions available for "free" and with commercial support (free 3 years v. commercial 5+ years?). Furthermore, these are durations which -- unlike Red Hat and SuSE (who have 7+ years of SLAs and/or "Enterprise" products now) -- have not yet to be realized yet. And that is, again, starting to lead to demonizations, especially when SLA costs are compared.

With the popularity of the brand and trademark used in unlicensed versions that violate the Ubuntu trademark guidelines, it will be interested to see where Canonical starts to "draw the line" more publicly on the on Ubuntu(R) trademark when it is threatened by unlicensed redistribution. So far, OEMs such as Dell have had to sign licensing agreements, which have become standard since Sun made it an issue for Red Hat and then Sun found no sanctuary with SuSE after spurning Red Hat on trademark. So we may already be passed this consideration, as Canonical does seem to be enforcing (so far), and no distribution vendor (including Red Hat itself) has missed the lesson of Red Hat - Cobalt and, later, Sun.

But what about the individual who starts to release the commercial, five (5) year Ubuntu LTS management and updated packages to non-subscriptoin/non-SLA customers? Especially if they are not striping off the Ubuntu(R) trademark? Let's say Canonical still allows that, whereas SuSE's history has prevented much of this. I.e., even Red Hat has to deal with the regular issue of even their legitimate customers calling on systems that are CentOS installs, and specific systems not covered by SLAs. But at least they are identified as CentOS. Branding, support and many other considerations will only lead to further "clarifications" by Canonical on Ubuntu.

The Canonical Apologist?

It will be the abusers that will force these clarifications, just like SuSE, later Novell, and Red Hat have had to do, and Mandriva that would later follow. And it never ends either, with rabid people ready to jump on anything, especially necessary brand-related enforcements that would otherwise open even Microsoft to abuse of them (you laugh, but it's legally true -- you can't "selectively enforce" in the US, EU, etc...). And the naysayers and demonizers will only grow as a result. They will forget Ubuntu has done a lot of good for the community, initially and still significantly on the charity of Mark Shuttleworth, which is always for praise. The rabid advocates that wouldn't listen to us earlier will not when they turn on Canonical, as some already are. And that's when we'll all lose in the message, marketing and related demonizations by rabid advocates are never good for the Linux community.

Sadly enough, it will be Novell and Red Hat employees like myself that will be the first to defend Canonical's clarifications, all while they alleged became "uncool." Just like it happened to Mandrake, formerly Mandriva, only on a much larger scale. Apparently people can't realize that support costs are a reality, and branding sometimes requires vendors name products differently, including using separate trademarks. Red Hat hit that brick wall. SuSE never allowed and Novell has had to fork its own. Canonical is addressing it and will continue to do so. I've already heard the phrase "Ubuntu is not as community focused" or "Ubuntu is more evil than I thought" recently from a few people.

Oh the irony as history repeats itself yet again! They're beyond the naysayers who are Ubuntu users who blast Debian, or the CentOS user who says Red Hat subscriptions aren't worth a dime (oh man, that's my favorite). It goes to the heart of people who want a free lunch, including the branding all the services that cost people in time.
Tags: enterprise, linux, canonical, ubuntu, lts, redhat, rhel, suse, sles, server
Sunday March 9, 2008 - 07:00pm (EDT) Permanent Link | 0 Comments
Fedora 8 BlackBerry Sync (with Evolution)
To begin, thanks goes to Kerry Webb for first pointing out the OpenSync (fka Multisync) and Barry software. After a little investigation, I was able to get the solution working with Fedora 8, which I have documented in the following.

0. What is OpenSync (fka MultiSync)?

OpenSync is a desktop to/from device agnostic synchronization backend and optional front-end system that builds upon deprecated developments in the GTK-only (e.g., GNOME) MultiSync project. A nice slideshow introduction is available from Novell .

Although it is only a matter of time before native OpenSync support is in most major open source applications with contact, scheduling and other information commonly used on a PDA, OpenSync is used today as a standalone application. You setup a "Group," typically via a graphical user interface (GUI -- the GTK+ MultiSync GUI is still commonly used for this), and two (2) end-applications and/or devices in each "Group" that you wish to sync. In this blog entry, Evolution (end-user application) and BlackBerry (end-user device) will be utilized.

