committing changes in /etc after apt run

author Frank Brehm <frank@brehm-online.com>

Wed, 29 Jan 2020 22:48:27 +0000 (23:48 +0100)

committer Frank Brehm <frank@brehm-online.com>

Wed, 29 Jan 2020 22:48:27 +0000 (23:48 +0100)
author Frank Brehm <frank@brehm-online.com>
Wed, 29 Jan 2020 22:48:27 +0000 (23:48 +0100)
committer Frank Brehm <frank@brehm-online.com>
Wed, 29 Jan 2020 22:48:27 +0000 (23:48 +0100)
diff --git a/alternatives/jfr b/alternatives/jfr

new file mode 120000 (symlink)

index 0000000..d5fda24
--- /dev/null
+++ b/alternatives/jfr
@@ -0,0 +1 @@
+/usr/lib/jvm/java-11-openjdk-amd64/bin/jfr
+\ No newline at end of file
diff --git a/apt/apt.conf.d/01autoremove-kernels b/apt/apt.conf.d/01autoremove-kernels

index e01f2b25a73a8b9eb11004ab44f4e5c0c96acbf1..eeb62d4d20ab9c2b2226f1c1e2299abe37944740 100644 (file)
--- a/apt/apt.conf.d/01autoremove-kernels
+++ b/apt/apt.conf.d/01autoremove-kernels
@@ -1,69 +1,75 @@
  // DO NOT EDIT! File autogenerated by /etc/kernel/postinst.d/apt-auto-removal
  APT::NeverAutoRemove
  {
-   "^linux-image-5\.0\.0-37-generic$";
     "^linux-image-5\.3\.0-26-generic$";
-   "^linux-headers-5\.0\.0-37-generic$";
+   "^linux-image-5\.3\.0-28-generic$";
     "^linux-headers-5\.3\.0-26-generic$";
-   "^linux-image-extra-5\.0\.0-37-generic$";
+   "^linux-headers-5\.3\.0-28-generic$";
     "^linux-image-extra-5\.3\.0-26-generic$";
-   "^linux-modules-5\.0\.0-37-generic$";
+   "^linux-image-extra-5\.3\.0-28-generic$";
     "^linux-modules-5\.3\.0-26-generic$";
-   "^linux-modules-extra-5\.0\.0-37-generic$";
+   "^linux-modules-5\.3\.0-28-generic$";
     "^linux-modules-extra-5\.3\.0-26-generic$";
-   "^linux-signed-image-5\.0\.0-37-generic$";
+   "^linux-modules-extra-5\.3\.0-28-generic$";
     "^linux-signed-image-5\.3\.0-26-generic$";
-   "^linux-image-unsigned-5\.0\.0-37-generic$";
+   "^linux-signed-image-5\.3\.0-28-generic$";
     "^linux-image-unsigned-5\.3\.0-26-generic$";
-   "^kfreebsd-image-5\.0\.0-37-generic$";
+   "^linux-image-unsigned-5\.3\.0-28-generic$";
     "^kfreebsd-image-5\.3\.0-26-generic$";
-   "^kfreebsd-headers-5\.0\.0-37-generic$";
+   "^kfreebsd-image-5\.3\.0-28-generic$";
     "^kfreebsd-headers-5\.3\.0-26-generic$";
-   "^gnumach-image-5\.0\.0-37-generic$";
+   "^kfreebsd-headers-5\.3\.0-28-generic$";
     "^gnumach-image-5\.3\.0-26-generic$";
-   "^.*-modules-5\.0\.0-37-generic$";
+   "^gnumach-image-5\.3\.0-28-generic$";
     "^.*-modules-5\.3\.0-26-generic$";
-   "^.*-kernel-5\.0\.0-37-generic$";
+   "^.*-modules-5\.3\.0-28-generic$";
     "^.*-kernel-5\.3\.0-26-generic$";
-   "^linux-backports-modules-.*-5\.0\.0-37-generic$";
+   "^.*-kernel-5\.3\.0-28-generic$";
     "^linux-backports-modules-.*-5\.3\.0-26-generic$";
-   "^linux-modules-.*-5\.0\.0-37-generic$";
+   "^linux-backports-modules-.*-5\.3\.0-28-generic$";
     "^linux-modules-.*-5\.3\.0-26-generic$";
-   "^linux-tools-5\.0\.0-37-generic$";
+   "^linux-modules-.*-5\.3\.0-28-generic$";
     "^linux-tools-5\.3\.0-26-generic$";
-   "^linux-cloud-tools-5\.0\.0-37-generic$";
+   "^linux-tools-5\.3\.0-28-generic$";
     "^linux-cloud-tools-5\.3\.0-26-generic$";
