linux-kernel - Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures [ver #7a]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LRH.2.20.1508121921190.13410@namei.org>
Date:	Wed, 12 Aug 2015 19:27:24 +1000 (AEST)
From:	James Morris <jmorris@...ei.org>
To:	David Woodhouse <dwmw2@...radead.org>
cc:	David Howells <dhowells@...hat.com>, mcgrof@...il.com,
	zohar@...ux.vnet.ibm.com, linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org
Subject: Re: [GIT PULL] MODSIGN: Use PKCS#7 for module signatures [ver #7a]

On Wed, 12 Aug 2015, David Woodhouse wrote:

> On Wed, 2015-08-12 at 19:08 +1000, James Morris wrote:
> > 
> >   CHK     include/generated/compile.h
> >   EXTRACT_CERTS   signing_key.pem
> > At main.c:146:
> > - SSL error:02001002:system library:fopen:No such file or directory: 
> > bss_file.c:169
> > - SSL error:2006D080:BIO routines:BIO_new_file:no such file: 
> > bss_file.c:172
> > extract-cert: signing_key.pem: No such file or directory
> > rm: cannot remove `signing_key.x509': No such file or directory
> > make[1]: *** [signing_key.x509] Error 1
> > make: *** [kernel] Error 2
> 
> Hm, but that ought to have a dependency on signing_key.pem.
> 
> What is CONFIG_MODULE_SIG_KEY? Its default value of 'signing_key.pem'?
> That should mean that the rule in kernel/Makefile to create the signing
> key does exist.

Yep:

# CONFIG_MODULE_SIG_SHA512 is not set
CONFIG_MODULE_SIG_HASH="sha1"
CONFIG_MODULE_SIG_KEY="signing_key.pem"
# CONFIG_MODULE_COMPRESS is not set

> 
> At the very end of kernel/Makefile, in the rule for signing_key.x509,
> please could you add an 'echo $(X509_DEP)' before the call to
> extract_certs? That ought to be correctly depending on the
> signing_key.pem file.

$ make
  CHK     include/config/kernel.release
  CHK     include/generated/uapi/linux/version.h
  CHK     include/generated/utsrelease.h
  CHK     include/generated/bounds.h
  CHK     include/generated/timeconst.h
  CHK     include/generated/asm-offsets.h
  CALL    scripts/checksyscalls.sh
  CHK     include/generated/compile.h
echo 

  EXTRACT_CERTS   signing_key.pem

i.e. nothing.

> 
> There's magic here to work out the precise dependency, since it might
> be a filename relative to either the build tree or the source tree.
> I'll take another look and work out how it copes in the case where the
> file doesn't exist yet... is this an out-of-tree build?
> 

Nope, but try a make mrproper first (as I have) and see if you get the 
same result.

-- 
James Morris
<jmorris@...ei.org>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/