1. Install Sync packages from Fedora 8 Respository

The Multisync solution is already checked into Fedora 8. Virtually everything you need, except Barry (for BlackBerry support), should be in Fedora. I have not yet investigated why Barry is not in Fedora 8 (maturity, maintainer interest, IP issues, etc...), but I will not speculate further. Barry installation will be covered in step #3.

# yum install multisync multisync-gui libopensync-plugin-evolution2

NOTE: For those running KDE instead of GNOME (and Evolution), the KDE PIM plug-in package is libopensync-plugin-kdepim. Other OpenSync libraries for various end-applications and end-devices can be found in the Fedora repository with yum list | grep -i libopensync . New OpenSync application and device support libraries are being added regularly (e.g., I noted the plug-in for the Mozilla "Sunbird" calendaring system in Fedora 8's Update Testing repository at the time of this blog entry).

2. Additional Development Packages for Barry

The Fedora release model separates "Run-time" (end-user) binary and library packages from "Development" (-devel) header and library packages. For size considerations, the latter required only when software is built against those headers and libraries, but not required for normal user usage or when the software is already built. The -devel packages should not be confused with the full source code for rebuilding the software from scratch, however (these concepts are outside the scope of this blog entry).

One or more of these prerequisites "Development" (-devel) packages may be required, possibly others as these were the ones that were required for myself, to build Barry.

# yum install gtkmm24-devel libglademm24-devel libopensync-devel libtar-devel libusb-devel

3. Download and build Barry with OpenSync

The Barry project offers various support for BlackBerry devices, including an optional OpenSync library support package. At the time of this blog entry, Barry packages were not included in Fedora 8. But under the SourceForge download page , a source RPM (.src.rpm) package for Fedora 7 not only builds under Fedora 8, but has been tested to work successfully on my Fedora 8 system with my BlackBerry 7290.

This blog entry reflects building Barry with the barry-0.11-1 release for Fedora 7.

# rpmbuild --rebuild --with gui --with opensync barry-0.11-1.fc7.src.rpm

This builds the following binary binary packages in the directory /usr/src/redhat/RPMS/i386 (on Fedora 8 i386 systems).
  • barry-debuginfo-0.11-1.i386.rpm
  • barry-opensync-0.11-1.i386.rpm
  • barry-gui-0.11-1.i386.rpm
  • barry-util-0.11-1.i386.rpm
  • libbarry-0.11-1.i386.rpm
  • libbarry-devel-0.11-1.i386.rpm

The barry-gui and barry-util packages are optional and are not required for OpenSync, and the barry-debuginfo and libbarry-devel are completely optional. The first two are still recommended as they offer backup and various other utilities. In fact, the bidentify utility in barry-util package will return the PIN of your BlackBerry which is necessary for the OpenSync configuration (although it can be found on the BlackBerry itself).

4. OpenSync Configuration and Sync

Plug into your BlackBerry device into any supported USB port on your Fedora 8 system and verify there is a device connection (e.g., as root, running tail -f /var/log/messages prior to connection is always a good move, or using a popular USB view utility is another option). Once connected, use the bidentify program to get the PIN number of your BlackBerry device.

# bidentify
0a1b2c3d, RIM 7200 Series Colour GPRS Handheld
^^^^^^^^ Eight (8) hexadecimal digit BlackBerry PIN

NOTE: Under BlackBerry OS 4.0 (and most latter versions), you can find the PIN of the Device on the Device itself under Options (the "Wrench") and Status.

Now launch the Multisync GUI (this requires GTK+ for those running KDE and not GNOME, XFCE or other GTK+ based desktop solutions), the currently available and supported front-end option (there are other mechanisms and possible future GUI options, but I will not cover them).

