[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Ybu30C6Nc7Mbo8MQ@casper.infradead.org>
Date: Thu, 16 Dec 2021 22:04:00 +0000
From: Matthew Wilcox <willy@...radead.org>
To: Masahiro Yamada <masahiroy@...nel.org>
Cc: Ard Biesheuvel <ardb@...nel.org>,
Michal Marek <michal.lkml@...kovi.net>,
Nick Desaulniers <ndesaulniers@...gle.com>,
Linux Kbuild mailing list <linux-kbuild@...r.kernel.org>,
Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
efi@...ts.einval.com,
debian-kernel <debian-kernel@...ts.debian.org>,
linux-efi <linux-efi@...r.kernel.org>,
Ben Hutchings <ben@...adent.org.uk>
Subject: Re: [PATCH] builddeb: Support signing kernels with a Machine Owner
Key
On Thu, Nov 04, 2021 at 06:28:40PM +0900, Masahiro Yamada wrote:
> On Thu, Oct 14, 2021 at 6:47 PM Ard Biesheuvel <ardb@...nel.org> wrote:
> >
> > On Wed, 13 Oct 2021 at 22:07, Matthew Wilcox (Oracle)
> > <willy@...radead.org> wrote:
> > >
> > > If the config file specifies a signing key, use it to sign
> > > the kernel so that machines with SecureBoot enabled can boot.
> > > See https://wiki.debian.org/SecureBoot
> > >
> > > Signed-off-by: Matthew Wilcox (Oracle) <willy@...radead.org>
> >
> > For the change itself
> >
> > Acked-by: Ard Biesheuvel <ardb@...nel.org>
> >
> > although I'd suggest to fix the subject not to refer to Machine Owner
> > Keys, as I don't see anything shim related here (i.e., if you sign
> > using a key that is listed in db, it should also work)
> >
> >
> > > ---
> > > scripts/package/builddeb | 10 +++++++++-
> > > 1 file changed, 9 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/scripts/package/builddeb b/scripts/package/builddeb
> > > index 91a502bb97e8..4fa6ff2b5cac 100755
> > > --- a/scripts/package/builddeb
> > > +++ b/scripts/package/builddeb
> > > @@ -147,7 +147,15 @@ else
> > > cp System.map "$tmpdir/boot/System.map-$version"
> > > cp $KCONFIG_CONFIG "$tmpdir/boot/config-$version"
> > > fi
> > > -cp "$($MAKE -s -f $srctree/Makefile image_name)" "$tmpdir/$installed_image_path"
> > > +
> > > +vmlinux=$($MAKE -s -f $srctree/Makefile image_name)
> > > +if is_enabled CONFIG_MODULE_SIG; then
> > > + cert=$srctree/$(grep ^CONFIG_MODULE_SIG_KEY= include/config/auto.conf | cut -d\" -f2)
> > > + key=${cert%pem}priv
> > > + sbsign --key $key --cert $cert "$vmlinux" --output "$tmpdir/$installed_image_path"
> > > +else
> > > + cp "$vmlinux" "$tmpdir/$installed_image_path"
> > > +fi
> > >
> > > if is_enabled CONFIG_OF_EARLY_FLATTREE; then
> > > # Only some architectures with OF support have this target
> > > --
> > > 2.32.0
> > >
>
> How to compile this patch?
>
> "make bindeb-pkg" fails with
> Can't load key from file './certs/signing_key.priv'
I'm sorry; I missed this email.
I don't know why you're seeing this error, exactly. I'm just trying to
automate the step here:
https://wiki.debian.org/SecureBoot#Using_your_key_to_sign_your_kernel
Have you followed the other steps on that page; ie do you have:
signing_key.priv, signing_key.der and signing_key.pem files?
>
> Also, sbsign emits "Invalid DOS header magic" error
> if CONFIG_EFI_STUB is not set.
>
> The CONFIG name might depend on arch.
> CONFIG_EFI for ARCH=arm64, but CONFIG_EFI_STUB for ARCH=x86.
>
>
> If you require sbsign, you need to update Build-Depends ?
It looks like we should add a few extra checks before running sbsign ...
> sh ./scripts/package/builddeb
> Can't load key from file './certs/signing_key.priv'
> 139999825022720:error:02001002:system library:fopen:No such file or
> directory:../crypto/bio/bss_file.c:69:fopen('./certs/signing_key.priv','r')
> 139999825022720:error:2006D080:BIO routines:BIO_new_file:no such
> file:../crypto/bio/bss_file.c:76:
> make[4]: *** [scripts/Makefile.package:87: intdeb-pkg] Error 1
> make[3]: *** [Makefile:1539: intdeb-pkg] Error 2
> make[2]: *** [debian/rules:13: binary-arch] Error 2
> dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2
> make[1]: *** [scripts/Makefile.package:83: bindeb-pkg] Error 2
> make: *** [Makefile:1539: bindeb-pkg] Error 2
Powered by blists - more mailing lists