Bug 1697963
| Summary: | DNF has inconsistent behaviour for kernel-core package | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Andrei Stepanov <astepano> |
| Component: | dnf | Assignee: | Packaging Maintenance Team <packaging-team-maint> |
| Status: | CLOSED NOTABUG | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | --- | CC: | esyr, james.antill |
| Target Milestone: | rc | ||
| Target Release: | 8.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-04-09 15:14:56 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1698145 | ||
| Bug Blocks: | |||
|
Comment 1
Andrei Stepanov
2019-04-09 11:25:40 UTC
# dnf remove --setopt=autocheck_running_kernel=no --allowerasing kernel-core-4.18.0-80.el8.x86_64 Doesn't help. # dnf --assumeno remove kernel-core-4.18.0-80.5.el8.x86_64 Updating Subscription Management repositories. Unable to read consumer identity This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register. Repository beaker-client-testing is listed more than once in the configuration Error: Problem: The operation would result in removing the following protected packages: kernel-core (try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages) # echo $? 1 # dnf --assumeno remove bc Updating Subscription Management repositories. Unable to read consumer identity This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register. Repository beaker-client-testing is listed more than once in the configuration Dependencies resolved. ============================================================================================================================================================================================================= Package Arch Version Repository Size ============================================================================================================================================================================================================= Removing: bc x86_64 1.07.1-5.el8 @rhel 234 k Transaction Summary ============================================================================================================================================================================================================= Remove 1 Package Freed space: 234 k Operation aborted. # echo $? 1 It seems a solution can be: # dnf --assumeyes --setopt tsflags=test remove kernel-core-4.18.0-80.5.el8.x86_64 The protection of a running kernel is a feature of DNF and it is more than recommended to not perform such an action. If you know what you do you can always run "rpm -e kernel-core". In general users of DNF expects a certain level of security that includes protecting of a running kernel. Please don't hesitate to reopen the bug if you thing that approach with rpm is not suitable for your user case. Then please explain your story in details and why it is essential to implement disablement of basic mechanisms of protection of system integrity and stability. (In reply to Jaroslav Mracek from comment #5) > The protection of a running kernel is a feature of DNF and it is more than recommended to not perform such an action. Protection of kernel image itself is close to meaningless, the only meaningful protection is protection of kernel modules (as they may be loaded on demand at any time and their absence may lead to severe issues), and DNF doesn't provide that. Moreover, the protection is meaningless if the action is requested within a mount namespace. |