Unified · Split
| @@ -92,13 +92,13 @@ This has a number of options available: · 91 unmodified lines | |||
| 92 | (4) "File name or PKCS#11 URI of module signing key" (CONFIG_MODULE_SIG_KEY) | 92 | (4) "File name or PKCS#11 URI of module signing key" (CONFIG_MODULE_SIG_KEY) |
| 93 | 93 | ||
| 94 | Setting this option to something other than its default of | 94 | Setting this option to something other than its default of |
| 95 | "signing_key.pem" will disable the autogeneration of signing keys and | 95 | "certs/signing_key.pem" will disable the autogeneration of signing keys |
| 96 | allow the kernel modules to be signed with a key of your choosing. | 96 | and allow the kernel modules to be signed with a key of your choosing. |
| 97 | The string provided should identify a file containing both a private | 97 | The string provided should identify a file containing both a private key |
| 98 | key and its corresponding X.509 certificate in PEM form, or — on | 98 | and its corresponding X.509 certificate in PEM form, or — on systems where |
| 99 | systems where the OpenSSL ENGINE_pkcs11 is functional — a PKCS#11 URI | 99 | the OpenSSL ENGINE_pkcs11 is functional — a PKCS#11 URI as defined by |
| 100 | as defined by RFC7512. In the latter case, the PKCS#11 URI should | 100 | RFC7512. In the latter case, the PKCS#11 URI should reference both a |
| 101 | reference both a certificate and a private key. | 101 | certificate and a private key. |
| 102 | 102 | ||
| 103 | If the PEM file containing the private key is encrypted, or if the | 103 | If the PEM file containing the private key is encrypted, or if the |
| 104 | PKCS#11 token requries a PIN, this can be provided at build time by | 104 | PKCS#11 token requries a PIN, this can be provided at build time by |
| @@ -130,12 +130,12 @@ Under normal conditions, when CONFIG_MODULE_SIG_KEY is unchanged from its · 25 unmodified lines | |||
| 130 | default, the kernel build will automatically generate a new keypair using | 130 | default, the kernel build will automatically generate a new keypair using |
| 131 | openssl if one does not exist in the file: | 131 | openssl if one does not exist in the file: |
| 132 | 132 | ||
| 133 | signing_key.pem | 133 | certs/signing_key.pem |
| 134 | 134 | ||
| 135 | during the building of vmlinux (the public part of the key needs to be built | 135 | during the building of vmlinux (the public part of the key needs to be built |
| 136 | into vmlinux) using parameters in the: | 136 | into vmlinux) using parameters in the: |
| 137 | 137 | ||
| 138 | x509.genkey | 138 | certs/x509.genkey |
| 139 | 139 | ||
| 140 | file (which is also generated if it does not already exist). | 140 | file (which is also generated if it does not already exist). |
| 141 | 141 | ||
| @@ -2589,6 +2589,15 @@ S: Supported · 2588 unmodified lines | |||
| 2589 | F: Documentation/filesystems/ceph.txt | 2589 | F: Documentation/filesystems/ceph.txt |
| 2590 | F: fs/ceph/ | 2590 | F: fs/ceph/ |
| 2591 | 2591 | ||
| 2592 | CERTIFICATE HANDLING: | ||
| 2593 | M: David Howells <dhowells@redhat.com> | ||
| 2594 | M: David Woodhouse <dwmw2@infradead.org> | ||
| 2595 | L: keyrings@linux-nfs.org | ||
| 2596 | S: Maintained | ||
| 2597 | F: Documentation/module-signing.txt | ||
| 2598 | F: certs/ | ||
| 2599 | F: scripts/extract-cert.c | ||
| 2600 | |||
| 2592 | CERTIFIED WIRELESS USB (WUSB) SUBSYSTEM: | 2601 | CERTIFIED WIRELESS USB (WUSB) SUBSYSTEM: |