# multisync &

Now use the following procedure to setup Evolution software and Blackberry devices for sync:
  • Click the Add button (and subsequently type the new Group name), under the top button bar in the window multisync , to create a new Group
  • Click the Edit button, below the new Group in the window "multisync, to edit the new Group
    • Click Add Member button, on the left of the second window multisync , to add an application/device
      • Click Evolution 2.x in the list (and subsequently click the Apply button), in the third window multisync , to add Evolution 2.x sync
      • NOTE: If you have alternative AddressBook, Calender and Tasks lists than Personal , you will want to change the defaults of the Evolution library/member.
    • Once again, click Add Member button
      • Click Barry OpenSync plugin ... (and, again, subsequently click the Apply button), to add BlackBarry sync
    • Click the Close button, back in the second window multisync
  • Click barry-sync in the list, on the left of the second window multisync
    • Enter your BlackBerry's eight (8) hexadecimal digit PIN in the 2nd field on the Device line
    • Click the "Close" button, in the lower-right corner of the second window multisync

Now the synchronization libraries between Evolution application and BlackBerry are setup, and the configuration should be saved. To attempt a sync, click the Refresh button (yes, I know, I don't appreciate the choice of terminology either, but it may be a non-English translation I can only assume or a poor use of Windows nomenclature).

NOTE: The first time I attempt this, it failed. Exiting the application and re-lauching it (possibly re-reading the new configuration and PIN?) worked, and worked every subsequent time. Also, don't be surprised when you get double entries if both exist in Evolution and on your BlackBerry, and you may need to resolve them (but this is not uncommon with BlackBerry, Palm or Mobile Windows with their official software either). I had no such isses in subsequent attempts.

Again, until OpenSync is directly supported in end-user applications like Evolution, you will still launch the separate MultiSync GUI. This may change as more OpenSync front-ends are made available, or it is directly supported in Evolution itself.
Tags: blackberry, evolution, fedora, gnome, linux, multisync, opensync, redhat, rim, sync, synchronize
Wednesday December 26, 2007 - 11:26am (EST) Permanent Link | 0 Comments
RPC (portmap), NFS, TCP Wrappers and IPTables Rules
Like it or not, NFS is still in widespread usage for various reasons. And like it or not, not all of those implementations are completely NFSv4 over TCP, especially with the great number of legacy NFSv3 clients workstations and servers in various corporate networks. As such, when deploying even a recent Fedora or Red Hat Enterprise Linux NFS server, several ports must be open for full NFSv3 compatible functionality.

The Portmapper and Dynamic Ports

NFS clients typically request NFS blocks from the destination port of 2049 on the NFS server (nfsd -- yes, this is an oversimplification for the purposes of this article -- I'm not dissecting to the level of NFS Illustrated). IETF RFC/STD NFS version 3 and 4 (NFSv3 and NFSv4, respectively, for the remainder of this article) default to TCP, and the Linux 2.6 kernel NFS implementation defaults to TCP. NFS v4 can also offer all required Remote Procedure Call (RPC) services over that single port, and when combined with advanced and (finally) standardized authentication, authorization and other object association mechanisms, make NFS a viable and far more risk mitigated corporate network filesystem for modern subnets with version 4. Unfortunately, as I hinted previously (and what this article is about), there are still a number of legacy NFSv3 workstations (even if Kerberos is ultimately the way users are authenticated).

As part of the aging Sun Microsystems Open Network Computing (ONC) architecture, NFS relies on a number of Remote Procedure Call (RPC) services. These RPC services opened and serviced by a program known as the portmapper (portmap) which runs on UDP and TCP port 111 (sunrpc). Although both nfsd and sunrpc are statically assigned and well-known ports, the portmappers main responsibility is to dynamically map other ONC RPC services that NFS requires. Namely ...

Clients and Servers:
- lockd -- NFS locking services (typically kernel supported, and handle concurrency issues with other protocols, including simultaneous SMB)
- statd -- NFS status/availability services (it's really almost as dumb as the up v. down sign, which affects statefulness which clients act upon)

Servers-only (in addition to nfsd):
- mountd -- NFS mount availability (the service that largely provides export information and handles some of the mount handshake)
- rquotad -- NFS quota services (in addition to the local enforcement on the filesystem, NFS provides the service to inform clients proper)

To take a look at what RPC services are running on a NFS server, and on what current port using what current transport (UDP or TCP), run:

# rpcinfo -p [server]


Although one could write scripts around the iptables utility, or even a NetFilter kernel module, to dynamically modfiy the NetFilter rules in the kernel, it would be much easier to make these ports dynamic.

