linux-kernel - [PATCH 2/3 v2] KEYS: Insert incompressible bytes to vmlinux to reserve space in bzImage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1466635053-30512-3-git-send-email-mkayaalp@linux.vnet.ibm.com>
Date:	Wed, 22 Jun 2016 18:37:32 -0400
From:	Mehmet Kayaalp <mkayaalp@...ux.vnet.ibm.com>
To:	David Howells <dhowells@...hat.com>, linux-kernel@...r.kernel.org,
	linux-security-module@...r.kernel.org,
	linux-ima-devel@...ts.sourceforge.net, keyrings@...r.kernel.org
Cc:	Mimi Zohar <zohar@...ux.vnet.ibm.com>,
	George Wilson <gcwilson@...ibm.com>,
	Stefan Berger <stefanb@...ux.vnet.ibm.com>,
	Mehmet Kayaalp <mkayaalp@...ux.vnet.ibm.com>
Subject: [PATCH 2/3 v2] KEYS: Insert incompressible bytes to vmlinux to reserve space in bzImage

Call insert-sys-cert script with null file to ensure that random bytes are
inserted to the space reserved with CONFIG_SYSTEM_EXTRA_CERTIFICATE, before
compressing the vmlinux. This results in an uncompressed reserved area
inside the bzImage as well, so that it can be replaced with an actual
certificate later (after the bzImage is distributed).

Cross compilation is not supported yet.

Signed-off-by: Mehmet Kayaalp <mkayaalp@...ux.vnet.ibm.com>
Tested-by: Stefan Berger <stefanb@...ux.vnet.ibm.com>
Acked-by: Mimi Zohar <zohar@...ux.vnet.ibm.com>
---
 arch/x86/boot/compressed/Makefile | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index f135688..5b15e56 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -88,8 +88,16 @@ vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_thunk_$(BITS).o
 $(obj)/vmlinux: $(vmlinux-objs-y) FORCE
 	$(call if_changed,ld)
 
+quiet_cmd_inscert = INSCERT /dev/null to $<
+      cmd_inscert = scripts/insert-sys-cert -b $< -c /dev/null > /dev/null
+
 OBJCOPYFLAGS_vmlinux.bin :=  -R .comment -S
 $(obj)/vmlinux.bin: vmlinux FORCE
+ifndef CROSS_COMPILE
+ifeq ("$(CONFIG_SYSTEM_EXTRA_CERTIFICATE)", "y")
+	$(call if_changed,inscert)
+endif
+endif
 	$(call if_changed,objcopy)
 
 targets += $(patsubst $(obj)/%,%,$(vmlinux-objs-y)) vmlinux.bin.all vmlinux.relocs
-- 
2.7.4