linux-kernel - Re: [PATCH] builddeb: Support signing kernels with a Machine Owner Key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAK7LNASfr4pxmXWO8WLPM4j1NiJ6+dAO_QyUmRREzJUXJNozFw@mail.gmail.com>
Date:   Thu, 4 Nov 2021 18:28:40 +0900
From:   Masahiro Yamada <masahiroy@...nel.org>
To:     Ard Biesheuvel <ardb@...nel.org>
Cc:     "Matthew Wilcox (Oracle)" <willy@...radead.org>,
        Michal Marek <michal.lkml@...kovi.net>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Linux Kbuild mailing list <linux-kbuild@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        efi@...ts.einval.com,
        debian-kernel <debian-kernel@...ts.debian.org>,
        linux-efi <linux-efi@...r.kernel.org>,
        Ben Hutchings <ben@...adent.org.uk>
Subject: Re: [PATCH] builddeb: Support signing kernels with a Machine Owner Key

On Thu, Oct 14, 2021 at 6:47 PM Ard Biesheuvel <ardb@...nel.org> wrote:
>
> On Wed, 13 Oct 2021 at 22:07, Matthew Wilcox (Oracle)
> <willy@...radead.org> wrote:
> >
> > If the config file specifies a signing key, use it to sign
> > the kernel so that machines with SecureBoot enabled can boot.
> > See https://wiki.debian.org/SecureBoot
> >
> > Signed-off-by: Matthew Wilcox (Oracle) <willy@...radead.org>
>
> For the change itself
>
> Acked-by: Ard Biesheuvel <ardb@...nel.org>
>
> although I'd suggest to fix the subject not to refer to Machine Owner
> Keys, as I don't see anything shim related here (i.e., if you sign
> using a key that is listed in db, it should also work)
>
>
> > ---
> >  scripts/package/builddeb | 10 +++++++++-
> >  1 file changed, 9 insertions(+), 1 deletion(-)
> >
> > diff --git a/scripts/package/builddeb b/scripts/package/builddeb
> > index 91a502bb97e8..4fa6ff2b5cac 100755
> > --- a/scripts/package/builddeb
> > +++ b/scripts/package/builddeb
> > @@ -147,7 +147,15 @@ else
> >         cp System.map "$tmpdir/boot/System.map-$version"
> >         cp $KCONFIG_CONFIG "$tmpdir/boot/config-$version"
> >  fi
> > -cp "$($MAKE -s -f $srctree/Makefile image_name)" "$tmpdir/$installed_image_path"
> > +
> > +vmlinux=$($MAKE -s -f $srctree/Makefile image_name)
> > +if is_enabled CONFIG_MODULE_SIG; then
> > +       cert=$srctree/$(grep ^CONFIG_MODULE_SIG_KEY= include/config/auto.conf | cut -d\" -f2)
> > +       key=${cert%pem}priv
> > +       sbsign --key $key --cert $cert "$vmlinux" --output "$tmpdir/$installed_image_path"
> > +else
> > +       cp "$vmlinux" "$tmpdir/$installed_image_path"
> > +fi
> >
> >  if is_enabled CONFIG_OF_EARLY_FLATTREE; then
> >         # Only some architectures with OF support have this target
> > --
> > 2.32.0
> >

How to compile this patch?

"make  bindeb-pkg" fails with
Can't load key from file './certs/signing_key.priv'

Also, sbsign emits "Invalid DOS header magic" error
if CONFIG_EFI_STUB is not set.

The CONFIG name might depend on arch.
CONFIG_EFI for ARCH=arm64, but CONFIG_EFI_STUB for ARCH=x86.

If you require sbsign, you need to update Build-Depends ?

My build log:

masahiro@...ver:~/workspace/linux-kbuild$ make  bindeb-pkg -j8
sh ./scripts/package/mkdebian
dpkg-buildpackage -r"fakeroot -u" -a$(cat debian/arch)  -b -nc -uc
dpkg-buildpackage: info: source package linux-upstream
dpkg-buildpackage: info: source version 5.15.0-rc2+-1
dpkg-buildpackage: info: source distribution hirsute
dpkg-buildpackage: info: source changed by masahiro <masahiro@...ver>
dpkg-buildpackage: info: host architecture amd64
 dpkg-source --before-build .
 debian/rules binary
make KERNELRELEASE=5.15.0-rc2+ ARCH=x86 KBUILD_BUILD_VERSION=1 -f ./Makefile
  DESCEND objtool
  CALL    scripts/atomic/check-atomics.sh
  CALL    scripts/checksyscalls.sh
  CHK     include/generated/compile.h
Kernel: arch/x86/boot/bzImage is ready  (#1)
make KERNELRELEASE=5.15.0-rc2+ ARCH=x86 KBUILD_BUILD_VERSION=1 -f
./Makefile intdeb-pkg
sh ./scripts/package/builddeb
Can't load key from file './certs/signing_key.priv'
139999825022720:error:02001002:system library:fopen:No such file or
directory:../crypto/bio/bss_file.c:69:fopen('./certs/signing_key.priv','r')
139999825022720:error:2006D080:BIO routines:BIO_new_file:no such
file:../crypto/bio/bss_file.c:76:
make[4]: *** [scripts/Makefile.package:87: intdeb-pkg] Error 1
make[3]: *** [Makefile:1539: intdeb-pkg] Error 2
make[2]: *** [debian/rules:13: binary-arch] Error 2
dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2
make[1]: *** [scripts/Makefile.package:83: bindeb-pkg] Error 2
make: *** [Makefile:1539: bindeb-pkg] Error 2

CC'ed Ben in case he has more comments.

-- 
Best Regards
Masahiro Yamada