| 2593 | L: linux-usb@vger.kernel.org | 2602 | L: linux-usb@vger.kernel.org |
| 2594 | S: Orphan | 2603 | S: Orphan |
| @@ -870,10 +870,9 @@ INITRD_COMPRESS-$(CONFIG_RD_LZ4) := lz4 · 869 unmodified lines | |||
| 870 | # export INITRD_COMPRESS := $(INITRD_COMPRESS-y) | 870 | # export INITRD_COMPRESS := $(INITRD_COMPRESS-y) |
| 871 | 871 | ||
| 872 | ifdef CONFIG_MODULE_SIG_ALL | 872 | ifdef CONFIG_MODULE_SIG_ALL |
| 873 | MODSECKEY = $(CONFIG_MODULE_SIG_KEY) | 873 | $(eval $(call config_filename,MODULE_SIG_KEY)) |
| 874 | MODPUBKEY = ./signing_key.x509 | 874 | |
| 875 | export MODPUBKEY | 875 | mod_sign_cmd = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(MODULE_SIG_KEY_SRCPREFIX)$(CONFIG_MODULE_SIG_KEY) certs/signing_key.x509 |
| 876 | mod_sign_cmd = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(MODSECKEY) $(MODPUBKEY) | ||
| 877 | else | 876 | else |
| 878 | mod_sign_cmd = true | 877 | mod_sign_cmd = true |
| 879 | endif | 878 | endif |
| @@ -881,7 +880,7 @@ export mod_sign_cmd · 1 unmodified line | |||
| 881 | 880 | ||
| 882 | 881 | ||
| 883 | ifeq ($(KBUILD_EXTMOD),) | 882 | ifeq ($(KBUILD_EXTMOD),) |
| 884 | core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ | 883 | core-y += kernel/ certs/ mm/ fs/ ipc/ security/ crypto/ block/ |
| 885 | 884 | ||
| 886 | vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \ | 885 | vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \ |
| 887 | $(core-y) $(core-m) $(drivers-y) $(drivers-m) \ | 886 | $(core-y) $(core-m) $(drivers-y) $(drivers-m) \ |
| @@ -0,0 +1,42 @@ | |||
| 1 | menu "Certificates for signature checking" | ||
| 2 | |||
| 3 | config MODULE_SIG_KEY | ||
| 4 | string "File name or PKCS#11 URI of module signing key" | ||
| 5 | default "certs/signing_key.pem" | ||
| 6 | depends on MODULE_SIG | ||
| 7 | help | ||
| 8 | Provide the file name of a private key/certificate in PEM format, | ||
| 9 | or a PKCS#11 URI according to RFC7512. The file should contain, or | ||
| 10 | the URI should identify, both the certificate and its corresponding | ||
| 11 | private key. | ||
| 12 | |||
| 13 | If this option is unchanged from its default "certs/signing_key.pem", | ||
| 14 | then the kernel will automatically generate the private key and | ||
| 15 | certificate as described in Documentation/module-signing.txt | ||
| 16 | |||
| 17 | config SYSTEM_TRUSTED_KEYRING | ||
| 18 | bool "Provide system-wide ring of trusted keys" | ||
| 19 | depends on KEYS | ||
| 20 | help | ||
| 21 | Provide a system keyring to which trusted keys can be added. Keys in | ||
| 22 | the keyring are considered to be trusted. Keys may be added at will | ||
| 23 | by the kernel from compiled-in data and from hardware key stores, but | ||
| 24 | userspace may only add extra keys if those keys can be verified by | ||
| 25 | keys already in the keyring. | ||
| 26 | |||
| 27 | Keys in this keyring are used by module signature checking. | ||
| 28 | |||
| 29 | config SYSTEM_TRUSTED_KEYS | ||
| 30 | string "Additional X.509 keys for default system keyring" | ||
| 31 | depends on SYSTEM_TRUSTED_KEYRING | ||
| 32 | help | ||
| 33 | If set, this option should be the filename of a PEM-formatted file | ||
| 34 | containing trusted X.509 certificates to be included in the default | ||
| 35 | system keyring. Any certificate used for module signing is implicitly | ||
| 36 | also trusted. | ||
| 37 | |||
| 38 | NOTE: If you previously provided keys for the system keyring in the | ||
