diff mbox series

[RFC,Unstable] UBUNTU: [Config] Disable CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE

Message ID 20201102164218.1013390-1-dann.frazier@canonical.com
State New
Headers show
Series [RFC,Unstable] UBUNTU: [Config] Disable CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE | expand

Commit Message

dann frazier Nov. 2, 2020, 4:42 p.m. UTC
Disables deprecated algorithms unused by the kernel but exposed to userspace
via AF_ALG as recommended here:

 https://lists.linaro.org/pipermail/cross-distro/2020-October/000938.html

As noted, iwd (universe) did have a dependency on the kernel's ecb(arc4) but
upstream has now replaced that with a userspace version:

https://git.kernel.org/pub/scm/network/wireless/iwd.git/commit/?id=1db8a85a60c645232eb5bba1ec0cd0a2927ccd16

While we have a new enough iwd in hirsute, focal's version still has this
dependency. So, if we decide to do this, we may also want to SRU that back.

Signed-off-by: dann frazier <dann.frazier@canonical.com>
---
 debian.master/config/annotations          |  7 ++-----
 debian.master/config/config.common.ubuntu | 12 ++++++------
 2 files changed, 8 insertions(+), 11 deletions(-)

Comments

Seth Forshee Nov. 4, 2020, 9:35 p.m. UTC | #1
On Mon, Nov 02, 2020 at 09:42:18AM -0700, dann frazier wrote:
> Disables deprecated algorithms unused by the kernel but exposed to userspace
> via AF_ALG as recommended here:
> 
>  https://lists.linaro.org/pipermail/cross-distro/2020-October/000938.html
> 
> As noted, iwd (universe) did have a dependency on the kernel's ecb(arc4) but
> upstream has now replaced that with a userspace version:
> 
> https://git.kernel.org/pub/scm/network/wireless/iwd.git/commit/?id=1db8a85a60c645232eb5bba1ec0cd0a2927ccd16
> 
> While we have a new enough iwd in hirsute, focal's version still has this
> dependency. So, if we decide to do this, we may also want to SRU that back.
> 
> Signed-off-by: dann frazier <dann.frazier@canonical.com>

Applied to unstable/master. I also updated the abi to avoid module check
failures for the modules which are being disabled. Thanks!
diff mbox series

Patch

diff --git a/debian.master/config/annotations b/debian.master/config/annotations
index 81938786ab66..3a11bafaebcf 100644
--- a/debian.master/config/annotations
+++ b/debian.master/config/annotations
@@ -280,8 +280,6 @@  CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL              policy<{'amd64': 'm'}>
 CONFIG_CRYPTO_AES                               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_CRYPTO_AES_TI                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
 CONFIG_CRYPTO_AES_NI_INTEL                      policy<{'amd64': 'm'}>
-CONFIG_CRYPTO_ANUBIS                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
-CONFIG_CRYPTO_ARC4                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
 CONFIG_CRYPTO_BLOWFISH                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
 CONFIG_CRYPTO_BLOWFISH_X86_64                   policy<{'amd64': 'm'}>
 CONFIG_CRYPTO_CAMELLIA                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
@@ -295,17 +293,14 @@  CONFIG_CRYPTO_CAST6_AVX_X86_64                  policy<{'amd64': 'm'}>
 CONFIG_CRYPTO_DES                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
 CONFIG_CRYPTO_DES3_EDE_X86_64                   policy<{'amd64': 'm'}>
 CONFIG_CRYPTO_FCRYPT                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
-CONFIG_CRYPTO_KHAZAD                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
 CONFIG_CRYPTO_SALSA20                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
 CONFIG_CRYPTO_CHACHA20                          policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
 CONFIG_CRYPTO_CHACHA20_X86_64                   policy<{'amd64': 'm'}>
-CONFIG_CRYPTO_SEED                              policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
 CONFIG_CRYPTO_SERPENT                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
 CONFIG_CRYPTO_SERPENT_SSE2_X86_64               policy<{'amd64': 'm'}>
 CONFIG_CRYPTO_SERPENT_AVX_X86_64                policy<{'amd64': 'm'}>
 CONFIG_CRYPTO_SERPENT_AVX2_X86_64               policy<{'amd64': 'm'}>
 CONFIG_CRYPTO_SM4                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
-CONFIG_CRYPTO_TEA                               policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
 CONFIG_CRYPTO_TWOFISH                           policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
 CONFIG_CRYPTO_TWOFISH_X86_64                    policy<{'amd64': 'm'}>
 CONFIG_CRYPTO_TWOFISH_X86_64_3WAY               policy<{'amd64': 'm'}>
@@ -322,6 +317,7 @@  CONFIG_CRYPTO_USER_API_HASH                     policy<{'amd64': 'm', 'arm64': '
 CONFIG_CRYPTO_USER_API_SKCIPHER                 policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
 CONFIG_CRYPTO_USER_API_RNG                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
 CONFIG_CRYPTO_USER_API_AEAD                     policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
+CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE		policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 's390x': 'n'}>
 CONFIG_CRYPTO_STATS                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_CRYPTO_LIB_BLAKE2S                       policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
 CONFIG_CRYPTO_LIB_CHACHA                        policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm', 's390x': 'm'}>
@@ -439,6 +435,7 @@  CONFIG_CRYPTO_DEV_SA2UL                         policy<{'arm64': 'm'}>
 #
 CONFIG_CRYPTO_DEV_HISI_ZIP                      mark<ENFORCED>
 CONFIG_ZCRYPT_MULTIDEVNODES                     mark<ENFORCED> note<LP:1805429>
+CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE		mark<ENFORCED> note<Obsolete w/ no known userspace dependencies>
 
