linux-kernel - Re: [PATCH] kbuild: If the module stripping command fails the build should abort

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 15 Mar 2019 08:19:24 -0700
From:   Doug Anderson <dianders@...omium.org>
To:     Masahiro Yamada <yamada.masahiro@...ionext.com>
Cc:     Michal Marek <michal.lkml@...kovi.net>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Linux Kbuild mailing list <linux-kbuild@...r.kernel.org>
Subject: Re: [PATCH] kbuild: If the module stripping command fails the build
 should abort

Hi,

On Fri, Mar 15, 2019 at 7:11 AM Masahiro Yamada
<yamada.masahiro@...ionext.com> wrote:
>
> On Fri, Mar 15, 2019 at 2:59 AM Douglas Anderson <dianders@...omium.org> wrote:
> >
> > If the call to strip returns an error code then it makes sense for the
> > build to fail.  Currently we'll just chug along and ship unstripped
> > modules.
> >
> > Fixes: e2a666d52b48 ("kbuild: sign the modules at install time")
> > Signed-off-by: Douglas Anderson <dianders@...omium.org>
>
>
> Did you see this problem in the latest kernel?
>
> Since commit q,
> $(call cmd,...) is run with 'set -e'.
>
> Any failure in a series of commands will let the build fail.
>
>
> If you have the problem in old versions ( < 4.20),

Ah!  I was in 4.19 when I saw the problem.  I then confirmed that the
code in mainline was the same and that the new version built fine with
my patch, but I didn't go back and confirm the problem there.

OK, I just checked linux/master and can confirm there's no problem
there.  Sorry for the noise then...

I wonder if perhaps we should revert commit caf6fe91ddf6 ("modsign:
Abort modules_install when signing fails") then to be consistent?

> I do not mind this patch for linux-stable.

It's probably not worth it.  In general I prefer linux-stable to be as
just cherry-picks of mainline as much as possible.  When it starts
forking then future picks get harder.  Sure in this case it's unlikely
that someone will get tripped up by an "&&" vs a ";" when picking
future changes, but given that it's not super urgent I guess I'd vote
that we skip it.

-Doug
-Doug