-   "^linux-buildinfo-5\.0\.0-37-generic$";
+   "^linux-cloud-tools-5\.3\.0-28-generic$";
     "^linux-buildinfo-5\.3\.0-26-generic$";
-   "^linux-source-5\.0\.0-37-generic$";
+   "^linux-buildinfo-5\.3\.0-28-generic$";
     "^linux-source-5\.3\.0-26-generic$";
+   "^linux-source-5\.3\.0-28-generic$";
  };
  /* Debug information:
  # dpkg list:
  ii  linux-image-4.15.0-74-generic              4.15.0-74.84                                    amd64        Signed kernel image generic
+ii  linux-image-4.15.0-76-generic              4.15.0-76.86                                    amd64        Signed kernel image generic
  ii  linux-image-5.0.0-32-generic               5.0.0-32.34~18.04.2                             amd64        Signed kernel image generic
  ii  linux-image-5.0.0-37-generic               5.0.0-37.40~18.04.1                             amd64        Signed kernel image generic
-iF  linux-image-5.3.0-26-generic               5.3.0-26.28~18.04.1                             amd64        Signed kernel image generic
-ii  linux-image-generic                        4.15.0.74.76                                    amd64        Generic Linux kernel image
-ii  linux-image-generic-hwe-18.04              5.3.0.26.95                                     amd64        Generic Linux kernel image
+ii  linux-image-5.3.0-26-generic               5.3.0-26.28~18.04.1                             amd64        Signed kernel image generic
+iF  linux-image-5.3.0-28-generic               5.3.0-28.30~18.04.1                             amd64        Signed kernel image generic
+ii  linux-image-generic                        4.15.0.76.78                                    amd64        Generic Linux kernel image
+ii  linux-image-generic-hwe-18.04              5.3.0.28.96                                     amd64        Generic Linux kernel image
  # list of installed kernel packages:
  4.15.0-74-generic 4.15.0-74.84
+4.15.0-76-generic 4.15.0-76.86
  5.0.0-32-generic 5.0.0-32.34~18.04.2
  5.0.0-37-generic 5.0.0-37.40~18.04.1
  5.3.0-26-generic 5.3.0-26.28~18.04.1
+5.3.0-28-generic 5.3.0-28.30~18.04.1
  # list of different kernel versions:
+5.3.0-28.30~18.04.1
  5.3.0-26.28~18.04.1
  5.0.0-37.40~18.04.1
  5.0.0-32.34~18.04.2
+4.15.0-76.86
  4.15.0-74.84
-# Installing kernel: 5.3.0-26.28~18.04.1 (5.3.0-26-generic)
-# Running kernel: 5.0.0-37.40~18.04.1 (5.0.0-37-generic)
-# Last kernel: 5.3.0-26.28~18.04.1
-# Previous kernel: 5.0.0-37.40~18.04.1
+# Installing kernel: 5.3.0-28.30~18.04.1 (5.3.0-28-generic)
+# Running kernel: 5.3.0-26.28~18.04.1 (5.3.0-26-generic)
+# Last kernel: 5.3.0-28.30~18.04.1
+# Previous kernel: 5.3.0-26.28~18.04.1
  # Kernel versions list to keep:
-5.0.0-37.40~18.04.1
  5.3.0-26.28~18.04.1
+5.3.0-28.30~18.04.1
  # Kernel packages (version part) to protect:
-5\.0\.0-37-generic
  5\.3\.0-26-generic
+5\.3\.0-28-generic
  */
diff --git a/java-11-openjdk/jfr/default.jfc b/java-11-openjdk/jfr/default.jfc

index 04e02e93134fad34bb317b316fd7e08afe5114f7..d55eeeafc0ddbe202e12442a4049b2a6acc92665 100644 (file)
--- a/java-11-openjdk/jfr/default.jfc
+++ b/java-11-openjdk/jfr/default.jfc
@@ -115,12 +115,12 @@
  
