<div dir="ltr">I managed to create a patched version of the lustre-client-dkms 2.15.8 rpm, which fixes the issue that the kernel modules cannot be compiled on our Alma Linux 9.8 client nodes.<br>Since thousands of users can login on or submit jobs to these clients we absolutely need to be able to quickly fix privilege escalation exploits on these nodes.<br><br>Here is a summary of the way I was able to rebuild the lustre-client-dkms rpm:<br><br>The patches for the new kernels can be found via: <a href="https://jira.whamcloud.com/browse/LU-20071">https://jira.whamcloud.com/browse/LU-20071</a><br>where LU-20071 is the label for the new Red Hat 9.8 release. I assume that a similar procedure can be followed in the future for Red Hat 9.9 and its derivatives.<br>Note that in our case we wanted to fix the LTS release 2.15.8. So look for the branch b2_15 on the LU-20071 page. This specific patch can be found at:<br><a href="https://review.whamcloud.com/c/fs/lustre-release/+/65797">https://review.whamcloud.com/c/fs/lustre-release/+/65797</a><br>Figuring this out took some time, as I did not know the structure of the build system, and I first tried to use the patch for the latest release, which would not apply.<br><br>After this I used the following procedure to build an updated lustre-client-dkms rpm:<br><br>1. Download the Lustre source rpm from <a href="https://downloads.whamcloud.com/public/lustre/latest-release/el9.7/client/SRPMS/lustre-client-dkms-2.15.8-1.el9.src.rpm">https://downloads.whamcloud.com/public/lustre/latest-release/el9.7/client/SRPMS/lustre-client-dkms-2.15.8-1.el9.src.rpm</a><br>2. Install the rpm using:<br> rpm -i lustre-client-dkms-2.15.8-1.el9.src.rpm<br>3. Go the the ~/rpmbuild/SOURCES directory and unpack the source file<br> tar xzf lustre-2.15.8.tar.gz<br>4. Download the patch from <a href="https://review.whamcloud.com/c/fs/lustre-release/+/65797">https://review.whamcloud.com/c/fs/lustre-release/+/65797</a>, which can be downloaded using the "DOWNLOAD" link. I selected c131e65.diff.zip<br>5. Unzip the patch into c131e65.diff<br>6. Apply the patch using something like:<br> cd lustre-2.15.8<br> patch -p1 < ../c131e65.diff<br> cd ..<br>7. Create an updated source tar file:<br> tar czf lustre-2.15.8.tar.gz lustre-2.15.8<br>8. Fix the hardcoded buildid in the spec file, by changing it from 1 to 2, so the line reads:<br>%define buildid 2<br>9. Build the rpm (client without zfs, but with ldiskfs for our use case):<br>rpmbuild -ba rpmbuild/SPECS/lustre-dkms.spec --without servers --without zfs --with ldiskfs<br><br>This results in rpmbuild/RPMS/noarch/lustre-client-dkms-2.15.8-2.el9.noarch.rpm<br><br>Installing this rpm, together with lustre-client-2.15.8-1.el9.x86_64.rpm resulted in a working client on Alma Linux 9.8. I've tested some nodes using the IOR benchmark.<br><br>I hope these instructions are helpful to others. Please let me know if you have suggestions to improve the procedure.<div><br></div><div>Kind regards,</div><div><br></div><div>Fokke Dijkstra<br></div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">Op di 9 jun 2026 om 19:07 schreef Mohr, Rick <<a href="mailto:mohrrf@ornl.gov">mohrrf@ornl.gov</a>>:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Looking through my scripts, the configure command was run with the following options (with paths to dirs substituted for variables) after the patch had been applied to the source code:<br>
<br>
configure --with-linux=$KERN_DIR --with-linux-obj=$KERN_OBJ_DIR --with-o2ib=$OFED_DIR --disable-gss --disable-gss-keyring --disable-server --disable-tests --disable-iokit --with-mds-max-threads=8192 --enable-mpitests=yes<br>
<br>
Then I just ran "make rpms" to create the packages. Everything was pretty straightforward, although not all the options I used would necessarily be needed at another site.<br>
<br>
--Rick<br>
<br>
<br>
\ufeffOn 6/4/26, 12:35 PM, "Mohr, Rick" <<a href="mailto:mohrrf@ornl.gov" target="_blank">mohrrf@ornl.gov</a> <mailto:<a href="mailto:mohrrf@ornl.gov" target="_blank">mohrrf@ornl.gov</a>>> wrote:<br>
<br>
<br>
Well, I actually built the client using a wrapper script that James Simmons wrote to manage git checkouts, patch application, etc. so the steps were hidden by that process. I'll see if I can dig out the underlying commands and post them here.<br>
<br>
<br>
--Rick<br>
<br>
<br>
<br>
<br>
</blockquote></div><div><br clear="all"></div><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr">Fokke Dijkstra <a href="mailto:f.dijkstra@rug.nl" target="_blank"><f.dijkstra@rug.nl></a>
<br>Team High Performance Computing</div><div dir="ltr">Center for Information Technology, University of Groningen
<br>Postbus 11044, 9700 CA Groningen, The Netherlands
<br><br>
</div></div></div></div>