Forcing RPC to Assign Static Ports

RPC ports can be forced to static assignments at service start-up time, namely the portmapper itself. Once the destination port of the service is static, the clients always communicate with that same port for any SYN TCP or other "new/first" UDP packet. The clients still receive these port assigments from the portmapper of the server, which is always running on port 111. Different distributions of Linux have different mechanisms for setting these values at init/startup. I will cover the long-standing Fedora/Red Hat init approach.

/etc/sysconfig/nfs

LOCKD_[TCP|UDP]PORT=a
MOUNTD_PORT=b
RQUOTAD_PORT=c
STATD_PORT=d

These variables are under-documented on the Internet. Worse yet, there seems to be little consistency at times, hence why I am authoring this. Most have the first line in to forms, plus the second and fourth lines:

LOCKD_TCPPORT=a
LOCKD_UDPPORT=a
MOUNTD_PORT=b
STATD_PORT=d

In reality, the lockd port for TCP and UDP need not be separated out. There may be some unique non-Linux NFS client that expects them to be on different ports for different transports, but for the most part, nearly every HOWTO has them equal anyway. So, in reality, you only need one line for lockd not qualified for either transport, and it works for both -- at least in kernel 2.6 Fedora / Red Hat distributions in my experience. Most of these HOWTOs also forget the all-important rquotad port, of which I recommend rquotad as most NFSv3 implementations support it well and for greater than 2GB files/usage too (Linux NFSv2 and pre-2.2.18 SGI/Trond+Higgen or 2.4 implementatoins of NFSv3 may vary).

With that said, here is my typical /etc/sysconfig/nfs:

LOCKD_TCPPORT=11101
LOCKD_UDPPORT=11101
MOUNTD_PORT=11102
RQUOTAD_PORT=11103
STATD_PORT=11104

I like to use a prefix of 111xx for RPC services, since 111 is the portmapper port. I may be ignorant of an official assignment in the range, but I have not run into it yet (i.e., if you know of one, please correct my ignorance so it doesn't harm anyone else). I separate out the lockd ports just in case some init or other support script I don't know about has a hissy fit, or maybe I'm on an earlier release (this file should work for kernel 2.4 distros as well). If you want to be extra-anal, you can change the lockd TCP and UDP ports so they don't use the same port.

In any case, you must either do this at boot/init, or shut down all RPC services (e.g., service nfs stop and services nfslock stop), then the portmapper itself (e.g., service portmap stop), before starting them again, and that includes in the proper, reverse order as the stop. If any stateful connections were made, then the client may have some existing expectations on service connections that may complicate matters further. I.e., it's best not to set these when clients are currently mounting NFS exports from the server, period.

Don't forget to run the rpcinfo -p server command to verify the ports are indeed open (without using something "more nasty" like nmap), ideally from a client before it attempts to mount.

IPTables Rules

Now we get to have our fun with IPTables. You should be creating the following rules, adding the appropriate chain, interface, subnet declarations, etc... in your rules as appropriate.

-p tcp -m tcp --dport 111 -j ACCEPT
-p tcp -m tcp --dport 2049 -j ACCEPT
-p tcp -m tcp --dport 11101:11104 -j ACCEPT
-p udp -m udp --dport 111 -j ACCEPT
-p udp -m udp --dport 2049 -j ACCEPT
-p udp -m udp --dport 11101:11104 -j ACCEPT

If you are lazy like myself, and try to keep everything within the management framework of the Fedora/Red Hat init scripts, then you will want to modify /etc/sysconfig/iptables (and /etc/sysconfig/ip6tables for IPv6 if it is so enabled) as follows, just before the final "REJECT" target jump.