      <event name="jdk.ExecutionSample">
        <setting name="enabled" control="method-sampling-enabled">true</setting>
-      <setting name="period" control="method-sampling-interval">20 ms</setting>
+      <setting name="period" control="method-sampling-java-interval">20 ms</setting>
      </event>
  
      <event name="jdk.NativeMethodSample">
        <setting name="enabled" control="method-sampling-enabled">true</setting>
-      <setting name="period" control="method-sampling-interval">20 ms</setting>
+      <setting name="period" control="method-sampling-native-interval">20 ms</setting>
      </event>
  
      <event name="jdk.SafepointBegin">
@@ -488,6 +488,11 @@
        <setting name="period">beginChunk</setting>
      </event>
  
+    <event name="jdk.VirtualizationInformation">
+     <setting name="enabled">true</setting>
+     <setting name="period">beginChunk</setting>
+    </event>
+
      <event name="jdk.CPUInformation">
        <setting name="enabled">true</setting>
        <setting name="period">beginChunk</setting>
@@ -773,13 +778,42 @@
        </condition>
  
        <selection name="method-sampling-interval" default="normal" label="Method Sampling">
-        <option label="Off" name="off">999 d</option>
-        <option label="Normal" name="normal">20 ms</option>
-        <option label="Maximum" name="maximum">10 ms</option>
+        <option label="Off" name="off">off</option>
+        <option label="Normal" name="normal">normal</option>
+        <option label="High" name="high">high</option>
+        <option label="Ludicrous (High Overhead)" name="ludicrous">ludicrous</option>
        </selection>
+      
+      <condition name="method-sampling-java-interval" true="999 d">
+        <test name="method-sampling-interval" operator="equal" value="off"/>
+      </condition>
+
+      <condition name="method-sampling-java-interval" true="20 ms">
+        <test name="method-sampling-interval" operator="equal" value="normal"/>
+      </condition>
+
+      <condition name="method-sampling-java-interval" true="10 ms">
+        <test name="method-sampling-interval" operator="equal" value="high"/>
+      </condition>
+
+      <condition name="method-sampling-java-interval" true="1 ms">
+        <test name="method-sampling-interval" operator="equal" value="ludicrous"/>
+      </condition>
+      
+      <condition name="method-sampling-native-interval" true="999 d">
+        <test name="method-sampling-interval" operator="equal" value="off"/>
+      </condition>
+
+      <condition name="method-sampling-native-interval" true="20 ms">
+        <or>
+          <test name="method-sampling-interval" operator="equal" value="normal"/>
+          <test name="method-sampling-interval" operator="equal" value="high"/>
+          <test name="method-sampling-interval" operator="equal" value="ludicrous"/>
+        </or>
+      </condition>  
  
        <condition name="method-sampling-enabled" true="false" false="true">
-        <test name="method-sampling-interval" operator="equal" value="999 d"/>
+        <test name="method-sampling-interval" operator="equal" value="off"/>
        </condition>
  
        <selection name="thread-dump-interval" default="normal" label="Thread Dump">
diff --git a/java-11-openjdk/jfr/profile.jfc b/java-11-openjdk/jfr/profile.jfc

index fec835f14930923d351240f36641c9bccfd8b4e4..9023cd020f7a98ae77085b5998b559b37a8c5a28 100644 (file)
--- a/java-11-openjdk/jfr/profile.jfc
+++ b/java-11-openjdk/jfr/profile.jfc
@@ -115,12 +115,12 @@
  
      <event name="jdk.ExecutionSample">
        <setting name="enabled" control="method-sampling-enabled">true</setting>
-      <setting name="period" control="method-sampling-interval">10 ms</setting>
+      <setting name="period" control="method-sampling-java-interval">10 ms</setting>
      </event>
  
      <event name="jdk.NativeMethodSample">
        <setting name="enabled" control="method-sampling-enabled">true</setting>
-      <setting name="period" control="method-sampling-interval">10 ms</setting>
+      <setting name="period" control="method-sampling-native-interval">20 ms</setting>
      </event>
  
      <event name="jdk.SafepointBegin">
@@ -488,6 +488,11 @@
        <setting name="period">beginChunk</setting>
      </event>
  
+    <event name="jdk.VirtualizationInformation">
+     <setting name="enabled">true</setting>
+     <setting name="period">beginChunk</setting>
+    </event>
+
      <event name="jdk.CPUInformation">
        <setting name="enabled">true</setting>
        <setting name="period">beginChunk</setting>
@@ -773,14 +778,43 @@
          <test name="compiler-level" operator="equal" value="all"/>
        </condition>
  
