|
 |
6e2d2c5 |
From f1fa90d02f50078a89da602d73dc9ab7743439ba Mon Sep 17 00:00:00 2001
|
|
|
f0f4ff2 |
From: Josh Boyer <jwboyer@redhat.com>
|
|
|
f0f4ff2 |
Date: Mon, 24 Sep 2012 10:46:36 -0400
|
|
 |
be7ac52 |
Subject: [PATCH 2/2] MODSIGN: Add modules_sign make target
|
|
|
f0f4ff2 |
|
|
|
f0f4ff2 |
If CONFIG_MODULE_SIG is set, and 'make modules_sign' is called then this
|
|
|
f0f4ff2 |
patch will cause the modules to get a signature installed. The make target
|
|
|
f0f4ff2 |
is intended to be run after 'make modules_install', and will modify the
|
|
|
f0f4ff2 |
modules in-place in the installed location.
|
|
|
f0f4ff2 |
|
|
|
f0f4ff2 |
The signature will be appended to the module, along with some information
|
|
|
f0f4ff2 |
about the signature size and a magic string that indicates the presence of
|
|
|
f0f4ff2 |
the signature. This requires private and public keys to be available. By
|
|
|
f0f4ff2 |
default these are expected to be found in files:
|
|
|
f0f4ff2 |
|
|
|
f0f4ff2 |
signing_key.priv
|
|
|
f0f4ff2 |
signing_key.x509
|
|
|
f0f4ff2 |
|
|
|
f0f4ff2 |
in the base directory of the build. The first is the private key in PEM
|
|
|
f0f4ff2 |
form and the second is the X.509 certificate in DER form as can be generated
|
|
|
f0f4ff2 |
from openssl:
|
|
|
f0f4ff2 |
|
|
|
f0f4ff2 |
openssl req \
|
|
|
f0f4ff2 |
-new -x509 -outform PEM -out signing_key.x509 \
|
|
|
f0f4ff2 |
-keyout signing_key.priv -nodes \
|
|
|
f0f4ff2 |
-subj "/CN=H2G2/O=Magrathea/CN=Slartibartfast"
|
|
|
f0f4ff2 |
|
|
|
f0f4ff2 |
If the secret key is not found then signing will be skipped and the unsigned
|
|
|
f0f4ff2 |
module from (1) will just be copied to foo.ko.
|
|
|
f0f4ff2 |
|
|
|
f0f4ff2 |
If signing occurs, lines like the following will be seen:
|
|
|
f0f4ff2 |
|
|
|
f0f4ff2 |
SIGN [M] <install path>/fs/foo/foo.ko
|
|
|
f0f4ff2 |
|
|
|
f0f4ff2 |
will appear in the build log. If the signature step will be skipped and the
|
|
|
f0f4ff2 |
following will be seen:
|
|
|
f0f4ff2 |
|
|
|
f0f4ff2 |
NO SIGN [M] <install path>/fs/foo/foo.ko
|
|
|
f0f4ff2 |
|
|
|
f0f4ff2 |
NOTE! After the signature step, the signed module must not be passed through
|
|
|
f0f4ff2 |
strip. If you wish to strip or otherwise modify the kernel modules, use the
|
|
|
f0f4ff2 |
built-in stripping capabilities with 'make modules_install' or perform said
|
|
|
f0f4ff2 |
modifications before calling this make target. This restriction may affect
|
|
|
f0f4ff2 |
packaging tools (such as rpmbuild) and initramfs composition tools.
