* Building signed debs
@ 2023-12-08 11:14 Tom Cook
2023-12-08 12:06 ` Bagas Sanjaya
2023-12-09 18:17 ` Masahiro Yamada
0 siblings, 2 replies; 6+ messages in thread
From: Tom Cook @ 2023-12-08 11:14 UTC (permalink / raw)
To: LKML
I'm trying to build a signed .deb kernel package of
https://github.com/torvalds/linux/tree/v6.6. I've copied
certs/default_x509.genkey to certs/x509.genkey. The .config is the
one from Ubuntu 23.10's default kernel with all new options accepted
at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and
CONFIG_SYSTEM_REVOCATION_KEYS="".
This builds the kernel and modules, signs the modules, compresses the
modules and then attempts to sign the modules again. That fails,
because the .ko module files are now .ko.zst files and the file it's
trying to sign isn't there. Full failure is pasted below.
Unsetting CONFIG_MODULE_COMPRESS_ZSTD is a workaround (ie disable
module compression).
Is there a way to build a .deb of a signed kernel with compressed modules?
Thanks for any help,
Tom
INSTALL debian/linux-libc-dev/usr/include
SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko
SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or
directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko
SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or
directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko
SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko
make[6]: *** [scripts/Makefile.modinst:137:
debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko]
Error 1
make[6]: *** Waiting for unfinished jobs....
make[6]: *** [scripts/Makefile.modinst:137:
debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko]
Error 1
SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or
directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko
make[6]: *** [scripts/Makefile.modinst:137:
debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko]
Error 1
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or
directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko
make[6]: *** [scripts/Makefile.modinst:137:
debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko]
Error 1
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or
directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko
make[6]: *** [scripts/Makefile.modinst:137:
debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko]
Error 1
make[5]: *** [Makefile:1821: modules_install] Error 2
make[4]: *** [Makefile:2036: run-command] Error 2
make[3]: *** [debian/rules:17: binary-arch] Error 2
dpkg-buildpackage: error: make -f debian/rules binary subprocess
returned exit status 2
make[2]: *** [scripts/Makefile.package:146: bindeb-pkg] Error 2
make[1]: *** [/home/tkcook/git/linux/v6.6/Makefile:1538: bindeb-pkg] Error 2
make: *** [Makefile:234: __sub-make] Error 2
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Building signed debs
2023-12-08 11:14 Building signed debs Tom Cook
@ 2023-12-08 12:06 ` Bagas Sanjaya
2023-12-11 10:24 ` Tom Cook
2023-12-09 18:17 ` Masahiro Yamada
1 sibling, 1 reply; 6+ messages in thread
From: Bagas Sanjaya @ 2023-12-08 12:06 UTC (permalink / raw)
To: Tom Cook, Linux Kernel Mailing List, Linux Kernel Build System,
Linux Crypto API
Cc: Masahiro Yamada, Herbert Xu, David S. Miller, Nick Terrell
[-- Attachment #1: Type: text/plain, Size: 2000 bytes --]
On Fri, Dec 08, 2023 at 11:14:35AM +0000, Tom Cook wrote:
> I'm trying to build a signed .deb kernel package of
> https://github.com/torvalds/linux/tree/v6.6. I've copied
> certs/default_x509.genkey to certs/x509.genkey. The .config is the
> one from Ubuntu 23.10's default kernel with all new options accepted
> at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and
> CONFIG_SYSTEM_REVOCATION_KEYS="".
>
> This builds the kernel and modules, signs the modules, compresses the
> modules and then attempts to sign the modules again. That fails,
> because the .ko module files are now .ko.zst files and the file it's
> trying to sign isn't there. Full failure is pasted below.
>
> Unsetting CONFIG_MODULE_COMPRESS_ZSTD is a workaround (ie disable
> module compression).
>
Seriously? Unrelated option becomes a workaround?
> Is there a way to build a .deb of a signed kernel with compressed modules?