| 39 | form of DER-encoded *.x509 files in the top-level build directory, | ||
| 40 | those are no longer used. You will need to set this option instead. | ||
| 41 | |||
| 42 | endmenu | ||
| @@ -0,0 +1,94 @@ | |||
| 1 | # | ||
| 2 | # Makefile for the linux kernel signature checking certificates. | ||
| 3 | # | ||
| 4 | |||
| 5 | obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o | ||
| 6 | |||
| 7 | ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) | ||
| 8 | |||
| 9 | $(eval $(call config_filename,SYSTEM_TRUSTED_KEYS)) | ||
| 10 | |||
| 11 | # GCC doesn't include .incbin files in -MD generated dependencies (PR#66871) | ||
| 12 | $(obj)/system_certificates.o: $(obj)/x509_certificate_list | ||
| 13 | |||
| 14 | # Cope with signing_key.x509 existing in $(srctree) not $(objtree) | ||
| 15 | AFLAGS_system_certificates.o := -I$(srctree) | ||
| 16 | |||
| 17 | quiet_cmd_extract_certs = EXTRACT_CERTS $(patsubst "%",%,$(2)) | ||
| 18 | cmd_extract_certs = scripts/extract-cert $(2) $@ || ( rm $@; exit 1) | ||
| 19 | |||
| 20 | targets += x509_certificate_list | ||
| 21 | $(obj)/x509_certificate_list: scripts/extract-cert $(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(SYSTEM_TRUSTED_KEYS_FILENAME) FORCE | ||
| 22 | $(call if_changed,extract_certs,$(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(CONFIG_SYSTEM_TRUSTED_KEYS)) | ||
| 23 | endif | ||
| 24 | |||
| 25 | clean-files := x509_certificate_list .x509.list | ||
| 26 | |||
| 27 | ifeq ($(CONFIG_MODULE_SIG),y) | ||
| 28 | ############################################################################### | ||
| 29 | # | ||
| 30 | # If module signing is requested, say by allyesconfig, but a key has not been | ||
| 31 | # supplied, then one will need to be generated to make sure the build does not | ||
| 32 | # fail and that the kernel may be used afterwards. | ||
| 33 | # | ||
| 34 | ############################################################################### | ||
| 35 | ifndef CONFIG_MODULE_SIG_HASH | ||
| 36 | $(error Could not determine digest type to use from kernel config) | ||
| 37 | endif | ||
| 38 | |||
| 39 | # We do it this way rather than having a boolean option for enabling an | ||
| 40 | # external private key, because 'make randconfig' might enable such a | ||
| 41 | # boolean option and we unfortunately can't make it depend on !RANDCONFIG. | ||
| 42 | ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") | ||
| 43 | $(obj)/signing_key.pem: $(obj)/x509.genkey | ||
| 44 | @echo "###" | ||
| 45 | @echo "### Now generating an X.509 key pair to be used for signing modules." | ||
| 46 | @echo "###" | ||
| 47 | @echo "### If this takes a long time, you might wish to run rngd in the" | ||
| 48 | @echo "### background to keep the supply of entropy topped up. It" | ||
| 49 | @echo "### needs to be run as root, and uses a hardware random" | ||
| 50 | @echo "### number generator if one is available." | ||
| 51 | @echo "###" | ||
| 52 | openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ | ||
| 53 | -batch -x509 -config $(obj)/x509.genkey \ | ||
| 54 | -outform PEM -out $(obj)/signing_key.pem \ | ||
| 55 | -keyout $(obj)/signing_key.pem 2>&1 | ||
| 56 | @echo "###" | ||
| 57 | @echo "### Key pair generated." | ||
| 58 | @echo "###" | ||
| 59 | |||
| 60 | $(obj)/x509.genkey: | ||
| 61 | @echo Generating X.509 key generation config | ||
| 62 | @echo >$@ "[ req ]" | ||
