linux-kernel - [PATCH] MODSIGN: Only sign modules if built in-tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20121031132749.GH6627@hansolo.jdub.homelinux.org>
Date:	Wed, 31 Oct 2012 09:27:50 -0400
From:	Josh Boyer <jwboyer@...hat.com>
To:	Rusty Russell <rusty@...tcorp.com.au>
Cc:	Bruno Wolff III <bruno@...ff.to>, dhowells@...hat.com,
	linux-kernel@...r.kernel.org
Subject: [PATCH] MODSIGN: Only sign modules if built in-tree

When building out-of-tree modules, the current modules_install target
will attempt to sign them if module signing is enabled.  This will only
work if the signing keys are present in the build tree.  That will
often not be the case for modules that are built out-of-tree against
distribution kernel development packages.  This distros will not include
the signing keys, and build errors such as:

    INSTALL /home/bruno/rpmbuild/BUILD/dahdi-linux-2.6.1/drivers/dahdi/dahdi_dyamic_eth.ko
    Can't read private key
    make[2]: *** [/home/bruno/rpmbuild/BUILD/dahdi-linux-2.6.1/drivers/dahdi/dahdi_dynamic.ko] Error 2

will prevent such modules from successfully being installed.  This changes
the mod_sign_cmd to only sign the modules if they are built in-tree.  Those
built externally can sign them manually.

Reported-by: Bruno Wolff III <bruno@...ff.to>
Signed-off-by: Josh Boyer <jwboyer@...hat.com>
---
 Makefile | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Makefile b/Makefile
index 42d0e56..3d10a87 100644
--- a/Makefile
+++ b/Makefile
@@ -720,6 +720,7 @@ export mod_strip_cmd
 
 
 ifeq ($(CONFIG_MODULE_SIG),y)
+ifeq ($(KBUILD_EXTMOD),)
 MODSECKEY = ./signing_key.priv
 MODPUBKEY = ./signing_key.x509
 export MODPUBKEY
@@ -727,6 +728,9 @@ mod_sign_cmd = perl $(srctree)/scripts/sign-file $(MODSECKEY) $(MODPUBKEY)
 else
 mod_sign_cmd = true
 endif
+else
+mod_sign_cmd = true
+endif
 export mod_sign_cmd
 
 
-- 
1.7.12.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/