>
> Thanks for any help,
> Tom
>
> INSTALL debian/linux-libc-dev/usr/include
> SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko
> SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko
> At main.c:298:
> - SSL error:FFFFFFFF80000002:system library::No such file or
> directory: ../crypto/bio/bss_file.c:67
Above means that you don't have a valid certificate/keypair set in
CONFIG_MODULE_SIG_KEY. If you keep the option value on `certs/signing_key.pem`
(which is the default), the key should be automatically generated
(with your observation, only if `certs/x509.genkey` doesn't already exist).
After building the kernel with `make all`, you should check if the certificate
pointed in CONFIG_MODULE_SIG_KEY is present or not. If it isn't the case,
you have to generate the certificate yourself. For more information, see
Documentation/admin-guide/module.signing.rst in the kernel sources.
Thanks.
--
An old man doll... just what I always wanted! - Clara
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Building signed debs
2023-12-08 11:14 Building signed debs Tom Cook
2023-12-08 12:06 ` Bagas Sanjaya
@ 2023-12-09 18:17 ` Masahiro Yamada
2023-12-11 10:19 ` Tom Cook
1 sibling, 1 reply; 6+ messages in thread
From: Masahiro Yamada @ 2023-12-09 18:17 UTC (permalink / raw)
To: Tom Cook, linux-modules; +Cc: LKML
On Fri, Dec 8, 2023 at 8:14 PM Tom Cook <tom.k.cook@gmail.com> wrote:
>
> I'm trying to build a signed .deb kernel package of
> https://github.com/torvalds/linux/tree/v6.6. I've copied
> certs/default_x509.genkey to certs/x509.genkey. The .config is the
> one from Ubuntu 23.10's default kernel with all new options accepted
> at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and
> CONFIG_SYSTEM_REVOCATION_KEYS="".
>
> This builds the kernel and modules, signs the modules, compresses the
> modules and then attempts to sign the modules again. That fails,
> because the .ko module files are now .ko.zst files and the file it's
> trying to sign isn't there. Full failure is pasted below.
Modules are signed before the compression.
Once you compress modules, you cannot re-sign them again unless
you decompress modules, sign them, and compress them again.
Now, the kernel can directly load compressed modules, so
perhaps allowing users to sign compressed modules might
be beneficial.
(that is, reverse the order of singing and compression)
I am not sure whether it is possible or not, though.
I added linux-modules ML.
>
> Unsetting CONFIG_MODULE_COMPRESS_ZSTD is a workaround (ie disable
> module compression).
>
> Is there a way to build a .deb of a signed kernel with compressed modules?
>
> Thanks for any help,
> Tom
>
> INSTALL debian/linux-libc-dev/usr/include
> SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko
> SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko
> At main.c:298:
> - SSL error:FFFFFFFF80000002:system library::No such file or
> directory: ../crypto/bio/bss_file.c:67
> - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
> sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko
> SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko
> At main.c:298:
> - SSL error:FFFFFFFF80000002:system library::No such file or
> directory: ../crypto/bio/bss_file.c:67
> - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
> sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko
> SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko
> make[6]: *** [scripts/Makefile.modinst:137:
> debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko]
> Error 1
> make[6]: *** Waiting for unfinished jobs....
