Merge pull request #2256 from crawford/linux

sys-kernel/coreos-*: bump to v4.8.4

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest

@@ -1,2 +1,2 @@
 DIST linux-4.8.tar.xz 91966856 SHA256 3e9150065f193d3d94bcf46a1fe9f033c7ef7122ab71d75a7fb5a2f0c9a7e11a SHA512 a48a065f21e1c7c4de4cf8ca47b8b8d9a70f86b64e7cfa6e01be490f78895745b9c8790734b1d22182cf1f930fb87eaaa84e62ec8cc1f64ac4be9b949e7c0358 WHIRLPOOL 3888c8c07db0c069f827245d4d7306087f78f7d03e8240eb1fcd13622cd5dbe1c17cd8ed7dc11513f77f3efd5dbd84e2b48e82bdb9b9bfd2242fd62ae32812d5
-DIST patch-4.8.2.xz 18772 SHA256 edb6e8022172df2b020b53e1cfa32bcde070f3119a6618766066098c46008a9b SHA512 378ee4d328169b6e2475177bef31596d9f586b08ba87eb170c1943e3a1d43749d7b101b6f39886d50bbf1abf0ca8720a567f30a6ac9f5c66afe1f657d4899d25 WHIRLPOOL 9e4292da8f1ce629e95e08caa41c128153b3c477a0edd0540794e8f69fcf8c41e9138f3086b8cdf8cbe0155900d3faf324438b4c93c58ec14248df5726df9a0b
+DIST patch-4.8.4.xz 39264 SHA256 86e246b19253ee3aa971403a5990376a5e33667122f7c8742cc0ee807f204403 SHA512 e4316472bb34e1fe8aa796f8a894781f3c4104b01c90598962a705b1cc35d860412dd1986571d4e59b797cf6b486f12c516668303aa8c82b6599ac30460f8de1 WHIRLPOOL ee3a0e44348247dc70e9e11bb53b2a2f29f87d65a83fd6ba9e5b10c1690240bd8258210582ef0085b7ca07a136bfa72564fb3e049fe2d2ba31b3fa0af9ad75b1

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0001-security-overlayfs-provide-copy-up-security-hook-for.patch

@@ -1,4 +1,4 @@
-From a893dfc0d7ae1ef27d57ba8585d9d6d079a440d9 Mon Sep 17 00:00:00 2001
+From 01ae62a2adcadab9f862590f5e1e20ecee298bfa Mon Sep 17 00:00:00 2001
 From: Vivek Goyal <vgoyal@redhat.com>
 Date: Tue, 19 Jul 2016 14:34:57 -0400
 Subject: [PATCH 01/21] security, overlayfs: provide copy up security hook for

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0002-selinux-Implementation-for-inode_copy_up-hook.patch

@@ -1,4 +1,4 @@
-From a9d38a0fd25b5ce5896d0eee704902fa94264edb Mon Sep 17 00:00:00 2001
+From 9b08810799d603c20cc8275fface66332a9fb805 Mon Sep 17 00:00:00 2001
 From: Vivek Goyal <vgoyal@redhat.com>
 Date: Tue, 19 Jul 2016 14:34:58 -0400
 Subject: [PATCH 02/21] selinux: Implementation for inode_copy_up() hook

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0003-security-overlayfs-Provide-security-hook-for-copy-up.patch

@@ -1,4 +1,4 @@
-From 19222362a287b22fa8482a92be9ba749b7497e42 Mon Sep 17 00:00:00 2001
+From 5d98f79e7ba90d24592f12037e8d531a5eaf172a Mon Sep 17 00:00:00 2001
 From: Vivek Goyal <vgoyal@redhat.com>
 Date: Tue, 19 Jul 2016 14:34:58 -0400
 Subject: [PATCH 03/21] security,overlayfs: Provide security hook for copy up

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0004-selinux-Implementation-for-inode_copy_up_xattr-hook.patch

@@ -1,4 +1,4 @@
-From 0e7ff4309fbdb793c579336ea16d1b25523476fe Mon Sep 17 00:00:00 2001
+From a0347d2718f40eb2c14835d7c019905ac7c32758 Mon Sep 17 00:00:00 2001
 From: Vivek Goyal <vgoyal@redhat.com>
 Date: Tue, 19 Jul 2016 14:34:58 -0400
 Subject: [PATCH 04/21] selinux: Implementation for inode_copy_up_xattr() hook

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0005-selinux-Pass-security-pointer-to-determine_inode_lab.patch

