linux-kernel - Re: [PATCH 3/5] certs: remove noisy messages while generating the signing key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAK8P3a3YshR=gXWL1co0ZhAAV+7CymC437-=77rcgTQjPiDfQg@mail.gmail.com>
Date:   Fri, 5 Nov 2021 08:33:46 +0100
From:   Arnd Bergmann <arnd@...db.de>
To:     Masahiro Yamada <masahiroy@...nel.org>
Cc:     Jarkko Sakkinen <jarkko@...nel.org>,
        David Howells <dhowells@...hat.com>,
        David Woodhouse <dwmw2@...radead.org>,
        keyrings@...r.kernel.org, Arnd Bergmann <arnd@...db.de>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 3/5] certs: remove noisy messages while generating the
 signing key

On Fri, Nov 5, 2021 at 4:59 AM Masahiro Yamada <masahiroy@...nel.org> wrote:
>
> When you run Kbuild with the parallel option -j, the messages from this
> rule and others are interleaved, like follows:
>
>     ###
>       CC      arch/x86/mm/pat/set_memory.o
>     ### Now generating an X.509 key pair to be used for signing modules.
>     ###
>     ### If this takes a long time, you might wish to run rngd in the
>     ### background to keep the supply of entropy topped up.  It
>       CC      arch/x86/events/intel/bts.o
>       HDRTEST usr/include/linux/qnx4_fs.h
>       CC      arch/x86/events/zhaoxin/core.o
>     ### needs to be run as root, and uses a hardware random
>     ### number generator if one is available.
>       AR      init/built-in.a
>     ###
>
> On modern machines, it does not take a long time to generate the key.
>
> Remove the ugly log messages.

I have no real objection to this, but I would still point out that
the warning message may still be helpful for those building
in a virtual machine or some other environment without a hwrng,
and that most people wouldn't see the message anway if they
built with 'make -s', at least after my 5d06ee20b662 ("modsign:
hide openssl output in silent builds").

I wonder if it would be time to change the default output to
be more quiet, by degrading it one level, like

                    old           new
only warnings       make -s       make
CC file.o           make          make V=1
full cmdline        make V=1      make V=2

This would take some time to adjust to, but it does sound like
a more reasonable default. Does anyone still build without -s
in practice?

        Arnd