Securing and Optimizing Linux: RedHat Edition -A Hands on Guide
Prev Chapter 7. Configuring and Building a Secure, Optimized Kernel Next

7.10. Installing the new kernel

  1. Copy the file /usr/src/linux/arch/i386/boot/bzImage from the kernel source tree to the /boot directory, and give it an appropriate new name.

    
             [root@deep ] /linux#cp /usr/src/linux/arch/i386/boot/bzImage /boot/vmlinuz-kernel.version.number
    An appropriated or recommended new name is something like vmlinuz-2.2.14, this is important if you want a new rescue floppy or emergency boot floppy using the mkbootdisk program that require some specific needs like for example: vmlinuz-2.2.14 instead of vmlinuz-2.2.14.a

  2. Copy the file /usr/src/linux/System.map from the kernel source tree to the /boot directory, and give it an appropriate new name.

    
             [root@deep ] /linux#cp /usr/src/linux/System.map /boot/System.map-kernel.version.number

  3. Move into the /boot directory and rebuild the links to vmlinuz and System.map with the following commands:

    
             [root@deep ] /linux#cd /boot
             [root@deep ] /boot#ln -fs vmlinuz-kernel.version.number vmlinuz
             [root@deep ] /boot#ln -fs System.map-kernel.version.number System.map
    We must rebuild the links of vmlinuz and System.map to point them to the new kernel version installed. Without the new links LILO program will look by default for the old version of your Linux kernel.

  4. Remove obsolete and unnecessary files under the /boot directory to make space:

    
             [root@deep ] /boot#rm -f  module-info
             [root@deep ] /boot#rm -f  initrd-2.2.xx.img
    The module-info link point to the old modules directory of your original kernel. Since we have installed a brand new kernel, we don't need to keep this broken link. The initrd-2.2.xx is a file that contains an initial RAM disk image that serves as a system before the disk is available. This file is only available and is installed from the Linux setup installation if your system has a SCSI adapter present. If we use and have a SCSI system, the driver now will be incorporated into our new Linux kernel since we have build a monolithic kernel, so we can remove this file initrd-2.2.xx.img safely.

  5. Create a new Linux kernel directory that will handle all header files related to Linux kernel for future compilation of other programs on your system. Recall, we had created two symlinks under the /usr/include directory that point to the Linux kernel to be able to compile it without receiving error and also be able to compile future programs. The /usr/include directory is where all header files of your Linux system are kept for reference and dependencies when you compile and install new programs. The asm, and linux links are used when program need to know some functions from compile-time specific to the kernel installed on your system. Programs call other headers in the include directory when they must know specific information, dependencies, etc. of your system.

    
              [root@deep] /#mkdir -p  /usr/src/linux-2.2.14/include
              [root@deep] /#cp -r  /usr/src/linux/include/asm-generic /usr/src/linux-2.2.14/include
              [root@deep] /#cp -r  /usr/src/linux/include/asm-i386 /usr/src/linux-2.2.14/include
              [root@deep] /#cp -r  /usr/src/linux/include/linux /usr/src/linux-2.2.14/include
              [root@deep] /#cp -r  /usr/src/linux/include/net /usr/src/linux-2.2.14/include
              [root@deep] /#cp -r  /usr/src/linux/include/video /usr/src/linux-2.2.14/include
              [root@deep] /#cp -r  /usr/src/linux/include/scsi /usr/src/linux-2.2.14/include
              [root@deep] /#rm -rf  /usr/src/linux
              [root@deep] /#cd /usr/src
              [root@deep ] /src#ln -s  /usr/src/linux-2.2.14 linux
    First we create a new directory named linux-2.2.14 based on the version of the kernel we have installed for easy interpretation, then we copy directories asm-generic, asm-i386, linux, net, video, and scsi from /usr/linux/include to our new place /usr/src/linux-2.2.14/include. After We remove the entire source directory where we had compiled the new kernel, create a new symbolic link named linux under /usr/src that points to our new /usr/src/linux-2.2.14/include directory. With these steps, future compiled programs will know where to look for headers related to the kernel on your server.

    Note: This step will allow us to gain space on our hard drive and will reduce the risk of security. The Linux kernel source directory handles a of lot files and is about 75 MB in size when uncompressed. With the procedure described above, our Linux kernel directory began approximately 3 MB in size so we save 72 MB for the same functionalities.

  6. Finally, you need to edit the /etc/lilo.conf file to make your new kernel one of the boot time options:

    1. Edit the lilo.conf file - vi /etc/lilo.conf and make the appropriated change on the line that read image=/boot/.

      
             [root@deep] /#vi /etc/lilo.conf


                      boot=/dev/sda map=/boot/map install=/boot/boot.b prompt timeout=00 restricted password=somepasswd image=/boot/vmlinuz-kernel.version.number #add your new kernel name file here. label=linux root=/dev/sda6 read-only
                   

      Important: Don't forget to remove the line that read initrd=/boot/initrd-2.2.12-20.img in the lilo.conf file, since this line is not necessary now monolithic kernel doesn't need an initrd file.

    2. Once the name of the new kernel version has been put in the lilo.conf file as shown above, we update our lilo.conf file for the change to take effect with the following command:

      
             [root@deep] /#/sbin/lilo -v


                      LILO version 21, [Copyright 1992-1998 Werner Almesberger Reading boot sector from /dev/sda Merging with /boot/boot.b Boot image: /boot/vmlinuz-2.2.14 Added linux * /boot/boot.0800 exits no backup copy made. Writing boot sector.
                   

      Important: If you say NO to the configuration option Unix98 PTY support CONFIG_UNIX98_PTYS during your kernel configuration, you must edit the /etc/fstab file and remove the line that read:

      
             none         /dev/pts                devpts          gid=5,mode=620  0 0

Prev Home Next
Kernel configuration -Part "E" Up Delete programs, Edit files pertaining to modules