From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751848AbcDZOCU (ORCPT ); Tue, 26 Apr 2016 10:02:20 -0400 Received: from smtprelay0222.hostedemail.com ([216.40.44.222]:58622 "EHLO smtprelay.hostedemail.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750843AbcDZOCS (ORCPT ); Tue, 26 Apr 2016 10:02:18 -0400 X-Session-Marker: 726F737465647440676F6F646D69732E6F7267 X-Spam-Summary: 2,0,0,,d41d8cd98f00b204,rostedt@goodmis.org,:::::::::::,RULES_HIT:41:355:379:541:599:800:960:973:982:988:989:1260:1277:1311:1313:1314:1345:1359:1437:1515:1516:1518:1534:1542:1593:1594:1711:1730:1747:1777:1792:2197:2199:2393:2553:2559:2562:2693:2895:2899:3138:3139:3140:3141:3142:3354:3622:3653:3865:3866:3867:3868:3870:3874:4605:5007:6261:6299:7875:7903:10004:10400:10848:10967:11026:11232:11473:11658:11914:12043:12291:12294:12438:12517:12519:12555:12683:12740:13132:13231:13439:14093:14097:14181:14659:14721:21080:21221:30051:30054:30069:30070:30090:30091,0,RBL:none,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fn,MSBL:0,DNSBL:none,Custom_rules:0:0:0,LFtime:2,LUA_SUMMARY:none X-HE-Tag: hat51_30cf076112443 X-Filterd-Recvd-Size: 3674 Date: Tue, 26 Apr 2016 10:02:14 -0400 From: Steven Rostedt To: Benjamin Poirier Cc: Michal Marek , joeyli , "Yann E . MORIN " , linux-kbuild@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 2/2] localmodconfig: Reset certificate paths Message-ID: <20160426100214.08f3569a@gandalf.local.home> In-Reply-To: <1459619722-13695-2-git-send-email-bpoirier@suse.com> References: <1459619722-13695-1-git-send-email-bpoirier@suse.com> <1459619722-13695-2-git-send-email-bpoirier@suse.com> X-Mailer: Claws Mail 3.13.2 (GTK+ 2.24.30; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, 2 Apr 2016 10:55:22 -0700 Benjamin Poirier wrote: > When using `make localmodconfig` and friends, if the input config comes > from a kernel that was built in a different environment (for example, the > canonical case of using localmodconfig to trim a distribution kernel > config) the key files for module signature checking will not be available > and should be regenerated or omitted. Otherwise, the user will be faced > with annoying errors when trying to build with the generated .config: > > make[1]: *** No rule to make target 'keyring.crt', needed by 'certs/x509_certificate_list'. Stop. > Makefile:1576: recipe for target 'certs/' failed > > Signed-off-by: Benjamin Poirier > --- > scripts/kconfig/streamline_config.pl | 34 ++++++++++++++++++++++++++++++++++ > 1 file changed, 34 insertions(+) > > diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl > index 7036ae3..514735d 100755 > --- a/scripts/kconfig/streamline_config.pl > +++ b/scripts/kconfig/streamline_config.pl > @@ -610,6 +610,40 @@ foreach my $line (@config_file) { > next; > } > > + if (/CONFIG_MODULE_SIG_KEY="(.+)"/) { > + my $orig_cert = $1; > + my $default_cert = "certs/signing_key.pem"; > + > + # Check that the logic in this script still matches the one in Kconfig > + if (!defined($depends{"MODULE_SIG_KEY"}) || > + $depends{"MODULE_SIG_KEY"} !~ /"\Q$default_cert\E"/) { > + die "Assertion failure, update needed"; Instead of dieing here, what about just going back to the current behavior, and ignore the sig keys? -- Steve > + } > + > + if ($orig_cert ne $default_cert && ! -f $orig_cert) { > + print STDERR "Module signature verification enabled but ", > + "module signing key \"$orig_cert\" not found. Resetting ", > + "signing key to default value.\n"; > + print "CONFIG_MODULE_SIG_KEY=\"$default_cert\"\n"; > + } else { > + print; > + } > + next; > + } > + > + if (/CONFIG_SYSTEM_TRUSTED_KEYS="(.+)"/) { > + my $orig_keys = $1; > + > + if (! -f $orig_keys) { > + print STDERR "System keyring enabled but keys \"$orig_keys\" ", > + "not found. Resetting keys to default value.\n"; > + print "CONFIG_SYSTEM_TRUSTED_KEYS=\"\"\n"; > + } else { > + print; > + } > + next; > + } > + > if (/^(CONFIG.*)=(m|y)/) { > if (defined($configs{$1})) { > if ($localyesconfig) {