|
|
|
f0f4ff2 |
|
|
|
f0f4ff2 |
Based heavily on work by: David Howells <dhowells@redhat.com>
|
|
|
f0f4ff2 |
Signed-off-by: Josh Boyer <jwboyer@redhat.com>
|
|
|
f0f4ff2 |
---
|
|
|
6e2d2c5 |
Makefile | 6 ++++++
|
|
|
6e2d2c5 |
scripts/Makefile.modsign | 32 ++++++++++++++++++++++++++++++++
|
|
|
6e2d2c5 |
2 files changed, 38 insertions(+)
|
|
|
f0f4ff2 |
create mode 100644 scripts/Makefile.modsign
|
|
|
f0f4ff2 |
|
|
|
f0f4ff2 |
diff --git a/Makefile b/Makefile
|
|
|
6e2d2c5 |
index 89a2e2c..ac04c11 100644
|
|
|
f0f4ff2 |
--- a/Makefile
|
|
|
f0f4ff2 |
+++ b/Makefile
|
|
|
6e2d2c5 |
@@ -981,6 +981,12 @@ _modinst_post: _modinst_
|
|
|
f0f4ff2 |
$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.fwinst obj=firmware __fw_modinst
|
|
|
f0f4ff2 |
$(call cmd,depmod)
|
|
|
f0f4ff2 |
|
|
|
f0f4ff2 |
+ifeq ($(CONFIG_MODULE_SIG), y)
|
|
|
f0f4ff2 |
+PHONY += modules_sign
|
|
|
f0f4ff2 |
+modules_sign:
|
|
|
f0f4ff2 |
+ $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modsign
|
|
|
f0f4ff2 |
+endif
|
|
|
f0f4ff2 |
+
|
|
|
f0f4ff2 |
else # CONFIG_MODULES
|
|
|
f0f4ff2 |
|
|
|
f0f4ff2 |
# Modules not configured
|
|
|
f0f4ff2 |
diff --git a/scripts/Makefile.modsign b/scripts/Makefile.modsign
|
|
|
f0f4ff2 |
new file mode 100644
|
|
|
6e2d2c5 |
index 0000000..670d5dc
|
|
|
f0f4ff2 |
--- /dev/null
|
|
|
f0f4ff2 |
+++ b/scripts/Makefile.modsign
|
|
|
6e2d2c5 |
@@ -0,0 +1,32 @@
|
|
|
f0f4ff2 |
+# ==========================================================================
|
|
|
f0f4ff2 |
+# Signing modules
|
|
|
f0f4ff2 |
+# ==========================================================================
|
|
|
f0f4ff2 |
+
|
|
|
f0f4ff2 |
+PHONY := __modsign
|
|
|
f0f4ff2 |
+__modsign:
|
|
|
f0f4ff2 |
+
|
|
|
f0f4ff2 |
+include scripts/Kbuild.include
|
|
|
f0f4ff2 |
+
|
|
|
f0f4ff2 |
+__modules := $(sort $(shell grep -h '\.ko' /dev/null $(wildcard $(MODVERDIR)/*.mod)))
|
|
|
f0f4ff2 |
+modules := $(patsubst %.o,%.ko,$(wildcard $(__modules:.ko=.o)))
|
|
|
f0f4ff2 |
+
|
|
|
f0f4ff2 |
+PHONY += $(modules)
|
|
|
f0f4ff2 |
+__modsign: $(modules)
|
|
|
f0f4ff2 |
+ @:
|
|
|
f0f4ff2 |
+
|
|
|
f0f4ff2 |
+quiet_cmd_sign_ko = SIGN [M] $(2)/$(notdir $@)
|
|
|
6e2d2c5 |
+ cmd_sign_ko = $(mod_sign_cmd) $(2)/$(notdir $@)
|
|
|
f0f4ff2 |
+
|
|
|
f0f4ff2 |
+# Modules built outside the kernel source tree go into extra by default
|
|
|
f0f4ff2 |
+INSTALL_MOD_DIR ?= extra
|
|
|
f0f4ff2 |
+ext-mod-dir = $(INSTALL_MOD_DIR)$(subst $(patsubst %/,%,$(KBUILD_EXTMOD)),,$(@D))
|
|
|
f0f4ff2 |
+
|
|
|
f0f4ff2 |
+modinst_dir = $(if $(KBUILD_EXTMOD),$(ext-mod-dir),kernel/$(@D))
|
|
|
f0f4ff2 |
+
|
|
|
6e2d2c5 |
+$(modules):
|
|
|
f0f4ff2 |
+ $(call cmd,sign_ko,$(MODLIB)/$(modinst_dir))
|
|
|
f0f4ff2 |
+
|
|
|
f0f4ff2 |
+# Declare the contents of the .PHONY variable as phony. We keep that
|
|
|
f0f4ff2 |
+# # information in a variable se we can use it in if_changed and friends.
|
|
|
f0f4ff2 |
+
|
|
|
f0f4ff2 |
+.PHONY: $(PHONY)
|
|
|
f0f4ff2 |
--
|
|
|
6e2d2c5 |
1.7.11.7
|
|
|
20accb4 |
|