| 63 | @echo >>$@ "default_bits = 4096" | ||
| 64 | @echo >>$@ "distinguished_name = req_distinguished_name" | ||
| 65 | @echo >>$@ "prompt = no" | ||
| 66 | @echo >>$@ "string_mask = utf8only" | ||
| 67 | @echo >>$@ "x509_extensions = myexts" | ||
| 68 | @echo >>$@ | ||
| 69 | @echo >>$@ "[ req_distinguished_name ]" | ||
| 70 | @echo >>$@ "#O = Unspecified company" | ||
| 71 | @echo >>$@ "CN = Build time autogenerated kernel key" | ||
| 72 | @echo >>$@ "#emailAddress = unspecified.user@unspecified.company" | ||
| 73 | @echo >>$@ | ||
| 74 | @echo >>$@ "[ myexts ]" | ||
| 75 | @echo >>$@ "basicConstraints=critical,CA:FALSE" | ||
| 76 | @echo >>$@ "keyUsage=digitalSignature" | ||
| 77 | @echo >>$@ "subjectKeyIdentifier=hash" | ||
| 78 | @echo >>$@ "authorityKeyIdentifier=keyid" | ||
| 79 | endif | ||
| 80 | |||
| 81 | $(eval $(call config_filename,MODULE_SIG_KEY)) | ||
| 82 | |||
| 83 | # If CONFIG_MODULE_SIG_KEY isn't a PKCS#11 URI, depend on it | ||
| 84 | ifeq ($(patsubst pkcs11:%,%,$(firstword $(MODULE_SIG_KEY_FILENAME))),$(firstword $(MODULE_SIG_KEY_FILENAME))) | ||
| 85 | X509_DEP := $(MODULE_SIG_KEY_SRCPREFIX)$(MODULE_SIG_KEY_FILENAME) | ||
| 86 | endif | ||
| 87 | |||
| 88 | # GCC PR#66871 again. | ||
| 89 | $(obj)/system_certificates.o: $(obj)/signing_key.x509 | ||
| 90 | |||
| 91 | targets += signing_key.x509 | ||
| 92 | $(obj)/signing_key.x509: scripts/extract-cert $(X509_DEP) FORCE | ||
| 93 | $(call if_changed,extract_certs,$(MODULE_SIG_KEY_SRCPREFIX)$(CONFIG_MODULE_SIG_KEY)) | ||
| 94 | endif | ||
| @@ -8,9 +8,9 @@ · 7 unmodified lines | |||
| 8 | VMLINUX_SYMBOL(system_certificate_list): | 8 | VMLINUX_SYMBOL(system_certificate_list): |
| 9 | __cert_list_start: | 9 | __cert_list_start: |
| 10 | #ifdef CONFIG_MODULE_SIG | 10 | #ifdef CONFIG_MODULE_SIG |
| 11 | .incbin "signing_key.x509" | 11 | .incbin "certs/signing_key.x509" |
| 12 | #endif | 12 | #endif |
| 13 | .incbin "kernel/x509_certificate_list" | 13 | .incbin "certs/x509_certificate_list" |
| 14 | __cert_list_end: | 14 | __cert_list_end: |
| 15 | 15 | ||
| 16 | .align 8 | 16 | .align 8 |
File renamed without changes.
| @@ -1601,5 +1601,6 @@ config CRYPTO_HASH_INFO · 1600 unmodified lines | |||
| 1601 | 1601 | ||
| 1602 | source "drivers/crypto/Kconfig" | 1602 | source "drivers/crypto/Kconfig" |
| 1603 | source crypto/asymmetric_keys/Kconfig | 1603 | source crypto/asymmetric_keys/Kconfig |
| 1604 | source certs/Kconfig | ||
| 1604 | 1605 | ||
| 1605 | endif # if CRYPTO | 1606 | endif # if CRYPTO |
| @@ -1740,31 +1740,6 @@ config MMAP_ALLOW_UNINITIALIZED · 1739 unmodified lines | |||
| 1740 | 1740 | ||
| 1741 | See Documentation/nommu-mmap.txt for more information. | 1741 | See Documentation/nommu-mmap.txt for more information. |
| 1742 | 1742 | ||
| 1743 | config SYSTEM_TRUSTED_KEYRING | ||
| 1744 | bool "Provide system-wide ring of trusted keys" | ||
| 1745 | depends on KEYS | ||
| 1746 | help | ||
| 1747 | Provide a system keyring to which trusted keys can be added. Keys in | ||
| 1748 | the keyring are considered to be trusted. Keys may be added at will | ||
| 1749 | by the kernel from compiled-in data and from hardware key stores, but | ||
| 1750 | userspace may only add extra keys if those keys can be verified by | ||
| 1751 | keys already in the keyring. | ||
| 1752 | |||
| 1753 | Keys in this keyring are used by module signature checking. | ||
| 1754 | |||
| 1755 | config SYSTEM_TRUSTED_KEYS | ||
