From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752044AbcFVWjf (ORCPT ); Wed, 22 Jun 2016 18:39:35 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:6526 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752007AbcFVWjd (ORCPT ); Wed, 22 Jun 2016 18:39:33 -0400 X-IBM-Helo: d03dlp01.boulder.ibm.com X-IBM-MailFrom: mkayaalp@linux.vnet.ibm.com From: Mehmet Kayaalp To: David Howells , linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-ima-devel@lists.sourceforge.net, keyrings@vger.kernel.org Cc: Mimi Zohar , George Wilson , Stefan Berger , Mehmet Kayaalp Subject: [PATCH 2/3 v2] KEYS: Insert incompressible bytes to vmlinux to reserve space in bzImage Date: Wed, 22 Jun 2016 18:37:32 -0400 X-Mailer: git-send-email 2.7.4 In-Reply-To: <1466635053-30512-1-git-send-email-mkayaalp@linux.vnet.ibm.com> References: <1466635053-30512-1-git-send-email-mkayaalp@linux.vnet.ibm.com> X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16062222-0016-0000-0000-000004049EEC X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 16062222-0017-0000-0000-00003074F1B6 Message-Id: <1466635053-30512-3-git-send-email-mkayaalp@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2016-06-22_12:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1606220231 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Call insert-sys-cert script with null file to ensure that random bytes are inserted to the space reserved with CONFIG_SYSTEM_EXTRA_CERTIFICATE, before compressing the vmlinux. This results in an uncompressed reserved area inside the bzImage as well, so that it can be replaced with an actual certificate later (after the bzImage is distributed). Cross compilation is not supported yet. Signed-off-by: Mehmet Kayaalp Tested-by: Stefan Berger Acked-by: Mimi Zohar --- arch/x86/boot/compressed/Makefile | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile index f135688..5b15e56 100644 --- a/arch/x86/boot/compressed/Makefile +++ b/arch/x86/boot/compressed/Makefile @@ -88,8 +88,16 @@ vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_thunk_$(BITS).o $(obj)/vmlinux: $(vmlinux-objs-y) FORCE $(call if_changed,ld) +quiet_cmd_inscert = INSCERT /dev/null to $< + cmd_inscert = scripts/insert-sys-cert -b $< -c /dev/null > /dev/null + OBJCOPYFLAGS_vmlinux.bin := -R .comment -S $(obj)/vmlinux.bin: vmlinux FORCE +ifndef CROSS_COMPILE +ifeq ("$(CONFIG_SYSTEM_EXTRA_CERTIFICATE)", "y") + $(call if_changed,inscert) +endif +endif $(call if_changed,objcopy) targets += $(patsubst $(obj)/%,%,$(vmlinux-objs-y)) vmlinux.bin.all vmlinux.relocs -- 2.7.4