FreeBSD Security Advisory FreeBSD-SA-13:05.nfsserver

[Oliver Pinter]

On 5/1/13, Brett Glass <brett at lariat.org> wrote:
> At 08:22 PM 4/30/2013, Glen Barber wrote:
>
>>Maybe I am missing the fundamental usage of freebsd-update(8).  How does
>>using freebsd-update(8) to fetch src/ updates install a new kernel?
>
> When you use freebsd-update(8) in the usual manner, it fetches all of the
> source and binary updates necessary to bring the system up to the latest
> security patch level. When a userland binary is updated, it overwrites the
> source and binary. But when the kernel is updated, it moves /boot/kernel to
> /boot/kernel.old and then drops a GENERIC kernel into /boot/kernel. If
> there were no loadable modules in /boot/kernel at the start of the update,
> none are placed in /boot/kernel afterward. This is problematic, because
> the custom kernel that previously resided in /boot/kernel might have had
> some
> necessary modules built in... and they will not be available, either as
> compiled-in modules or as loadable modules, at the next reboot.
>
> To leave the system in a precarious state, where a power glitch could
> leave it unable to reboot, does not seem to me like a good idea. If
> /boot/GENERIC exists (which means that the administrator has built a custom
> kernel and saved the GENERIC kernel there), best to update /boot/GENERIC and
>
> leave the custom kernel in place, to be rebuilt if needed.
>
> The administrator will probably want to rebuild his or her custom kernel
> after the update... unless it didn't contain the code that was fixed by
> the patch, in which case there's no need. (My kernel didn't contain NFS,
> and I didn't build any loadable NFS modules, so I actually didn't need a
> rebuild.)

The ultimate solution for you described in loader.conf(5).

     kernel        Name of the kernel to be loaded.  If no kernel name is set,
                   no additional modules will be loaded.  The name must be a
                   subdirectory of /boot that contains a kernel.

And set INSTKERNNAME in make.conf - this are in Makefile.inc1.

--8<--
#!/bin/sh
echo "INSTKERNNAME=magickernel" >> /etc/make.conf
echo "kernel=magickernel" >> /boot/loader.conf
cd /usr/src
make kernel
-->8--

good luck :)

>
> --Brett Glass
>
> _______________________________________________
> freebsd-security at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to "freebsd-security-unsubscribe at freebsd.org"
>