 # Menu: Cryptographic API >> Hardware crypto devices >> Algorithms enabled for QCE acceleration
 CONFIG_CRYPTO_DEV_QCE_ENABLE_ALL	        policy<{'arm64': 'y', 'armhf': 'y'}>
diff --git a/debian.master/config/config.common.ubuntu b/debian.master/config/config.common.ubuntu
index 8500c4203ac7..1dad0154fc4d 100644
--- a/debian.master/config/config.common.ubuntu
+++ b/debian.master/config/config.common.ubuntu
@@ -2124,8 +2124,8 @@  CONFIG_CRYPTO_AKCIPHER2=y
 CONFIG_CRYPTO_ALGAPI=y
 CONFIG_CRYPTO_ALGAPI2=y
 CONFIG_CRYPTO_ANSI_CPRNG=m
-CONFIG_CRYPTO_ANUBIS=m
-CONFIG_CRYPTO_ARC4=m
+# CONFIG_CRYPTO_ANUBIS is not set
+# CONFIG_CRYPTO_ARC4 is not set
 CONFIG_CRYPTO_ARCH_HAVE_LIB_BLAKE2S=m
 CONFIG_CRYPTO_ARCH_HAVE_LIB_CHACHA=m
 CONFIG_CRYPTO_ARCH_HAVE_LIB_CURVE25519=m
@@ -2295,7 +2295,7 @@  CONFIG_CRYPTO_HMAC=y
 CONFIG_CRYPTO_HW=y
 CONFIG_CRYPTO_JITTERENTROPY=y
 CONFIG_CRYPTO_KEYWRAP=m
-CONFIG_CRYPTO_KHAZAD=m
+# CONFIG_CRYPTO_KHAZAD is not set
 CONFIG_CRYPTO_KPP=y
 CONFIG_CRYPTO_KPP2=y
 CONFIG_CRYPTO_LIB_AES=y
@@ -2345,7 +2345,7 @@  CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_RNG_DEFAULT=y
 CONFIG_CRYPTO_RSA=y
 CONFIG_CRYPTO_SALSA20=m
-CONFIG_CRYPTO_SEED=m
+# CONFIG_CRYPTO_SEED is not set
 CONFIG_CRYPTO_SEQIV=y
 CONFIG_CRYPTO_SERPENT=m
 CONFIG_CRYPTO_SERPENT_AVX2_X86_64=m
@@ -2386,7 +2386,7 @@  CONFIG_CRYPTO_SM4=m
 CONFIG_CRYPTO_SM4_ARM64_CE=m
 CONFIG_CRYPTO_STATS=y
 CONFIG_CRYPTO_STREEBOG=m
-CONFIG_CRYPTO_TEA=m
+# CONFIG_CRYPTO_TEA is not set
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_TGR192=m
 CONFIG_CRYPTO_TWOFISH=m
@@ -2397,7 +2397,7 @@  CONFIG_CRYPTO_TWOFISH_X86_64_3WAY=m
 CONFIG_CRYPTO_USER=m
 CONFIG_CRYPTO_USER_API=m
 CONFIG_CRYPTO_USER_API_AEAD=m
-CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE=y
+# CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_RNG=m
 # CONFIG_CRYPTO_USER_API_RNG_CAVP is not set