/etc/sysconfig/ip[6]tables
...
-A RH-Firewall-1-INPUT
-p tcp -m tcp --dport 111 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 2049 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 11101:11104 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 111 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 2049 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 11101:11104 -j ACCEPT

...
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp6-port-unreachable
COMMIT

You'll need to restart the IPTables "service" (i.e., not really, it's just a basic management script) for them to take effect. Now you might think this is "good enough" in order to use the Red Hat firewall configuration tool system-config-securitylevel in the future to add or modify rules. Unfortunately, it is not, and these changes will be lost if you do. So if you are going to modify the /etc/sysconfig/ip[6]tables scripts, you should modify one more as well.

Addressing System-Config-SecurityLevel

In current Fedora and Red Hat Enterprise Linux releases (as well as the CentOS equipvament), system-config-securitylevel does not read /etc/sysconfig/iptables, but /etc/sysconfig/system-config-securitylevel. As such, you will want to insert the following lines in the latter (at any position) to match those in the former ...

/etc/sysconfig/system-config-securitylevel

--port=111:tcp
--port=2049:tcp
--port=11101-11104:tcp
--port=111:udp
--port=2409:udp
--port=11101-11104:udp

Yes, that is a dash (-) for a range of ports, not a colon (:) like in the iptables file, or when writing rules directly at the command line using the iptables command. I am not going to second guess the system-config-securitylevel authors on this format, but I am sure some of this syntax has to do with the fact that the system-config-securitylevel program and related approach encompasses many things outside of just NetFilter/iptables (e.g., SELinux), and may include even more in the future.

My only, current complaint is that in some versions (all?), if there is an entry for both TCP and UDP on port 2049 in the file, and the system-config-securitylevel program is run, you will lose the UDP line if rules are added. This is because the program reads in the port 2049 lines as "NFSv4" and sets the checkbox, removing the custom rules. So when it is saved, it only saves 2049/tcp, and the additional 2049/udp is lost. The authors (or maybe I'll just "scratch that itch myself") need to add another checkbox for "NFSv4 (UDP)" or somehow mitigate this issue and loss of a rule.

Side Note: TCP Wrapper Issues

If you are still having problems, and you have used iptables to log and finally concluded it is not your firewall (which is easy to verify since you'll still have issues even after running service iptables stop), then your issue may be due to TCP Wrappers. If you are a solid sysadmin with solid troubleshooting skills, then you would have seen this in your logs upon any incoming RPC request from any client. If you are newer to TCP Wrappers, please hit the man page for hosts.allow or hosts.deny (they should be the same page).

If you have entries in hosts.deny, then you likely need a portmap entry in hosts.allow. E.g., for a server servicing subnet 17.16/16 (the bracket entries are IPv6 and can be omitted) ...

/etc/hosts.allow
ALL:127.0.0.1 [::1]
sshd:172.16. [fe80::]/64
portmap:172.16. [fe80::]/64

/etc/hosts.deny
ALL: ALL

If you are a seasoned guru, you may be tempted to see if portmap is linked against libwrap, especially if you can't seem to get your /etc/hosts.allow entries working for NFS. Indeed, it is not dynamically linked and even the portmap RPM does not have a dependency on TCP Wrappers, so you may incorrectly conclude it is not (or a bug in the build). This even, and just recently, puzzled myself. But then I visited Red Hat's very deep and longstanding Buzilla system, which often offers great insights into development decisions going way back to the '90s. Back in the Red Hat Linux days, Red Hat started statically linking libwrap into /sbin/portmap, because /usr/lib/libwrap.so may be located in a separate /usr filesystem that may not be mounted at the time prortmapper is started. That is a good nugget to remember when it comes to any dependencies in /bin or /sbin binary on /usr/lib, /etc file to any /usr/*, etc...

Building Kernel 2.6 and Modules
For copyright and other reasons, I am hosting this on entry (originally posted on 2005-10-19) here.

The "good 'ole days" of the kernel-source-ver.i386.rpm package

Up through all Red Hat Linux releases and Fedora Core 1, which subsequently means through Red Hat Enterprise Linux 3, Red Hat included a package entitled kernel-source-ver.i386.rpm. The purpose of this "binary" RPM was to create a /usr/src/linux-ver directory (and associated /usr/src/linux[-2.x] symbolic link). This was the standard kernel location for not only building custom kernels, but where any 3rd party kernel modules (with their own Makefile) could expect to find kernel headers, build-time configuration information, etc...

