linux-kernel - Re: [PATCH] MODSIGN: Change default key details [ver #2]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 5 May 2015 07:43:03 -0700
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	David Howells <dhowells@...hat.com>
Cc:	Abelardo Ricart III <aricart@...nix.com>,
	Michal Marek <mmarek@...e.cz>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Sedat Dilek <sedat.dilek@...il.com>, keyrings@...ux-nfs.org,
	Rusty Russell <rusty@...tcorp.com.au>,
	LSM List <linux-security-module@...r.kernel.org>,
	James Morris <james.l.morris@...cle.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: [PATCH] MODSIGN: Change default key details [ver #2]

On Tue, May 5, 2015 at 7:33 AM, David Howells <dhowells@...hat.com> wrote:
> Linus Torvalds <torvalds@...ux-foundation.org> wrote:
>
>> +define filechk_x509_list
>> +     echo $(X509_CERTIFICATES)
>> +endef
>>  targets += $(obj)/.x509.list
>> -$(obj)/.x509.list:
>> -     @echo $(X509_CERTIFICATES) >$@
>> +$(obj)/.x509.list: Makefile FORCE
>> +     $(call filechk,x509_list)
>
> How does that actually work?

So the Makefile dependency is entirely fake, it's just that the
"filechk" macro wants to have an input. The FORCE means that it ends
up being done every time, regardless of whether the Makefile has
changed or not.

See scripts/Kbuild.include for details on the "filechk" macro, bit it
basically takes another make macro (called "filechk_xyz"), runs that
macro as a shell script and outputs it to a temporary file:

        $(filechk_$(1)) < $< > $@...p;

(that "$<" is also why the rule wants a some input, in our case
"Makefile"). It then does a move-if-changed of the temporary file to
the target.

So the end result is that we run that "filechk_x509_list" script,
compare the output to the old target, and update the target iff it is
different. That would seem to be exactly what we want.

That said, as mentioned, the whole "X509_CERTIFICATES" thing is
unstable, and ends up being "./signing_key.x509" or "signing_key.x509"
depending on whether that file existed or not. That needs fixing, so
that we get stable output. So some filtering required.

                      Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/