-      <selection name="method-sampling-interval" default="maximum" label="Method Sampling">
-        <option label="Off" name="off">999 d</option>
-        <option label="Normal" name="normal">20 ms</option>
-        <option label="Maximum" name="maximum">10 ms</option>
+      <selection name="method-sampling-interval" default="normal" label="Method Sampling">
+        <option label="Off" name="off">off</option>
+        <option label="Normal" name="normal">normal</option>
+        <option label="High" name="high">high</option>
+        <option label="Ludicrous (High Overhead)" name="ludicrous">ludicrous</option>
        </selection>
+      
+      <condition name="method-sampling-java-interval" true="999 d">
+        <test name="method-sampling-interval" operator="equal" value="off"/>
+      </condition>
+
+      <condition name="method-sampling-java-interval" true="20 ms">
+        <test name="method-sampling-interval" operator="equal" value="normal"/>
+      </condition>
  
+      <condition name="method-sampling-java-interval" true="10 ms">
+        <test name="method-sampling-interval" operator="equal" value="high"/>
+      </condition>
+
+      <condition name="method-sampling-java-interval" true="1 ms">
+        <test name="method-sampling-interval" operator="equal" value="ludicrous"/>
+      </condition>
+      
+      <condition name="method-sampling-native-interval" true="999 d">
+        <test name="method-sampling-interval" operator="equal" value="off"/>
+      </condition>
+
+      <condition name="method-sampling-native-interval" true="20 ms">
+        <or>
+          <test name="method-sampling-interval" operator="equal" value="normal"/>
+          <test name="method-sampling-interval" operator="equal" value="high"/>
+          <test name="method-sampling-interval" operator="equal" value="ludicrous"/>
+        </or>
+      </condition>    
+      
        <condition name="method-sampling-enabled" true="false" false="true">
-        <test name="method-sampling-interval" operator="equal" value="999 d"/>
+        <test name="method-sampling-interval" operator="equal" value="off"/>
        </condition>
  
        <selection name="thread-dump-interval" default="everyMinute" label="Thread Dump">
diff --git a/java-11-openjdk/security/java.security b/java-11-openjdk/security/java.security

index 0c87fe1191aded519dd3efdcf3ee3a3612fe4e6a..e922ef3e5be9d76d5e854387fb6e0d6c73dc7c94 100644 (file)
--- a/java-11-openjdk/security/java.security
+++ b/java-11-openjdk/security/java.security
@@ -452,6 +452,31 @@ networkaddress.cache.negative.ttl=10
  #
  krb5.kdc.bad.policy = tryLast
  
+#
+# Kerberos cross-realm referrals (RFC 6806)
+#
+# OpenJDK's Kerberos client supports cross-realm referrals as defined in
+# RFC 6806. This allows to setup more dynamic environments in which clients
+# do not need to know in advance how to reach the realm of a target principal
+# (either a user or service).
+#
+# When a client issues an AS or a TGS request, the "canonicalize" option
+# is set to announce support of this feature. A KDC server may fulfill the
+# request or reply referring the client to a different one. If referred,
+# the client will issue a new request and the cycle repeats.
+#
+# In addition to referrals, the "canonicalize" option allows the KDC server
+# to change the client name in response to an AS request. For security reasons,
+# RFC 6806 (section 11) FAST scheme is enforced.
+#
+# Disable Kerberos cross-realm referrals. Value may be overwritten with a
+# System property (-Dsun.security.krb5.disableReferrals).
+sun.security.krb5.disableReferrals=false
+
+# Maximum number of AS or TGS referrals to avoid infinite loops. Value may
+# be overwritten with a System property (-Dsun.security.krb5.maxReferrals).
+sun.security.krb5.maxReferrals=5
+
  #
  # Algorithm restrictions for certification path (CertPath) processing
  #
@@ -907,8 +932,8 @@ jdk.xml.dsig.secureValidationPolicy=\
  # Patterns are separated by ";" (semicolon).
  # Whitespace is significant and is considered part of the pattern.
  #
-# If the system property jdk.serialFilter is also specified, it supersedes
-# the security property value defined here.
+# If the system property jdk.serialFilter is also specified on the command
+# line, it supersedes the security property value defined here.
  #
  # If a pattern includes a "=", it sets a limit.
  # If a limit appears more than once the last value is used.
@@ -1021,6 +1046,16 @@ jdk.xml.dsig.secureValidationPolicy=\
  #
  #com.sun.CORBA.ORBIorTypeCheckRegistryFilter=binary_class_name;binary_class_name
  