| 1756 | string "Additional X.509 keys for default system keyring" | ||
| 1757 | depends on SYSTEM_TRUSTED_KEYRING | ||
| 1758 | help | ||
| 1759 | If set, this option should be the filename of a PEM-formatted file | ||
| 1760 | containing trusted X.509 certificates to be included in the default | ||
| 1761 | system keyring. Any certificate used for module signing is implicitly | ||
| 1762 | also trusted. | ||
| 1763 | |||
| 1764 | NOTE: If you previously provided keys for the system keyring in the | ||
| 1765 | form of DER-encoded *.x509 files in the top-level build directory, | ||
| 1766 | those are no longer used. You will need to set this option instead. | ||
| 1767 | |||
| 1768 | config SYSTEM_DATA_VERIFICATION | 1743 | config SYSTEM_DATA_VERIFICATION |
| 1769 | def_bool n | 1744 | def_bool n |
| 1770 | select SYSTEM_TRUSTED_KEYRING | 1745 | select SYSTEM_TRUSTED_KEYRING |
| @@ -1965,20 +1940,6 @@ config MODULE_SIG_HASH · 194 unmodified lines | |||
| 1965 | default "sha384" if MODULE_SIG_SHA384 | 1940 | default "sha384" if MODULE_SIG_SHA384 |
| 1966 | default "sha512" if MODULE_SIG_SHA512 | 1941 | default "sha512" if MODULE_SIG_SHA512 |
| 1967 | 1942 | ||
| 1968 | config MODULE_SIG_KEY | ||
| 1969 | string "File name or PKCS#11 URI of module signing key" | ||
| 1970 | default "signing_key.pem" | ||
| 1971 | depends on MODULE_SIG | ||
| 1972 | help | ||
| 1973 | Provide the file name of a private key/certificate in PEM format, | ||
| 1974 | or a PKCS#11 URI according to RFC7512. The file should contain, or | ||
| 1975 | the URI should identify, both the certificate and its corresponding | ||
| 1976 | private key. | ||
| 1977 | |||
| 1978 | If this option is unchanged from its default "signing_key.pem", | ||
| 1979 | then the kernel will automatically generate the private key and | ||
| 1980 | certificate as described in Documentation/module-signing.txt | ||
| 1981 | |||
| 1982 | config MODULE_COMPRESS | 1943 | config MODULE_COMPRESS |
| 1983 | bool "Compress modules on installation" | 1944 | bool "Compress modules on installation" |
| 1984 | depends on MODULES | 1945 | depends on MODULES |
| @@ -45,7 +45,6 @@ ifneq ($(CONFIG_SMP),y) · 44 unmodified lines | |||
| 45 | obj-y += up.o | 45 | obj-y += up.o |
| 46 | endif | 46 | endif |
| 47 | obj-$(CONFIG_UID16) += uid16.o | 47 | obj-$(CONFIG_UID16) += uid16.o |
| 48 | obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o | ||
| 49 | obj-$(CONFIG_MODULES) += module.o | 48 | obj-$(CONFIG_MODULES) += module.o |
| 50 | obj-$(CONFIG_MODULE_SIG) += module_signing.o | 49 | obj-$(CONFIG_MODULE_SIG) += module_signing.o |
| 51 | obj-$(CONFIG_KALLSYMS) += kallsyms.o | 50 | obj-$(CONFIG_KALLSYMS) += kallsyms.o |
| @@ -111,145 +110,3 @@ $(obj)/config_data.gz: $(KCONFIG_CONFIG) FORCE · 59 unmodified lines | |||
| 111 | targets += config_data.h | 110 | targets += config_data.h |
| 112 | $(obj)/config_data.h: $(obj)/config_data.gz FORCE | 111 | $(obj)/config_data.h: $(obj)/config_data.gz FORCE |
| 113 | $(call filechk,ikconfiggz) | 112 | $(call filechk,ikconfiggz) |
| 114 | |||
| 115 | ############################################################################### | ||
| 116 | # | ||
| 117 | # When a Kconfig string contains a filename, it is suitable for | ||
| 118 | # passing to shell commands. It is surrounded by double-quotes, and | ||
| 119 | # any double-quotes or backslashes within it are escaped by | ||
| 120 | # backslashes. | ||
| 121 | # | ||
