linux-kernel - [PATCH 1/2] certs: Trigger recreation of module signing key if it's not an RSA key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210406185340.1079403-2-stefanb@linux.ibm.com>
Date:   Tue,  6 Apr 2021 14:53:39 -0400
From:   Stefan Berger <stefanb@...ux.ibm.com>
To:     keyrings@...r.kernel.org, dhowells@...hat.com, zohar@...ux.ibm.com,
        jarkko@...nel.org
Cc:     nayna@...ux.ibm.com, linux-integrity@...r.kernel.org,
        linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org, Stefan Berger <stefanb@...ux.ibm.com>
Subject: [PATCH 1/2] certs: Trigger recreation of module signing key if it's not an RSA key

Make sure that the kernel module signing key is an RSA key and
remove it otherwise so that it gets recreated.

Prevent module loading failures if a developer chose an ECDSA key for
module signing with a 5.12 kernel and then falls back to compiling an
older kernel. However, this will also only work if falling back to
kernels that have actually been patched with this kernel, such as the
stable trees.

Fixes: cfc411e7fff3 ("Move certificate handling to its own directory")
Signed-off-by: Stefan Berger <stefanb@...ux.ibm.com>
---
 certs/Makefile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/certs/Makefile b/certs/Makefile
index e3185c57fbd8..f64bc89ccbf1 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -59,6 +59,11 @@ silent_redirect_openssl = 2>/dev/null
 # external private key, because 'make randconfig' might enable such a
 # boolean option and we unfortunately can't make it depend on !RANDCONFIG.
 ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem")
+
+X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text)
+
+$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY)))
+
 $(obj)/signing_key.pem: $(obj)/x509.genkey
 	@$(kecho) "###"
 	@$(kecho) "### Now generating an X.509 key pair to be used for signing modules."
-- 
2.29.2