3ee550f12c
Since commit 1329e8cc69 ("modsign: Extract signing cert from
CONFIG_MODULE_SIG_KEY if needed"), the build system has carefully coped
with the signing key being specified as a relative path in either the
source or or the build trees.
However, the actual signing of modules has not worked if the filename
is relative to the source tree.
Fix that by moving the config_filename helper into scripts/Kbuild.include
so that it can be used from elsewhere, and then using it in the top-level
Makefile to find the signing key file.
Kill the intermediate $(MODPUBKEY) and $(MODSECKEY) variables too, while
we're at it. There's no need for them.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: David Howells <dhowells@redhat.com>
95 lines
3.6 KiB
Makefile
95 lines
3.6 KiB
Makefile
#
|
|
# Makefile for the linux kernel signature checking certificates.
|
|
#
|
|
|
|
obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o
|
|
|
|
ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y)
|
|
|
|
$(eval $(call config_filename,SYSTEM_TRUSTED_KEYS))
|
|
|
|
# GCC doesn't include .incbin files in -MD generated dependencies (PR#66871)
|
|
$(obj)/system_certificates.o: $(obj)/x509_certificate_list
|
|
|
|
# Cope with signing_key.x509 existing in $(srctree) not $(objtree)
|
|
AFLAGS_system_certificates.o := -I$(srctree)
|
|
|
|
quiet_cmd_extract_certs = EXTRACT_CERTS $(patsubst "%",%,$(2))
|
|
cmd_extract_certs = scripts/extract-cert $(2) $@ || ( rm $@; exit 1)
|
|
|
|
targets += x509_certificate_list
|
|
$(obj)/x509_certificate_list: scripts/extract-cert $(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(SYSTEM_TRUSTED_KEYS_FILENAME) FORCE
|
|
$(call if_changed,extract_certs,$(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(CONFIG_SYSTEM_TRUSTED_KEYS))
|
|
endif
|
|
|
|
clean-files := x509_certificate_list .x509.list
|
|
|
|
ifeq ($(CONFIG_MODULE_SIG),y)
|
|
###############################################################################
|
|
#
|
|
# If module signing is requested, say by allyesconfig, but a key has not been
|
|
# supplied, then one will need to be generated to make sure the build does not
|
|
# fail and that the kernel may be used afterwards.
|
|
#
|
|
###############################################################################
|
|
ifndef CONFIG_MODULE_SIG_HASH
|
|
$(error Could not determine digest type to use from kernel config)
|
|
endif
|
|
|
|
# We do it this way rather than having a boolean option for enabling an
|
|
# external private key, because 'make randconfig' might enable such a
|
|
# boolean option and we unfortunately can't make it depend on !RANDCONFIG.
|
|
ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem")
|
|
$(obj)/signing_key.pem: $(obj)/x509.genkey
|
|
@echo "###"
|
|
@echo "### Now generating an X.509 key pair to be used for signing modules."
|
|
@echo "###"
|
|
@echo "### If this takes a long time, you might wish to run rngd in the"
|
|
@echo "### background to keep the supply of entropy topped up. It"
|
|
@echo "### needs to be run as root, and uses a hardware random"
|
|
@echo "### number generator if one is available."
|
|
@echo "###"
|
|
openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
|
|
-batch -x509 -config $(obj)/x509.genkey \
|
|
-outform PEM -out $(obj)/signing_key.pem \
|
|
-keyout $(obj)/signing_key.pem 2>&1
|
|
@echo "###"
|
|
@echo "### Key pair generated."
|
|
@echo "###"
|
|
|
|
$(obj)/x509.genkey:
|
|
@echo Generating X.509 key generation config
|
|
@echo >$@ "[ req ]"
|
|
@echo >>$@ "default_bits = 4096"
|
|
@echo >>$@ "distinguished_name = req_distinguished_name"
|
|
@echo >>$@ "prompt = no"
|
|
@echo >>$@ "string_mask = utf8only"
|
|
@echo >>$@ "x509_extensions = myexts"
|
|
@echo >>$@
|
|
@echo >>$@ "[ req_distinguished_name ]"
|
|
@echo >>$@ "#O = Unspecified company"
|
|
@echo >>$@ "CN = Build time autogenerated kernel key"
|
|
@echo >>$@ "#emailAddress = unspecified.user@unspecified.company"
|
|
@echo >>$@
|
|
@echo >>$@ "[ myexts ]"
|
|
@echo >>$@ "basicConstraints=critical,CA:FALSE"
|
|
@echo >>$@ "keyUsage=digitalSignature"
|
|
@echo >>$@ "subjectKeyIdentifier=hash"
|
|
@echo >>$@ "authorityKeyIdentifier=keyid"
|
|
endif
|
|
|
|
$(eval $(call config_filename,MODULE_SIG_KEY))
|
|
|
|
# If CONFIG_MODULE_SIG_KEY isn't a PKCS#11 URI, depend on it
|
|
ifeq ($(patsubst pkcs11:%,%,$(firstword $(MODULE_SIG_KEY_FILENAME))),$(firstword $(MODULE_SIG_KEY_FILENAME)))
|
|
X509_DEP := $(MODULE_SIG_KEY_SRCPREFIX)$(MODULE_SIG_KEY_FILENAME)
|
|
endif
|
|
|
|
# GCC PR#66871 again.
|
|
$(obj)/system_certificates.o: $(obj)/signing_key.x509
|
|
|
|
targets += signing_key.x509
|
|
$(obj)/signing_key.x509: scripts/extract-cert $(X509_DEP) FORCE
|
|
$(call if_changed,extract_certs,$(MODULE_SIG_KEY_SRCPREFIX)$(CONFIG_MODULE_SIG_KEY))
|
|
endif
|