| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 7 Aug 2023 11:35:06 +0900
From: Masahiro Yamada <masahiroy@...nel.org>
To: Shreenidhi Shedi <yesshedi@...il.com>
Cc: dhowells@...hat.com, dwmw2@...radead.org,
gregkh@...uxfoundation.org, nathan@...nel.org,
ndesaulniers@...gle.com, nicolas@...sle.eu,
linux-kernel@...r.kernel.org, sshedi@...are.com
Subject: Re: [PATCH v7 2/8] sign-file: inntroduce few new flags to make
argument processing easy.
On Fri, Jun 23, 2023 at 11:54 PM Shreenidhi Shedi <yesshedi@...il.com> wrote:
>
> - Add some more options like help, x509, hashalgo to command line args
> - This makes it easy to handle and use command line args wherever needed
>
> Signed-off-by: Shreenidhi Shedi <yesshedi@...il.com>
> ---
> scripts/sign-file.c | 63 ++++++++++++++++++++++++++++++++-------------
> 1 file changed, 45 insertions(+), 18 deletions(-)
>
> diff --git a/scripts/sign-file.c b/scripts/sign-file.c
> index 94228865b6cc..b0f340ea629b 100644
> --- a/scripts/sign-file.c
> +++ b/scripts/sign-file.c
> @@ -215,6 +215,11 @@ static X509 *read_x509(const char *x509_name)
>
> struct cmd_opts {
> char *raw_sig_name;
> + char *hash_algo;
> + char *dest_name;
> + char *private_key_name;
> + char *x509_name;
> + char *module_name;
> bool save_sig;
> bool replace_orig;
> bool raw_sig;
> @@ -233,6 +238,12 @@ static void parse_args(int argc, char **argv, struct cmd_opts *opts)
> #ifndef USE_PKCS7
> {"usekeyid", no_argument, 0, 'k'},
> #endif
> + {"help", no_argument, 0, 'h'},
> + {"privkey", required_argument, 0, 'i'},
> + {"hashalgo", required_argument, 0, 'a'},
> + {"x509", required_argument, 0, 'x'},
> + {"dest", required_argument, 0, 'd'},
> + {"replaceorig", required_argument, 0, 'r'},
> {0, 0, 0, 0}
> };
>
> @@ -241,10 +252,10 @@ static void parse_args(int argc, char **argv, struct cmd_opts *opts)
>
> do {
> #ifndef USE_PKCS7
> - opt = getopt_long_only(argc, argv, "pds:",
> + opt = getopt_long_only(argc, argv, "hpds:i:a:x:t:r:",
> cmd_options, &opt_index);
> #else
> - opt = getopt_long_only(argc, argv, "pdks:",
> + opt = getopt_long_only(argc, argv, "hpdks:i:a:x:t:r:",
> cmd_options, &opt_index);
> #endif
> switch (opt) {
> @@ -268,6 +279,30 @@ static void parse_args(int argc, char **argv, struct cmd_opts *opts)
> break;
> #endif
>
> + case 'h':
> + format();
> + break;
> +
> + case 'i':
> + opts->private_key_name = optarg;
> + break;
> +
> + case 'a':
> + opts->hash_algo = optarg;
> + break;
> +
> + case 'x':
> + opts->x509_name = optarg;
> + break;
> +
> + case 't':
> + opts->dest_name = optarg;
> + break;
> +
> + case 'r':
> + opts->replace_orig = true;
> + break;
> +
> case -1:
> break;
>
> @@ -281,9 +316,6 @@ static void parse_args(int argc, char **argv, struct cmd_opts *opts)
> int main(int argc, char **argv)
> {
> struct module_signature sig_info = { .id_type = PKEY_ID_PKCS7 };
> - char *hash_algo = NULL;
> - char *private_key_name = NULL;
> - char *x509_name, *module_name, *dest_name;
> unsigned char buf[4096];
> unsigned long module_size, sig_size;
> unsigned int use_signed_attrs;
> @@ -315,32 +347,27 @@ int main(int argc, char **argv)
> argv += optind;
>
> const char *raw_sig_name = opts.raw_sig_name;
> + const char *hash_algo = opts.hash_algo;
> + const char *private_key_name = opts.private_key_name;
> + const char *x509_name = opts.x509_name;
> + const char *module_name = opts.module_name;
> const bool save_sig = opts.save_sig;
> const bool raw_sig = opts.raw_sig;
> const bool sign_only = opts.sign_only;
> bool replace_orig = opts.replace_orig;
> + char *dest_name = opts.dest_name;
> #ifndef USE_PKCS7
> const unsigned int use_keyid = opts.use_keyid;
> #endif
>
> - if (argc < 4 || argc > 5)
> + if (!argv[0] || argc != 1)
> format();
You are breaking the bisect'ability.
You are turning the positional parameters into options
but not adjusting scripts/Makefile.modinst in the same commit.
masahiro@...ar:~/ref/linux((HEAD detached at 41cb7c94595d))$ make
INSTALL_MOD_PATH=/tmp/modules modules_install
INSTALL /tmp/modules/lib/modules/6.5.0-rc4+/kernel/arch/x86/events/amd/power.ko
SIGN /tmp/modules/lib/modules/6.5.0-rc4+/kernel/arch/x86/events/amd/power.ko
Usage: scripts/sign-file [OPTIONS]... [MODULE]...
Available options:
-h, --help Print this help message and exit
Optional args:
-s, --rawsig <sig> Raw signature
-p, --savesig Save signature
-d, --signonly Sign only
-k, --usekeyid Use key ID
-b, --bulksign Sign modules in bulk
-r, --replaceorig Replace original
-t, --dest <dest> Destination path (Exclusive with bulk option)
Mandatory args:
-i, --privkey <key> Private key
-a, --hashalgo <alg> Hash algorithm
-x, --x509 <x509> X509
Examples:
Regular signing:
scripts/sign-file -a sha512 -i certs/signing_key.pem -x
certs/signing_key.x509 <module>
Signing with destination path:
scripts/sign-file -a sha512 -i certs/signing_key.pem -x
certs/signing_key.x509 <module> -t <path>
Signing modules in bulk:
scripts/sign-file -a sha512 -i certs/signing_key.pem -x
certs/signing_key.x509 -b <module1> <module2> ...
make[2]: *** [scripts/Makefile.modinst:87:
/tmp/modules/lib/modules/6.5.0-rc4+/kernel/arch/x86/events/amd/power.ko]
Error 2
make[2]: *** Deleting file
'/tmp/modules/lib/modules/6.5.0-rc4+/kernel/arch/x86/events/amd/power.ko'
make[1]: *** [/home/masahiro/ref/linux/Makefile:1964: modules_install] Error 2
make: *** [Makefile:234: __sub-make] Error 2
--
Best Regards
Masahiro Yamada
Powered by blists - more mailing lists