| 122 | # This is no use for dependencies or $(wildcard). We need to strip the | ||
| 123 | # surrounding quotes and the escaping from quotes and backslashes, and | ||
| 124 | # we *do* need to escape any spaces in the string. So, for example: | ||
| 125 | # | ||
| 126 | # Usage: $(eval $(call config_filename,FOO)) | ||
| 127 | # | ||
| 128 | # Defines FOO_FILENAME based on the contents of the CONFIG_FOO option, | ||
| 129 | # transformed as described above to be suitable for use within the | ||
| 130 | # makefile. | ||
| 131 | # | ||
| 132 | # Also, if the filename is a relative filename and exists in the source | ||
| 133 | # tree but not the build tree, define FOO_SRCPREFIX as $(srctree)/ to | ||
| 134 | # be prefixed to *both* command invocation and dependencies. | ||
| 135 | # | ||
| 136 | # Note: We also print the filenames in the quiet_cmd_foo text, and | ||
| 137 | # perhaps ought to have a version specially escaped for that purpose. | ||
| 138 | # But it's only cosmetic, and $(patsubst "%",%,$(CONFIG_FOO)) is good | ||
| 139 | # enough. It'll strip the quotes in the common case where there's no | ||
| 140 | # space and it's a simple filename, and it'll retain the quotes when | ||
| 141 | # there's a space. There are some esoteric cases in which it'll print | ||
| 142 | # the wrong thing, but we don't really care. The actual dependencies | ||
| 143 | # and commands *do* get it right, with various combinations of single | ||
| 144 | # and double quotes, backslashes and spaces in the filenames. | ||
| 145 | # | ||
| 146 | ############################################################################### | ||
| 147 | # | ||
| 148 | quote := $(firstword " ") | ||
| 149 | space := | ||
| 150 | space += | ||
| 151 | space_escape := %%%SPACE%%% | ||
| 152 | # | ||
| 153 | define config_filename | ||
| 154 | ifneq ($$(CONFIG_$(1)),"") | ||
| 155 | $(1)_FILENAME := $$(subst \\,\,$$(subst \$$(quote),$$(quote),$$(subst $$(space_escape),\$$(space),$$(patsubst "%",%,$$(subst $$(space),$$(space_escape),$$(CONFIG_$(1))))))) | ||
| 156 | ifneq ($$(patsubst /%,%,$$(firstword $$($(1)_FILENAME))),$$(firstword $$($(1)_FILENAME))) | ||
| 157 | else | ||
| 158 | ifeq ($$(wildcard $$($(1)_FILENAME)),) | ||
| 159 | ifneq ($$(wildcard $$(srctree)/$$($(1)_FILENAME)),) | ||
| 160 | $(1)_SRCPREFIX := $(srctree)/ | ||
| 161 | endif | ||
| 162 | endif | ||
| 163 | endif | ||
| 164 | endif | ||
| 165 | endef | ||
| 166 | # | ||
| 167 | ############################################################################### | ||
| 168 | |||
| 169 | ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) | ||
| 170 | |||
| 171 | $(eval $(call config_filename,SYSTEM_TRUSTED_KEYS)) | ||
| 172 | |||
| 173 | # GCC doesn't include .incbin files in -MD generated dependencies (PR#66871) | ||
| 174 | $(obj)/system_certificates.o: $(obj)/x509_certificate_list | ||
| 175 | |||
| 176 | # Cope with signing_key.x509 existing in $(srctree) not $(objtree) | ||
| 177 | AFLAGS_system_certificates.o := -I$(srctree) | ||
| 178 | |||
| 179 | quiet_cmd_extract_certs = EXTRACT_CERTS $(patsubst "%",%,$(2)) | ||
| 180 | cmd_extract_certs = scripts/extract-cert $(2) $@ || ( rm $@; exit 1) | ||
| 181 | |||
| 182 | targets += x509_certificate_list | ||
| 183 | $(obj)/x509_certificate_list: scripts/extract-cert $(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(SYSTEM_TRUSTED_KEYS_FILENAME) FORCE | ||