@@ -1,4 +1,4 @@
-From bb44799820540a69a43ebc49dd8691f3f6b19312 Mon Sep 17 00:00:00 2001
+From e60f8bb00a8034fe8231e6fa3d93bd2c730ed1ff Mon Sep 17 00:00:00 2001
 From: Vivek Goyal <vgoyal@redhat.com>
 Date: Tue, 19 Jul 2016 14:34:59 -0400
 Subject: [PATCH 05/21] selinux: Pass security pointer to

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0006-security-overlayfs-Provide-hook-to-correctly-label-n.patch

@@ -1,4 +1,4 @@
-From aca722ec1a3ecda00f0317ff467dbdf0e12d5dbe Mon Sep 17 00:00:00 2001
+From 5e8dead34a9154beea39cabede13c8e55f311805 Mon Sep 17 00:00:00 2001
 From: Vivek Goyal <vgoyal@redhat.com>
 Date: Tue, 19 Jul 2016 14:34:59 -0400
 Subject: [PATCH 06/21] security, overlayfs: Provide hook to correctly label

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0007-selinux-Implement-dentry_create_files_as-hook.patch

@@ -1,4 +1,4 @@
-From e51df9a13fba7a385d97a4cd696dc6e488f617ba Mon Sep 17 00:00:00 2001
+From c723b3fb6de4b0b142013ed5bebcbdf976107299 Mon Sep 17 00:00:00 2001
 From: Vivek Goyal <vgoyal@redhat.com>
 Date: Tue, 19 Jul 2016 14:34:59 -0400
 Subject: [PATCH 07/21] selinux: Implement dentry_create_files_as() hook

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0008-Add-secure_modules-call.patch

@@ -1,4 +1,4 @@
-From b47ebff1c49b5d05d1265fc1115c76bc947864b4 Mon Sep 17 00:00:00 2001
+From 1cd00f30db2874ff6ba082b7d4773771613dcc1a Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Fri, 9 Aug 2013 17:58:15 -0400
 Subject: [PATCH 08/21] Add secure_modules() call

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0009-PCI-Lock-down-BAR-access-when-module-security-is-ena.patch

@@ -1,4 +1,4 @@
-From e168029a84e7306ea580caace7437fa4da8fbc6f Mon Sep 17 00:00:00 2001
+From 00523071ddbb241d7ea6461c4205d9c4c2a4cbaa Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Thu, 8 Mar 2012 10:10:38 -0500
 Subject: [PATCH 09/21] PCI: Lock down BAR access when module security is

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0010-x86-Lock-down-IO-port-access-when-module-security-is.patch

@@ -1,4 +1,4 @@
-From ec05aec348c19934baf6f8767b10d7a38cf41764 Mon Sep 17 00:00:00 2001
+From ab086c5a3fd75bf557a8a189d4801d2497949ba4 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Thu, 8 Mar 2012 10:35:59 -0500
 Subject: [PATCH 10/21] x86: Lock down IO port access when module security is

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0011-ACPI-Limit-access-to-custom_method.patch

@@ -1,4 +1,4 @@
-From ae584135ba044ef69640b22f53fe337a12cbe52f Mon Sep 17 00:00:00 2001
+From 71e6ac2de7db1db61cb41e82af2b748bc133c630 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Fri, 9 Mar 2012 08:39:37 -0500
 Subject: [PATCH 11/21] ACPI: Limit access to custom_method

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0012-asus-wmi-Restrict-debugfs-interface-when-module-load.patch

@@ -1,4 +1,4 @@
-From 9727ba09f56eb7873736d2cc2ecef42722b098b9 Mon Sep 17 00:00:00 2001
+From afe41933049853e1024f919fb79ef1a98d9364e8 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Fri, 9 Mar 2012 08:46:50 -0500
 Subject: [PATCH 12/21] asus-wmi: Restrict debugfs interface when module

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0013-Restrict-dev-mem-and-dev-kmem-when-module-loading-is.patch

@@ -1,4 +1,4 @@
-From 0fbd3b71c764f791bed5ad56e4fe3a4c0e557ebe Mon Sep 17 00:00:00 2001
+From 36ce102963662a97cf8554e56d24e63456ab0829 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Fri, 9 Mar 2012 09:28:15 -0500
 Subject: [PATCH 13/21] Restrict /dev/mem and /dev/kmem when module loading is

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0014-acpi-Ignore-acpi_rsdp-kernel-parameter-when-module-l.patch

