* [PATCH 0/2] Fix module signing with PKCS#11 URIs
@ 2023-01-30 14:15 Jan Luebbe
2023-01-30 14:15 ` [PATCH 1/2] certs: Fix build error when PKCS#11 URI contains semicolon Jan Luebbe
2023-01-30 14:15 ` [PATCH 2/2] kbuild: modinst: Fix build error when CONFIG_MODULE_SIG_KEY is a PKCS#11 URI Jan Luebbe
0 siblings, 2 replies; 6+ messages in thread
From: Jan Luebbe @ 2023-01-30 14:15 UTC (permalink / raw)
To: Masahiro Yamada
Cc: Jan Luebbe, David Howells, David Woodhouse, keyrings,
linux-kbuild, linux-kernel, kernel
Hi,
here are two patches to fix kernel module signing when using a key via
PKCS#11, including the case where the URI contains semicolons to
separate components.
Best regards,
Jan
Jan Luebbe (2):
certs: Fix build error when PKCS#11 URI contains semicolon
kbuild: modinst: Fix build error when CONFIG_MODULE_SIG_KEY is a
PKCS#11 URI
certs/Makefile | 2 +-
scripts/Makefile.modinst | 6 +++++-
2 files changed, 6 insertions(+), 2 deletions(-)
--
2.30.2
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH 1/2] certs: Fix build error when PKCS#11 URI contains semicolon 2023-01-30 14:15 [PATCH 0/2] Fix module signing with PKCS#11 URIs Jan Luebbe @ 2023-01-30 14:15 ` Jan Luebbe 2023-01-30 15:18 ` Masahiro Yamada 2023-01-30 14:15 ` [PATCH 2/2] kbuild: modinst: Fix build error when CONFIG_MODULE_SIG_KEY is a PKCS#11 URI Jan Luebbe 1 sibling, 1 reply; 6+ messages in thread From: Jan Luebbe @ 2023-01-30 14:15 UTC (permalink / raw) To: Masahiro Yamada Cc: Jan Luebbe, David Howells, David Woodhouse, keyrings, linux-kbuild, linux-kernel, kernel When CONFIG_MODULE_SIG_KEY is PKCS#11 URI (pkcs11:*) and contains a semicolon, signing_key.x509 fails to build: certs/extract-cert pkcs11:token=foo;object=bar;pin-value=1111 certs/signing_key.x509 Usage: extract-cert <source> <dest> Add quotes to the PKCS11_URI variable to avoid splitting by the shell. Fixes: 129ab0d2d9f3 ("kbuild: do not quote string values in include/config/auto.conf") Signed-off-by: Jan Luebbe <jlu@pengutronix.de> --- certs/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/certs/Makefile b/certs/Makefile index 9486ed924731..cda21811ed88 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -67,7 +67,7 @@ $(obj)/system_certificates.o: $(obj)/signing_key.x509 PKCS11_URI := $(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)) ifdef PKCS11_URI -$(obj)/signing_key.x509: extract-cert-in := $(PKCS11_URI) +$(obj)/signing_key.x509: extract-cert-in := "$(PKCS11_URI)" endif $(obj)/signing_key.x509: $(filter-out $(PKCS11_URI),$(CONFIG_MODULE_SIG_KEY)) $(obj)/extract-cert FORCE -- 2.30.2 ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] certs: Fix build error when PKCS#11 URI contains semicolon 2023-01-30 14:15 ` [PATCH 1/2] certs: Fix build error when PKCS#11 URI contains semicolon Jan Luebbe @ 2023-01-30 15:18 ` Masahiro Yamada 2023-01-30 16:43 ` Jan Lübbe 0 siblings, 1 reply; 6+ messages in thread From: Masahiro Yamada @ 2023-01-30 15:18 UTC (permalink / raw) To: Jan Luebbe Cc: David Howells, David Woodhouse, keyrings, linux-kbuild, linux-kernel, kernel On Mon, Jan 30, 2023 at 11:16 PM Jan Luebbe <jlu@pengutronix.de> wrote: > > When CONFIG_MODULE_SIG_KEY is PKCS#11 URI (pkcs11:*) and contains a > semicolon, signing_key.x509 fails to build: > > certs/extract-cert pkcs11:token=foo;object=bar;pin-value=1111 certs/signing_key.x509 > Usage: extract-cert <source> <dest> > > Add quotes to the PKCS11_URI variable to avoid splitting by the shell. > > Fixes: 129ab0d2d9f3 ("kbuild: do not quote string values in include/config/auto.conf") > Signed-off-by: Jan Luebbe <jlu@pengutronix.de> > --- > certs/Makefile | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/certs/Makefile b/certs/Makefile > index 9486ed924731..cda21811ed88 100644 > --- a/certs/Makefile > +++ b/certs/Makefile > @@ -67,7 +67,7 @@ $(obj)/system_certificates.o: $(obj)/signing_key.x509 > > PKCS11_URI := $(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)) > ifdef PKCS11_URI > -$(obj)/signing_key.x509: extract-cert-in := $(PKCS11_URI) > +$(obj)/signing_key.x509: extract-cert-in := "$(PKCS11_URI)" > endif > > $(obj)/signing_key.x509: $(filter-out $(PKCS11_URI),$(CONFIG_MODULE_SIG_KEY)) $(obj)/extract-cert FORCE > -- > 2.30.2 > Instead, how about this? diff --git a/certs/Makefile b/certs/Makefile index 9486ed924731..799ad7b9e68a 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -23,8 +23,8 @@ $(obj)/blacklist_hash_list: $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE targets += blacklist_hash_list quiet_cmd_extract_certs = CERT $@ - cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@ -extract-cert-in = $(or $(filter-out $(obj)/extract-cert, $(real-prereqs)),"") + cmd_extract_certs = $(obj)/extract-cert "$(extract-cert-in)" $@ +extract-cert-in = $(filter-out $(obj)/extract-cert, $(real-prereqs)) $(obj)/system_certificates.o: $(obj)/x509_certificate_list -- Best Regards Masahiro Yamada ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] certs: Fix build error when PKCS#11 URI contains semicolon 2023-01-30 15:18 ` Masahiro Yamada @ 2023-01-30 16:43 ` Jan Lübbe 2023-01-30 17:21 ` Masahiro Yamada 0 siblings, 1 reply; 6+ messages in thread From: Jan Lübbe @ 2023-01-30 16:43 UTC (permalink / raw) To: Masahiro Yamada Cc: David Howells, David Woodhouse, keyrings, linux-kbuild, linux-kernel, kernel On Tue, 2023-01-31 at 00:18 +0900, Masahiro Yamada wrote: > On Mon, Jan 30, 2023 at 11:16 PM Jan Luebbe <jlu@pengutronix.de> wrote: > > > > When CONFIG_MODULE_SIG_KEY is PKCS#11 URI (pkcs11:*) and contains a > > semicolon, signing_key.x509 fails to build: > > > > certs/extract-cert pkcs11:token=foo;object=bar;pin-value=1111 certs/signing_key.x509 > > Usage: extract-cert <source> <dest> > > > > Add quotes to the PKCS11_URI variable to avoid splitting by the shell. > > > > Fixes: 129ab0d2d9f3 ("kbuild: do not quote string values in include/config/auto.conf") > > Signed-off-by: Jan Luebbe <jlu@pengutronix.de> > > --- > > certs/Makefile | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/certs/Makefile b/certs/Makefile > > index 9486ed924731..cda21811ed88 100644 > > --- a/certs/Makefile > > +++ b/certs/Makefile > > @@ -67,7 +67,7 @@ $(obj)/system_certificates.o: $(obj)/signing_key.x509 > > > > PKCS11_URI := $(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)) > > ifdef PKCS11_URI > > -$(obj)/signing_key.x509: extract-cert-in := $(PKCS11_URI) > > +$(obj)/signing_key.x509: extract-cert-in := "$(PKCS11_URI)" > > endif > > > > $(obj)/signing_key.x509: $(filter-out $(PKCS11_URI),$(CONFIG_MODULE_SIG_KEY)) $(obj)/extract-cert FORCE > > -- > > 2.30.2 > > > > Instead, how about this? > > > > > diff --git a/certs/Makefile b/certs/Makefile > index 9486ed924731..799ad7b9e68a 100644 > --- a/certs/Makefile > +++ b/certs/Makefile > @@ -23,8 +23,8 @@ $(obj)/blacklist_hash_list: > $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE > targets += blacklist_hash_list > > quiet_cmd_extract_certs = CERT $@ > - cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@ > -extract-cert-in = $(or $(filter-out $(obj)/extract-cert, $(real-prereqs)),"") > + cmd_extract_certs = $(obj)/extract-cert "$(extract-cert-in)" $@ > +extract-cert-in = $(filter-out $(obj)/extract-cert, $(real-prereqs)) > > $(obj)/system_certificates.o: $(obj)/x509_certificate_list Thanks, this works im my tests, too. Regards, Jan -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] certs: Fix build error when PKCS#11 URI contains semicolon 2023-01-30 16:43 ` Jan Lübbe @ 2023-01-30 17:21 ` Masahiro Yamada 0 siblings, 0 replies; 6+ messages in thread From: Masahiro Yamada @ 2023-01-30 17:21 UTC (permalink / raw) To: Jan Lübbe Cc: David Howells, David Woodhouse, keyrings, linux-kbuild, linux-kernel, kernel On Tue, Jan 31, 2023 at 1:43 AM Jan Lübbe <jlu@pengutronix.de> wrote: > > On Tue, 2023-01-31 at 00:18 +0900, Masahiro Yamada wrote: > > On Mon, Jan 30, 2023 at 11:16 PM Jan Luebbe <jlu@pengutronix.de> wrote: > > > > > > When CONFIG_MODULE_SIG_KEY is PKCS#11 URI (pkcs11:*) and contains a > > > semicolon, signing_key.x509 fails to build: > > > > > > certs/extract-cert pkcs11:token=foo;object=bar;pin-value=1111 certs/signing_key.x509 > > > Usage: extract-cert <source> <dest> > > > > > > Add quotes to the PKCS11_URI variable to avoid splitting by the shell. > > > > > > Fixes: 129ab0d2d9f3 ("kbuild: do not quote string values in include/config/auto.conf") > > > Signed-off-by: Jan Luebbe <jlu@pengutronix.de> > > > --- > > > certs/Makefile | 2 +- > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > diff --git a/certs/Makefile b/certs/Makefile > > > index 9486ed924731..cda21811ed88 100644 > > > --- a/certs/Makefile > > > +++ b/certs/Makefile > > > @@ -67,7 +67,7 @@ $(obj)/system_certificates.o: $(obj)/signing_key.x509 > > > > > > PKCS11_URI := $(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)) > > > ifdef PKCS11_URI > > > -$(obj)/signing_key.x509: extract-cert-in := $(PKCS11_URI) > > > +$(obj)/signing_key.x509: extract-cert-in := "$(PKCS11_URI)" > > > endif > > > > > > $(obj)/signing_key.x509: $(filter-out $(PKCS11_URI),$(CONFIG_MODULE_SIG_KEY)) $(obj)/extract-cert FORCE > > > -- > > > 2.30.2 > > > > > > > Instead, how about this? > > > > > > > > > > diff --git a/certs/Makefile b/certs/Makefile > > index 9486ed924731..799ad7b9e68a 100644 > > --- a/certs/Makefile > > +++ b/certs/Makefile > > @@ -23,8 +23,8 @@ $(obj)/blacklist_hash_list: > > $(CONFIG_SYSTEM_BLACKLIST_HASH_LIST) FORCE > > targets += blacklist_hash_list > > > > quiet_cmd_extract_certs = CERT $@ > > - cmd_extract_certs = $(obj)/extract-cert $(extract-cert-in) $@ > > -extract-cert-in = $(or $(filter-out $(obj)/extract-cert, $(real-prereqs)),"") > > + cmd_extract_certs = $(obj)/extract-cert "$(extract-cert-in)" $@ > > +extract-cert-in = $(filter-out $(obj)/extract-cert, $(real-prereqs)) > > > > $(obj)/system_certificates.o: $(obj)/x509_certificate_list > > Thanks, this works im my tests, too. Can you send v2, please? I do not come up with a cleaner way for 2/2, so I am fine with it. > > Regards, > Jan > -- > Pengutronix e.K. | | > Steuerwalder Str. 21 | http://www.pengutronix.de/ | > 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | > Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | -- Best Regards Masahiro Yamada ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 2/2] kbuild: modinst: Fix build error when CONFIG_MODULE_SIG_KEY is a PKCS#11 URI 2023-01-30 14:15 [PATCH 0/2] Fix module signing with PKCS#11 URIs Jan Luebbe 2023-01-30 14:15 ` [PATCH 1/2] certs: Fix build error when PKCS#11 URI contains semicolon Jan Luebbe @ 2023-01-30 14:15 ` Jan Luebbe 1 sibling, 0 replies; 6+ messages in thread From: Jan Luebbe @ 2023-01-30 14:15 UTC (permalink / raw) To: Masahiro Yamada Cc: Jan Luebbe, David Howells, David Woodhouse, keyrings, linux-kbuild, linux-kernel, kernel When CONFIG_MODULE_SIG_KEY is PKCS#11 URI (pkcs11:*), signing of modules fails: scripts/sign-file sha256 /.../linux/pkcs11:token=foo;object=bar;pin-value=1111 certs/signing_key.x509 /.../kernel/crypto/tcrypt.ko Usage: scripts/sign-file [-dp] <hash algo> <key> <x509> <module> [<dest>] scripts/sign-file -s <raw sig> <hash algo> <x509> <module> [<dest>] First, we need to avoid adding the $(srctree)/ prefix to the URL. Second, since the kconfig string values no longer include quotes, we need to add them again when passing a PKCS#11 URI to sign-file. This avoids splitting by the shell if the URI contains semicolons. Fixes: 4db9c2e3d055 ("kbuild: stop using config_filename in scripts/Makefile.modsign") Fixes: 129ab0d2d9f3 ("kbuild: do not quote string values in include/config/auto.conf") Signed-off-by: Jan Luebbe <jlu@pengutronix.de> --- scripts/Makefile.modinst | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst index 836391e5d209..4815a8e32227 100644 --- a/scripts/Makefile.modinst +++ b/scripts/Makefile.modinst @@ -66,9 +66,13 @@ endif # Don't stop modules_install even if we can't sign external modules. # ifeq ($(CONFIG_MODULE_SIG_ALL),y) +ifeq ($(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)),) sig-key := $(if $(wildcard $(CONFIG_MODULE_SIG_KEY)),,$(srctree)/)$(CONFIG_MODULE_SIG_KEY) +else +sig-key := $(CONFIG_MODULE_SIG_KEY) +endif quiet_cmd_sign = SIGN $@ - cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(sig-key) certs/signing_key.x509 $@ \ + cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) "$(sig-key)" certs/signing_key.x509 $@ \ $(if $(KBUILD_EXTMOD),|| true) else quiet_cmd_sign := -- 2.30.2 ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-01-30 17:22 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2023-01-30 14:15 [PATCH 0/2] Fix module signing with PKCS#11 URIs Jan Luebbe 2023-01-30 14:15 ` [PATCH 1/2] certs: Fix build error when PKCS#11 URI contains semicolon Jan Luebbe 2023-01-30 15:18 ` Masahiro Yamada 2023-01-30 16:43 ` Jan Lübbe 2023-01-30 17:21 ` Masahiro Yamada 2023-01-30 14:15 ` [PATCH 2/2] kbuild: modinst: Fix build error when CONFIG_MODULE_SIG_KEY is a PKCS#11 URI Jan Luebbe
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®