| 184 | $(call if_changed,extract_certs,$(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(CONFIG_SYSTEM_TRUSTED_KEYS)) | ||
| 185 | endif | ||
| 186 | |||
| 187 | clean-files := x509_certificate_list .x509.list | ||
| 188 | |||
| 189 | ifeq ($(CONFIG_MODULE_SIG),y) | ||
| 190 | ############################################################################### | ||
| 191 | # | ||
| 192 | # If module signing is requested, say by allyesconfig, but a key has not been | ||
| 193 | # supplied, then one will need to be generated to make sure the build does not | ||
| 194 | # fail and that the kernel may be used afterwards. | ||
| 195 | # | ||
| 196 | ############################################################################### | ||
| 197 | ifndef CONFIG_MODULE_SIG_HASH | ||
| 198 | $(error Could not determine digest type to use from kernel config) | ||
| 199 | endif | ||
| 200 | |||
| 201 | # We do it this way rather than having a boolean option for enabling an | ||
| 202 | # external private key, because 'make randconfig' might enable such a | ||
| 203 | # boolean option and we unfortunately can't make it depend on !RANDCONFIG. | ||
| 204 | ifeq ($(CONFIG_MODULE_SIG_KEY),"signing_key.pem") | ||
| 205 | signing_key.pem: x509.genkey | ||
| 206 | @echo "###" | ||
| 207 | @echo "### Now generating an X.509 key pair to be used for signing modules." | ||
| 208 | @echo "###" | ||
| 209 | @echo "### If this takes a long time, you might wish to run rngd in the" | ||
| 210 | @echo "### background to keep the supply of entropy topped up. It" | ||
| 211 | @echo "### needs to be run as root, and uses a hardware random" | ||
| 212 | @echo "### number generator if one is available." | ||
| 213 | @echo "###" | ||
| 214 | openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ | ||
| 215 | -batch -x509 -config x509.genkey \ | ||
| 216 | -outform PEM -out signing_key.pem \ | ||
| 217 | -keyout signing_key.pem 2>&1 | ||
| 218 | @echo "###" | ||
| 219 | @echo "### Key pair generated." | ||
| 220 | @echo "###" | ||
| 221 | |||
| 222 | x509.genkey: | ||
| 223 | @echo Generating X.509 key generation config | ||
| 224 | @echo >x509.genkey "[ req ]" | ||
| 225 | @echo >>x509.genkey "default_bits = 4096" | ||
| 226 | @echo >>x509.genkey "distinguished_name = req_distinguished_name" | ||
| 227 | @echo >>x509.genkey "prompt = no" | ||
| 228 | @echo >>x509.genkey "string_mask = utf8only" | ||
| 229 | @echo >>x509.genkey "x509_extensions = myexts" | ||
| 230 | @echo >>x509.genkey | ||
| 231 | @echo >>x509.genkey "[ req_distinguished_name ]" | ||
| 232 | @echo >>x509.genkey "#O = Unspecified company" | ||
| 233 | @echo >>x509.genkey "CN = Build time autogenerated kernel key" | ||
| 234 | @echo >>x509.genkey "#emailAddress = unspecified.user@unspecified.company" | ||
| 235 | @echo >>x509.genkey | ||
| 236 | @echo >>x509.genkey "[ myexts ]" | ||
| 237 | @echo >>x509.genkey "basicConstraints=critical,CA:FALSE" | ||
| 238 | @echo >>x509.genkey "keyUsage=digitalSignature" | ||
| 239 | @echo >>x509.genkey "subjectKeyIdentifier=hash" | ||
| 240 | @echo >>x509.genkey "authorityKeyIdentifier=keyid" | ||
| 241 | endif | ||
| 242 | |||
| 243 | $(eval $(call config_filename,MODULE_SIG_KEY)) | ||
| 244 | |||
| 245 | # If CONFIG_MODULE_SIG_KEY isn't a PKCS#11 URI, depend on it | ||
| 246 | ifeq ($(patsubst pkcs11:%,%,$(firstword $(MODULE_SIG_KEY_FILENAME))),$(firstword $(MODULE_SIG_KEY_FILENAME))) | ||
| 247 | X509_DEP := $(MODULE_SIG_KEY_SRCPREFIX)$(MODULE_SIG_KEY_FILENAME) | ||
