linux-kernel - Re: [BUILD] Unable to sign drivers on Ubuntu 22.04 LTS desktop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 5 May 2023 22:07:39 +0200
From:   Mirsad Goran Todorovac <mirsad.goran.todorovac@....hr>
To:     Bagas Sanjaya <bagasdotme@...il.com>,
        Mirsad Goran Todorovac <mirsad.goran.todorovac@....hr>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Mark Rutland <mark.rutland@....com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Jiri Olsa <jolsa@...nel.org>,
        Namhyung Kim <namhyung@...nel.org>,
        Ian Rogers <irogers@...gle.com>,
        Adrian Hunter <adrian.hunter@...el.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Borislav Petkov <bp@...en8.de>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Linux x86 Architecture <x86@...nel.org>,
        "H. Peter Anvin" <hpa@...or.com>,
        Linux perf users <linux-perf-users@...r.kernel.org>,
        Linux Kernel Build System <linux-kbuild@...r.kernel.org>,
        Masahiro Yamada <masahiroy@...nel.org>
Subject: Re: [BUILD] Unable to sign drivers on Ubuntu 22.04 LTS desktop

On 05. 05. 2023. 15:46, Bagas Sanjaya wrote:

> On Thu, May 04, 2023 at 07:02:57PM +0200, Mirsad Goran Todorovac wrote:
>> Hi Bagas,
>>
>> I seem to have run into a dead end with this.
>>
>> OpenSSL 3.0.2 refuses to cooperate, despite enabling legacy ciphers:
>>
>>    BTF [M] net/nsh/nsh.ko
>>    BTF [M] net/hsr/hsr.ko
>> make -f ./Makefile ARCH=x86     KERNELRELEASE=6.3.0+ intdeb-pkg
>> sh ./scripts/package/builddeb
>>    INSTALL debian/linux-image/lib/modules/6.3.0+/kernel/arch/x86/events/intel/intel-cstate.ko
>>    SIGN debian/linux-image/lib/modules/6.3.0+/kernel/arch/x86/events/intel/intel-cstate.ko
>> At main.c:170:
>> - SSL error:1E08010C:DECODER routines::unsupported:
>> ../crypto/encode_decode/decoder_lib.c:101
> I didn't find any errors using self-compiled OpenSSL 3.1.0. I installed the
> library to `/tmp/openssl` and specify
> `KCFLAGS=-L/tmp/openssl/lib -I/tmp/openssl/include` when building bindeb-pkgs.
> Am I missing something?

Dear Mr. Bagas,

I have mistakenly deleted the

CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"

to

CONFIG_MODULE_SIG_KEY=""

so I got these strange errors, which made me believe that OpenSSL 3.0.1 
disabled some encryptions and hashes.

I suspected it was the problem with the FIPS mode not installed in the 
stock Ubuntu 22.04 LTS library, but I have to admit before so many 
people that it was this stupid mistake which I found out by looking up 
Debian config.

IOW, false alarm.

Ubuntu config with FIPS mode OpenSSL 3.1.0 works, however, I have 
rebuilt with the default OpenSSL 3.0.1 and the error was bisected to the 
missing .PEM.

Best regards,
Mirsad