Always force the use latest kernel by default

[emkll]

Status

Ready for review

Description of Changes

Fixes #3842.

• Bumps kernel metapackage version to 4.4.144-1 so that the version is higher than currently installed version
• Change postinst to force latest kernel to boot by default

Testing

• Install 0.9.0 on virtual machines or hardware
• roll back to 3.14.79 per instructions here: https://docs.securedrop.org/en/release-0.9/kernel_troubleshooting.html
• checkout this branch and make build-debs and use securedrop-grsec-4.4.144-1-amd64.deb
• install securedrop-grsec-4.4.144-1-amd64.deb on machines that have been rolled back
• sudo apt-get autoremove (necessary for local testing only: when using apt servers, this will be done by cron-apt)

Confirm that:

• The app and mon servers boot into kernel 4.4.144-grsec (uname -r)
• apt list --installed | grep grsec still includes 3.14.79
• /etc/default/grub contains GRUB_DEFAULT=0

Deployment

All changes will be deployed as part with the securedrop-grsec package.
Setting the version string to 4.4.144-1 (because we are not shipping a kernel as part of 0.10.0, see #3838 ). We will be removing 3.14.79 kernel at a later date, see #3643

Checklist

If you made changes to the system configuration:

• Configuration tests pass

If you made non-trivial code changes:

• I have written a test plan and validated it for this PR

[redshiftzero]

hey @zenmonkeykstop, putting this one on your QA list - let's try to get this one in today/tomorrow so we can backport into the release branch

[emkll]

Rebased on latest develop. The reason the full kernel string is due to the build logic around the Jinja templating of files: postinst requires executable permissions, but the templates produce files with non-executable permissions.

I see 2 ways to approach this:

• Ansible 2.6 with mode: preserve (https://docs.ansible.com/ansible/latest/modules/template_module.html)
• Per-file permissions, but would require refactoring some build/templating logic.

[zenmonkeykstop]

Tested as follows:

• Installed 0.9.1 (not 0.9.0) on prod VMs
• rolled back to 3.14.79 on app-prod as per instructions here: https://docs.securedrop.org/en/release-0.9/kernel_troubleshooting.html
• checked out branch, ran make build-debs
• copied securedrop-grsec-4.4.144-1-amd64.deb to app-prod and installed it:

sudo dpkg -i securedrop-grsec-4.4.144-1-amd64.deb
sudo apt-get autoremove
sudo reboot

Confirmed that:

[x] The app and mon servers boot into kernel 4.4.144-grsec (uname -r)
[x] apt list --installed | grep grsec still includes 3.14.79
[x] /etc/default/grub contains GRUB_DEFAULT=0

So 👍 for this change on VMs.

[redshiftzero]

thanks @emkll and thanks for the QA @zenmonkeykstop - merging so we can backport into the release branch