There were many issues with this approach.

First off, until kernel 2.6, if you wanted to build any 3rd party kernel module -- even one that included it's own Makefile and built systems -- you had to "prep" a kernel source tree that was exactly as your running kernel. This meant applying the correct configuration, the exact Makefile tags, etc... that were often daunting for newer users -- let alone even experienced users. It was more than just the common "build from source" routine of ./configure and make install. And the order was often important as well.

Secondly, the system headers, including C library and other kernel headers, were commonly used by applications as well as kernel building -- especially when different C compilers were being used for the system. Without going into a lot of specifics, it was not long before kernel headers and system headers became separate entities. A major reason being is that some headers and other build-time configuration information might need to be re-created in the kernel build process. In fact, early in Red Hat Linux 7, changes to kernel 2.2's mrproper ("Mr. Proper" is a non-US marketing name for "Mr. Clean") Makefile target resulted in the blowing away many of the system headers.

- Red Hat does not built kernels from kernel-source-ver.i386.rpm

RPM is a build system and designed as such for a reason. Red Hat Linux and Fedora-based distros (collectively referred to Fedora-based) as well as even other package systems and distros, such as Debian and Debian-based, have used a dedicated, "protected" build environment for kernels for a long time. Starting in Red Hat Linux 6 (well over 6 years ago), Red Hat kernels, modules and other components that have required the kernel source tree have been built from the kernel-ver.src.rpm, and not via a source tree located in /usr/src/linux-ver.

This addresses many issues, including:

1. Include all components to complete a build
2. Ensure exact steps to complete a build
3. Avoid negative affects to files in the production system (chroot)
4. Force documented changes with source, SPEC, etc...

As of Red Hat Linux 7, I personally and professionally stopped building kernels from kernel-source (now kernel-sourcecode as we'll talk about in a bit). The exact order and requirements in not only building but even "prepping" the kernel source tree for 3rd party kernel modules is extremely important. But beyond that, the "mrproper" target can do some particularly nasty things to your systems' /usr/include and other directories. In the kernel.src.rpm build under the chroot, the system's /usr/include and other directories are not touched, and they have their own, self-contained support.

- From kernel-source-ver.i386.rpm to kernel-sourcecode-ver.noarch.rpm to no more "binary" kernel source

Starting with Fedora Core 2 based on the new kernel 2.6, Red Hat decided to deprecate the "binary" kernel-source-ver.i386.rpm.

At first, they included a new architecture-independent "binary" package name called kernel-sourcecode-ver.noarch.rpm to avoid confusion with the old approach. Mid Fedora Core 2, they considered it redundant to continue doing so and, subsequently, it is not included with Red Hat Enterprise Linux 4 onward either. There is still a "binary" RPM target defined as kernel-sourcecode in the kernel-ver.src.rpm (Source RPM), but Red Hat no loner builds it by default. Redundancy, safety, etc... are major reasons.

To build a "prep'd" kernel 2.6 source tree in FC2+/RHEL4+, you should follow these steps:

1. Download the kernel-ver.src.rpm source RPM (SRPM, .src.rpm) package for your kernel version. If you don't know your kernel version, run `uname -r`. Alternatively, and preferrably, You should use the automated methods of YUM, UP2DATE, etc... to get the correct Source RPM (.src.rpm) of the currently running version of the kernel without any manual checking.

2. Install this package, e.g., rpm -ihv kernel-`uname -r`.src.rpm

3. Prep the kernel source for your architecture, e.g., rpmbuild -bp --target=i686 /usr/src/redhat/kernel-2.6.spec

That will safely prep the kernel in the RPM chroot environment into a mode that is "ready to use" under /usr/src/redhat/BUILD/kernel-2.6*/linux-2.6*/, although you should consult the kernel-2.6.spec file to see what Makefile targets have and have not been run. You may wish to create a symbolic linke to /usr/src/linux-`uname -r` but be careful when executing any Makefile targets in the unprotected, root filesystem of the system.

