linux-kernel - Building signed debs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 8 Dec 2023 11:14:35 +0000
From:   Tom Cook <tom.k.cook@...il.com>
To:     LKML <linux-kernel@...r.kernel.org>
Subject: Building signed debs

I'm trying to build a signed .deb kernel package of
https://github.com/torvalds/linux/tree/v6.6.  I've copied
certs/default_x509.genkey to certs/x509.genkey.  The .config is the
one from Ubuntu 23.10's default kernel with all new options accepted
at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and
CONFIG_SYSTEM_REVOCATION_KEYS="".

This builds the kernel and modules, signs the modules, compresses the
modules and then attempts to sign the modules again.  That fails,
because the .ko module files are now .ko.zst files and the file it's
trying to sign isn't there.  Full failure is pasted below.

Unsetting CONFIG_MODULE_COMPRESS_ZSTD is a workaround (ie disable
module compression).

Is there a way to build a .deb of a signed kernel with compressed modules?

Thanks for any help,
Tom

  INSTALL debian/linux-libc-dev/usr/include
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or
directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or
directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko
make[6]: *** [scripts/Makefile.modinst:137:
debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko]
Error 1
make[6]: *** Waiting for unfinished jobs....
make[6]: *** [scripts/Makefile.modinst:137:
debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko]
Error 1
  SIGN    debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or
directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko
make[6]: *** [scripts/Makefile.modinst:137:
debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko]
Error 1
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or
directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko
make[6]: *** [scripts/Makefile.modinst:137:
debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko]
Error 1
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or
directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko
make[6]: *** [scripts/Makefile.modinst:137:
debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko]
Error 1
make[5]: *** [Makefile:1821: modules_install] Error 2
make[4]: *** [Makefile:2036: run-command] Error 2
make[3]: *** [debian/rules:17: binary-arch] Error 2
dpkg-buildpackage: error: make -f debian/rules binary subprocess
returned exit status 2
make[2]: *** [scripts/Makefile.package:146: bindeb-pkg] Error 2
make[1]: *** [/home/tkcook/git/linux/v6.6/Makefile:1538: bindeb-pkg] Error 2
make: *** [Makefile:234: __sub-make] Error 2