@@ -1,4 +1,4 @@
-From a7fc0717f49a6a06e20ea24406eefeb8497b1666 Mon Sep 17 00:00:00 2001
+From 173431ce413924b0c0ca77168802bf5380bdfacb Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@redhat.com>
 Date: Mon, 25 Jun 2012 19:57:30 -0400
 Subject: [PATCH 14/21] acpi: Ignore acpi_rsdp kernel parameter when module

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0015-kexec-Disable-at-runtime-if-the-kernel-enforces-modu.patch

@@ -1,4 +1,4 @@
-From 3819061fb96f6cfe79c5827ccb1350274431a626 Mon Sep 17 00:00:00 2001
+From df56d6b915cef75ffbe434dd0d83fd5f4964ae8a Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <mjg59@coreos.com>
 Date: Thu, 19 Nov 2015 18:55:53 -0800
 Subject: [PATCH 15/21] kexec: Disable at runtime if the kernel enforces module

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0016-x86-Restrict-MSR-access-when-module-loading-is-restr.patch

@@ -1,4 +1,4 @@
-From 9e0d3ed7ba55087b28dd1d05d187772a2aca995c Mon Sep 17 00:00:00 2001
+From 2f322ec08c923f034453153a6bdb40d3b6268313 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Fri, 8 Feb 2013 11:12:13 -0800
 Subject: [PATCH 16/21] x86: Restrict MSR access when module loading is

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0017-Add-option-to-automatically-enforce-module-signature.patch

@@ -1,4 +1,4 @@
-From 1992d30251849cdeda09d423c9d55db6105b02ad Mon Sep 17 00:00:00 2001
+From 5d8a7800ba8d0c7295d8c88858291ebdbf95e063 Mon Sep 17 00:00:00 2001
 From: Matthew Garrett <matthew.garrett@nebula.com>
 Date: Fri, 9 Aug 2013 18:36:30 -0400
 Subject: [PATCH 17/21] Add option to automatically enforce module signatures

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0018-efi-Make-EFI_SECURE_BOOT_SIG_ENFORCE-depend-on-EFI.patch

@@ -1,4 +1,4 @@
-From 1dc121c43321cec056018f3a9b0be1905b4b3a98 Mon Sep 17 00:00:00 2001
+From 00efe9ab7a15b6c5bf4e62ba35f0bbf7c23f167f Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@fedoraproject.org>
 Date: Tue, 27 Aug 2013 13:28:43 -0400
 Subject: [PATCH 18/21] efi: Make EFI_SECURE_BOOT_SIG_ENFORCE depend on EFI

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0019-efi-Add-EFI_SECURE_BOOT-bit.patch

@@ -1,4 +1,4 @@
-From 3bbee9070feb5ecd3c4f4003564a47fc6b321aee Mon Sep 17 00:00:00 2001
+From 77c8564969225bbe01c379386e2b655e7bd58297 Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@fedoraproject.org>
 Date: Tue, 27 Aug 2013 13:33:03 -0400
 Subject: [PATCH 19/21] efi: Add EFI_SECURE_BOOT bit

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0020-hibernate-Disable-in-a-signed-modules-environment.patch

@@ -1,4 +1,4 @@
-From a046628a71b1a9e37252895898630ac176b62ddd Mon Sep 17 00:00:00 2001
+From 549485baca40509902572c0a02addd5e3d4d43b3 Mon Sep 17 00:00:00 2001
 From: Josh Boyer <jwboyer@fedoraproject.org>
 Date: Fri, 20 Jun 2014 08:53:24 -0400
 Subject: [PATCH 20/21] hibernate: Disable in a signed modules environment

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/files/4.8/z0021-kbuild-derive-relative-path-for-KBUILD_SRC-from-CURD.patch

@@ -1,4 +1,4 @@
-From a356477aced4eea60222b222509600839835dcbd Mon Sep 17 00:00:00 2001
+From 54bfa1c43bb2e21168611dba8898abfaa858b7b9 Mon Sep 17 00:00:00 2001
 From: Vito Caputo <vito.caputo@coreos.com>
 Date: Wed, 25 Nov 2015 02:59:45 -0800
 Subject: [PATCH 21/21] kbuild: derive relative path for KBUILD_SRC from CURDIR
@@ -12,7 +12,7 @@ by some undesirable path component.
  1 file changed, 2 insertions(+), 1 deletion(-)
 
 diff --git a/Makefile b/Makefile
-index bf6e44a..b4fe56d 100644
+index 82a36ab..8415a1f 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -147,7 +147,8 @@ $(filter-out _all sub-make $(CURDIR)/Makefile, $(MAKECMDGOALS)) _all: sub-make