| 248 | endif | ||
| 249 | |||
| 250 | # GCC PR#66871 again. | ||
| 251 | $(obj)/system_certificates.o: signing_key.x509 | ||
| 252 | |||
| 253 | signing_key.x509: scripts/extract-cert include/config/module/sig/key.h $(X509_DEP) | ||
| 254 | $(call cmd,extract_certs,$(MODULE_SIG_KEY_SRCPREFIX)$(CONFIG_MODULE_SIG_KEY)) | ||
| 255 | endif | ||
| @@ -303,3 +303,54 @@ why = \ · 302 unmodified lines | |||
| 303 | 303 | ||
| 304 | echo-why = $(call escsq, $(strip $(why))) | 304 | echo-why = $(call escsq, $(strip $(why))) |
| 305 | endif | 305 | endif |
| 306 | |||
| 307 | ############################################################################### | ||
| 308 | # | ||
| 309 | # When a Kconfig string contains a filename, it is suitable for | ||
| 310 | # passing to shell commands. It is surrounded by double-quotes, and | ||
| 311 | # any double-quotes or backslashes within it are escaped by | ||
| 312 | # backslashes. | ||
| 313 | # | ||
| 314 | # This is no use for dependencies or $(wildcard). We need to strip the | ||
| 315 | # surrounding quotes and the escaping from quotes and backslashes, and | ||
| 316 | # we *do* need to escape any spaces in the string. So, for example: | ||
| 317 | # | ||
| 318 | # Usage: $(eval $(call config_filename,FOO)) | ||
| 319 | # | ||
| 320 | # Defines FOO_FILENAME based on the contents of the CONFIG_FOO option, | ||
| 321 | # transformed as described above to be suitable for use within the | ||
| 322 | # makefile. | ||
| 323 | # | ||
| 324 | # Also, if the filename is a relative filename and exists in the source | ||
| 325 | # tree but not the build tree, define FOO_SRCPREFIX as $(srctree)/ to | ||
| 326 | # be prefixed to *both* command invocation and dependencies. | ||
| 327 | # | ||
| 328 | # Note: We also print the filenames in the quiet_cmd_foo text, and | ||
| 329 | # perhaps ought to have a version specially escaped for that purpose. | ||
| 330 | # But it's only cosmetic, and $(patsubst "%",%,$(CONFIG_FOO)) is good | ||
| 331 | # enough. It'll strip the quotes in the common case where there's no | ||
| 332 | # space and it's a simple filename, and it'll retain the quotes when | ||
| 333 | # there's a space. There are some esoteric cases in which it'll print | ||
| 334 | # the wrong thing, but we don't really care. The actual dependencies | ||
| 335 | # and commands *do* get it right, with various combinations of single | ||
| 336 | # and double quotes, backslashes and spaces in the filenames. | ||
| 337 | # | ||
| 338 | ############################################################################### | ||
| 339 | # | ||
| 340 | space_escape := %%%SPACE%%% | ||
| 341 | # | ||
| 342 | define config_filename | ||
| 343 | ifneq ($$(CONFIG_$(1)),"") | ||
| 344 | $(1)_FILENAME := $$(subst \\,\,$$(subst \$$(quote),$$(quote),$$(subst $$(space_escape),\$$(space),$$(patsubst "%",%,$$(subst $$(space),$$(space_escape),$$(CONFIG_$(1))))))) | ||
| 345 | ifneq ($$(patsubst /%,%,$$(firstword $$($(1)_FILENAME))),$$(firstword $$($(1)_FILENAME))) | ||
| 346 | else | ||
| 347 | ifeq ($$(wildcard $$($(1)_FILENAME)),) | ||
| 348 | ifneq ($$(wildcard $$(srctree)/$$($(1)_FILENAME)),) | ||
| 349 | $(1)_SRCPREFIX := $(srctree)/ | ||
| 350 | endif | ||
| 351 | endif | ||
| 352 | endif | ||
| 353 | endif | ||
| 354 | endef | ||
| 355 | # | ||
| 356 | ############################################################################### | ||