From 3197bb46ccbadb7fdc42d16389bf20c6642ed38b Mon Sep 17 00:00:00 2001 From: Bjordis Collaku Date: Thu, 17 Sep 2026 09:58:57 -0700 Subject: [PATCH] packaging: install kernel modules under /usr/lib/modules Debian Policy 10.1, since 4.7.1, says packages must not install files into /bin, /lib or /sbin, which are symlinks into /usr on merged-/usr systems. The image package installed its modules, their build and source links, and the bundled DKMS modules under /lib/modules. kbuild hardcodes MODLIB to $(INSTALL_MOD_PATH)/lib/modules, so keep installing there and move the staged files with dh_movetousr, as Debian's own linux package does. dh_movetousr also rewrites the absolute build and source links into the relative form Policy 10.5 requires. The move runs from execute_after_dh_installdeb rather than at its usual place. dh_installmodules, called from override_dh_installdeb, only scans lib/modules when it adds the depmod maintainer script snippet, so moving the modules before it would silently drop that snippet. The dh-sequence-movetousr addon would run the helper too early for the same reason. Build-depend on debhelper 13.11.9, the first release where dh_movetousr also rewrites links pointing into aliased directories. Nothing moves between binary packages, so the DEP17 file loss case (P1) does not apply, and base-files ships the /lib symlink on trixie, forky and resolute, so /lib/modules keeps resolving on the target. Signed-off-by: Bjordis Collaku --- debian/README.md | 16 +++++++++++----- debian/control.in | 5 +++-- debian/rules | 20 +++++++++++++++++++- 3 files changed, 33 insertions(+), 8 deletions(-) diff --git a/debian/README.md b/debian/README.md index 581753c2..206bdcf7 100644 --- a/debian/README.md +++ b/debian/README.md @@ -326,10 +326,15 @@ CI writes every orig in one builder image. Installed paths: - `/boot/vmlinuz-` — compressed kernel image - `/boot/config-` — kernel `.config` -- `/lib/modules//` — stripped kernel modules +- `/usr/lib/modules//` — stripped kernel modules - `/usr/lib/linux-image-/` — all DTBs (vendor subdirs preserved) -- `/lib/modules//build` → `/usr/src/linux-headers-/` (symlink) -- `/lib/modules//source` → `/usr/src/linux-headers-/` (symlink) +- `/usr/lib/modules//build` → `/usr/src/linux-headers-/` (symlink) +- `/usr/lib/modules//source` → `/usr/src/linux-headers-/` (symlink) + +Modules ship under `/usr/lib/modules`, the merged-/usr location required by +Debian Policy 10.1; `/lib/modules` resolves to the same directory on the +target. kbuild installs them under `lib/modules/` in the staging tree and +`dh_movetousr` moves them after `dh_installmodules` has run. Virtual packages provided: `linux-image`, `linux-image-arm64` @@ -409,7 +414,8 @@ packages have been staged. The script: On failure: prints `make.log` tail (compile error) or `BUILD_EXCLUSIVE` gate analysis (skip), then hard-fails — a manifest entry is a presence contract. 6. For each produced `.ko`: collision-checks against already-bundled and in-tree - modules; installs to `lib/modules//extra/`; extracts debug symbols via + modules; installs to `lib/modules//extra/` in the staging tree (shipped + as `/usr/lib/modules//extra/`); extracts debug symbols via `objcopy --only-keep-debug` into the `-dbg` package; strips with `strip --strip-debug` (required for kernel modules — a full strip drops the symtab and relocations needed by the module loader). @@ -459,7 +465,7 @@ and all available options (`--arch`, `--objcopy`, `--modules-manifest`). ## The `build` and `source` symlinks -`/lib/modules//build` and `/lib/modules//source` are symlinks +`/usr/lib/modules//build` and `/usr/lib/modules//source` are symlinks pointing to `/usr/src/linux-headers-/`. These are used by: - `make -C /lib/modules/$(uname -r)/build` — standard out-of-tree module build - DKMS — automatic module rebuild on kernel update diff --git a/debian/control.in b/debian/control.in index 6c5050bb..a2d2ff34 100644 --- a/debian/control.in +++ b/debian/control.in @@ -4,6 +4,7 @@ Priority: optional Maintainer: Bjordis Collaku Standards-Version: 4.6.2 Build-Depends: debhelper-compat (= 13), + debhelper (>= 13.11.9~), bc, bison, flex, libssl-dev, libelf-dev, dwarves, python3, kmod, cpio, rsync, pkg-config, gcc, make@DKMS_BUILD_DEPENDS@ Homepage: https://kernel.org @@ -22,7 +23,7 @@ Description: Qualcomm ARM64 Linux kernel image @KVER@ Files installed: - /boot/vmlinuz-@KVER@ - /boot/config-@KVER@ - - /lib/modules/@KVER@/ + - /usr/lib/modules/@KVER@/ - /usr/lib/linux-image-@KVER@/ (DTBs) - /usr/lib/firmware/@KVER@/device-tree (Ubuntu flash-kernel symlink) @@ -43,7 +44,7 @@ Description: Qualcomm ARM64 Linux kernel headers @KVER@ kernel release @KVER@. . Headers are installed under /usr/src/linux-headers-@KVER@/ and the - /lib/modules/@KVER@/build symlink is pointed there. + /usr/lib/modules/@KVER@/build symlink is pointed there. Package: @HDRPKG@ Architecture: arm64 diff --git a/debian/rules b/debian/rules index 37405e8a..26da506a 100755 --- a/debian/rules +++ b/debian/rules @@ -426,7 +426,8 @@ override_dh_auto_install: cp -a -T "$$IMG_PATH" "$$PKG/boot/vmlinuz-$$BASE"; \ cp -a -T "$$CFG_PATH" "$$PKG/boot/config-$$BASE"; \ \ - # Modules (stripped) + # Modules (stripped). kbuild installs them under lib/modules/ in the staging + # tree; execute_after_dh_installdeb moves them to /usr/lib/modules/. $(MAKE) $(KBUILD_O_ARG) ARCH=$(ARCH) modules_install \ INSTALL_MOD_PATH=$$PKG INSTALL_MOD_STRIP=1; \ \ @@ -564,6 +565,23 @@ override_dh_installdeb: dh_installmodules; \ dh_installdeb +# Move everything staged under the aliased /bin, /lib and /sbin directories +# into /usr, as Debian Policy 10.1 requires on merged-/usr systems: the +# modules and their build/source links from modules_install, and the bundled +# DKMS modules. kbuild hardcodes MODLIB to $(INSTALL_MOD_PATH)/lib/modules, so +# the modules are installed there and moved afterwards, the same way Debian's +# own linux package does it. dh_movetousr also rewrites the build/source links +# into the form Policy 10.5 requires. +# +# This must run after override_dh_installdeb rather than earlier in the +# sequence. dh_installmodules, which that override calls, only looks under +# lib/modules/ when deciding whether to add the depmod maintainer script +# snippet, so moving the modules first would silently drop it. The +# dh-sequence-movetousr addon runs the helper before dh_installdeb, which is +# still before that call, hence the explicit hook. +execute_after_dh_installdeb: + dh_movetousr + override_dh_auto_test: @echo "Skipping dh_auto_test (no kernel test suite)."