+# The iteration count used for password-based encryption (PBE) in JCEKS
+# keystores. Values in the range 10000 to 5000000 are considered valid.
+# If the value is out of this range, or is not a number, or is unspecified;
+# a default of 200000 is used.
+#
+# If the system property jdk.jceks.iterationCount is also specified, it
+# supersedes the security property value defined here.
+#
+#jdk.jceks.iterationCount = 200000
+
  #
  # JCEKS Encrypted Key Serial Filter
  #
diff --git a/java-8-openjdk/security/java.security b/java-8-openjdk/security/java.security

index de4e8f892155200db373f99e5e18ce47a5cd5609..b78f07d9d5cd871d06c1c0a43af9e13dcdda6f82 100644 (file)
--- a/java-8-openjdk/security/java.security
+++ b/java-8-openjdk/security/java.security
@@ -342,7 +342,7 @@ networkaddress.cache.negative.ttl=10
  # By default, the location of the OCSP responder is determined implicitly
  # from the certificate being validated. This property explicitly specifies
  # the location of the OCSP responder. The property is used when the
-# Authority Information Access extension (defined in RFC 3280) is absent
+# Authority Information Access extension (defined in RFC 5280) is absent
  # from the certificate or when it requires overriding.
  #
  # Example,
@@ -421,6 +421,32 @@ networkaddress.cache.negative.ttl=10
  #   krb5.kdc.bad.policy = tryLess:2,2000
  krb5.kdc.bad.policy = tryLast
  
+#
+# Kerberos cross-realm referrals (RFC 6806)
+#
+# OpenJDK's Kerberos client supports cross-realm referrals as defined in
+# RFC 6806. This allows to setup more dynamic environments in which clients
+# do not need to know in advance how to reach the realm of a target principal
+# (either a user or service).
+#
+# When a client issues an AS or a TGS request, the "canonicalize" option
+# is set to announce support of this feature. A KDC server may fulfill the
+# request or reply referring the client to a different one. If referred,
+# the client will issue a new request and the cycle repeats.
+#
+# In addition to referrals, the "canonicalize" option allows the KDC server
+# to change the client name in response to an AS request. For security reasons,
+# RFC 6806 (section 11) FAST scheme is enforced.
+#
+# Disable Kerberos cross-realm referrals. Value may be overwritten with a
+# System property (-Dsun.security.krb5.disableReferrals).
+sun.security.krb5.disableReferrals=false
+
+# Maximum number of AS or TGS referrals to avoid infinite loops. Value may
+# be overwritten with a System property (-Dsun.security.krb5.maxReferrals).
+sun.security.krb5.maxReferrals=5
+
+#
  # Algorithm restrictions for certification path (CertPath) processing
  #
  # In some environments, certain algorithms or key lengths may be undesirable
@@ -862,8 +888,8 @@ jdk.xml.dsig.secureValidationPolicy=\
  # Patterns are separated by ";" (semicolon).
  # Whitespace is significant and is considered part of the pattern.
  #
-# If the system property jdk.serialFilter is also specified, it supersedes
-# the security property value defined here.
+# If the system property jdk.serialFilter is also specified on the command
+# line, it supersedes the security property value defined here.
  #
  # If a pattern includes a "=", it sets a limit.
  # If a limit appears more than once the last value is used.
author	Frank Brehm <frank@brehm-online.com>
	Wed, 29 Jan 2020 22:48:27 +0000 (23:48 +0100)
committer	Frank Brehm <frank@brehm-online.com>
	Wed, 29 Jan 2020 22:48:27 +0000 (23:48 +0100)
alternatives/jfr	[new symlink]	patch \| blob
apt/apt.conf.d/01autoremove-kernels		patch \| blob \| history
java-11-openjdk/jfr/default.jfc		patch \| blob \| history
java-11-openjdk/jfr/profile.jfc		patch \| blob \| history
java-11-openjdk/security/java.security		patch \| blob \| history
java-8-openjdk/security/java.security		patch \| blob \| history