- Non-Red Hat/Fedora Distribution Source Code Rebuilds

Even though Red Hat does not build and distribute the kernel-sourcecode-ver.noarch.rpm, any distribution that rebuilds from Fedora Development, Core, Legacy or Red Hat Enterprise Linux kernel-ver.src.rpm may or may not choose to do the same. Some 3rd party rebuilds have decided to include it. Others agree with Red Hat, that it should be deprecated and the chroot RPM system build process be used.

As I eluded to earlier, you can still create a kernel-sourcecode-ver.noarch.rpm package that creates the /usr/src/linux-ver directory for any FC2+/RHEL4+ kernel 2.6 release. The procedure is as follows:

1. and 2., as the previous section.

3. Modify the SPEC file, e.g.,

# vi /usr/src/redhat/SPECS/kernel-2.6.spec

as follows ...

%ifarch noarch
%define builddoc 0
%define buildsource 1
%define buildup 0
...

4. Build the noarch target, which builds kernel-sourcecode


# rpmbuild -bb --target=noarch /usr/src/redhat/SPECS/kernel-2.6.spec

5. Install the "binary" kernel-sourcecode RPM

# rpm -ihv /usr/src/redhat/RPMS/noarch/kernel-sourcecode-`uname -r`.noarch.rpm

Now you have your /usr/src/linux-2.6 directory. I highly recommend against building your kernels in the "unprotected" and "root anchored" environment from an arbitrary set of commands (instead of the chroot of RPM with a pre-tested sequence of commands), but that is your choice.

Yes, before kernel 2.6, the location of /usr/src/linux-ver was expected so you could build 3rd party kernel modules. But it was typically safe to to do so, since you're not running the kernel's Makefile. You still typically wanted to "prep" the kernel tree itself in the RPM chroot environment, even if you were only going to symlink it to /usr/src/linux-`uname -r` after doing so. Kernel 2.6 addresses this, which brings me to my next point.

Kernel 2.6 build subdirectory and the kernel-devel-ver.*.rpm package

In the kernel modules directory (e.g., /lib/modules/`uname -r`/), there is a subdirectory called build. It points to the headers and other configuration, dependencies, etc... of the running kernel so 3rd party drivers can be built. Before kernel 2.6, this was a symlink to /usr/src/linux-`uname -r`. As of kernel 2.6, this is now static in the kernel itself (taking up a few MBs). The idea here is that you should be able to build 3rd party kernel modules against the current kernel without having to prep a full kernel tree.

Since most newer, 3rd party module Makefiles were already looking to /lib/modules/`uname -r`/build/ to locate the kernel headers, build-time configuration information, etc... As such, the change in kernel 2.6 should be transparent for most newer 3rd party kernel modules with their own Makefile, with exception of the fact that you no longer have to . At the same time, and in the worst case for kernel 2.6, it's often merely just a matter of:

ln -s /lib/modules/`uname -r`/build /usr/src/linux-`uname -r`

You almost never need to "prep" a kernel source tree to build 3rd party kernel modules against it.

Now as of Fedora Core 4 (and accidentally one Fedora Core 3 kernel release), as well as Red Hat Enterprise Linux 4, Red Hat decided to separate kernel 2.6's /lib/modules/`uname -r`/build/ subdirectory from the rest of the kernel modules in /lib/modules/`uname -r`. This new package is known as kernel-devel-ver.*.rpm (where * is the binary architecture, i386, i586, i686, athlon, x86_64, etc...).

So as of Fedora Core 4+ and Red Hat Enterprise Linux 4+, if you want to build 3rd party kernel modules, you need to to install the kernel-devel-ver.*.rpm package so the /lib/modules/`uname -r`/build/ subdirectory is present. A simple yum install kernel-devel or up2date kernel-devel takes care of that for an Internet connected system. By not installing it, you save several MBs of disk space (which may be useful in embedded/read-only systems, etc...), which I'm sure was Red Hat's rationale (since just the binary kernel modules can total less than 10MB in some cases).


Add Bryan J Smith's Blog to your personalized My Yahoo! page:

Add to My Yahoo!RSS About My Yahoo! & RSS
1 - 4 of 4 First | < Prev | Next > | Last