linux-kernel - [PATCH v6 2/4] certs: Check whether openssl tool is available

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210610125623.1553792-3-stefanb@linux.ibm.com>
Date:   Thu, 10 Jun 2021 08:56:21 -0400
From:   Stefan Berger <stefanb@...ux.ibm.com>
To:     jeyu@...nel.org, keyrings@...r.kernel.org, dhowells@...hat.com,
        dwmw2@...radead.org, zohar@...ux.ibm.com, jarkko@...nel.org
Cc:     nayna@...ux.ibm.com, linux-integrity@...r.kernel.org,
        linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Stefan Berger <stefanb@...ux.ibm.com>,
        kernel test robot <lkp@...el.com>
Subject: [PATCH v6 2/4] certs: Check whether openssl tool is available

To avoid a good key from being removed because the openssl tool is
not installed and 'openssl x509' is not returning the expected result,
run the openssl tool commands only if the openssl tool is available.

Fixes: 	ec739868f340 ("certs: Trigger creation of RSA module signing key if it's not an RSA key")
Signed-off-by: Stefan Berger <stefanb@...ux.ibm.com>
Reported-by: kernel test robot <lkp@...el.com>
---
 certs/Makefile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/certs/Makefile b/certs/Makefile
index e6f97c64aa99..72758684d254 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -57,15 +57,18 @@ endif
 redirect_openssl	= 2>&1
 quiet_redirect_openssl	= 2>&1
 silent_redirect_openssl = 2>/dev/null
+openssl_available       = $(shell openssl help 2>/dev/null && echo yes)
 
 # We do it this way rather than having a boolean option for enabling an
 # external private key, because 'make randconfig' might enable such a
 # boolean option and we unfortunately can't make it depend on !RANDCONFIG.
 ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem")
 
+ifeq ($(openssl_available),yes)
 X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text)
 
 $(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY)))
+endif
 
 $(obj)/signing_key.pem: $(obj)/x509.genkey
 	@$(kecho) "###"
-- 
2.29.2