> make[6]: *** [scripts/Makefile.modinst:137:
> debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko]
> Error 1
> SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko
> At main.c:298:
> - SSL error:FFFFFFFF80000002:system library::No such file or
> directory: ../crypto/bio/bss_file.c:67
> - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
> sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko
> make[6]: *** [scripts/Makefile.modinst:137:
> debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko]
> Error 1
> At main.c:298:
> - SSL error:FFFFFFFF80000002:system library::No such file or
> directory: ../crypto/bio/bss_file.c:67
> - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
> sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko
> make[6]: *** [scripts/Makefile.modinst:137:
> debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko]
> Error 1
> At main.c:298:
> - SSL error:FFFFFFFF80000002:system library::No such file or
> directory: ../crypto/bio/bss_file.c:67
> - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
> sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko
> make[6]: *** [scripts/Makefile.modinst:137:
> debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko]
> Error 1
> make[5]: *** [Makefile:1821: modules_install] Error 2
> make[4]: *** [Makefile:2036: run-command] Error 2
> make[3]: *** [debian/rules:17: binary-arch] Error 2
> dpkg-buildpackage: error: make -f debian/rules binary subprocess
> returned exit status 2
> make[2]: *** [scripts/Makefile.package:146: bindeb-pkg] Error 2
> make[1]: *** [/home/tkcook/git/linux/v6.6/Makefile:1538: bindeb-pkg] Error 2
> make: *** [Makefile:234: __sub-make] Error 2
--
Best Regards
Masahiro Yamada
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Building signed debs
2023-12-09 18:17 ` Masahiro Yamada
@ 2023-12-11 10:19 ` Tom Cook
2023-12-11 18:15 ` Masahiro Yamada
0 siblings, 1 reply; 6+ messages in thread
From: Tom Cook @ 2023-12-11 10:19 UTC (permalink / raw)
To: Masahiro Yamada; +Cc: linux-modules, LKML
On Sat, Dec 9, 2023 at 6:18 PM Masahiro Yamada <masahiroy@kernel.org> wrote:
> On Fri, Dec 8, 2023 at 8:14 PM Tom Cook <tom.k.cook@gmail.com> wrote:
> >
> > I'm trying to build a signed .deb kernel package of
> > https://github.com/torvalds/linux/tree/v6.6. I've copied
> > certs/default_x509.genkey to certs/x509.genkey. The .config is the
> > one from Ubuntu 23.10's default kernel with all new options accepted
> > at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and
> > CONFIG_SYSTEM_REVOCATION_KEYS="".
> >
> > This builds the kernel and modules, signs the modules, compresses the
> > modules and then attempts to sign the modules again. That fails,
> > because the .ko module files are now .ko.zst files and the file it's
> > trying to sign isn't there. Full failure is pasted below.
>
>
>
> Modules are signed before the compression.
Reading back through my earlier email, I wasn't clear that when I said "This
builds the kernel..." I meant "`make deb-pkg` builds the kernel". I'm not
doing anything outlandish here, I think, just expecting the build system to
work.
Regards,
Tom
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Building signed debs
2023-12-08 12:06 ` Bagas Sanjaya
@ 2023-12-11 10:24 ` Tom Cook
0 siblings, 0 replies; 6+ messages in thread
From: Tom Cook @ 2023-12-11 10:24 UTC (permalink / raw)
To: Bagas Sanjaya
Cc: Linux Kernel Mailing List, Linux Kernel Build System,
Linux Crypto API, Masahiro Yamada, Herbert Xu, David S. Miller,
Nick Terrell
On Fri, Dec 8, 2023 at 12:06 PM Bagas Sanjaya <bagasdotme@gmail.com> wrote:
> On Fri, Dec 08, 2023 at 11:14:35AM +0000, Tom Cook wrote:
> > Unsetting CONFIG_MODULE_COMPRESS_ZSTD is a workaround (ie disable
> > module compression).
> >
>
> Seriously? Unrelated option becomes a workaround?
"Workaround" as in "With this options set, `make deb-pkg` crashes out with the
reported error, while with this option unset it produces a deb package
of a signed
kernel and modules." This looks like a defect in the build system to me and the
workaround allows me to build a package in the meantime.
> > Is there a way to build a .deb of a signed kernel with compressed modules?
> >
> > Thanks for any help,
> > Tom
> >
> > INSTALL debian/linux-libc-dev/usr/include
> > SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko
> > SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko
> > At main.c:298:
> > - SSL error:FFFFFFFF80000002:system library::No such file or
> > directory: ../crypto/bio/bss_file.c:67
>
> Above means that you don't have a valid certificate/keypair set in
> CONFIG_MODULE_SIG_KEY. If you keep the option value on `certs/signing_key.pem`
> (which is the default), the key should be automatically generated
> (with your observation, only if `certs/x509.genkey` doesn't already exist).
> After building the kernel with `make all`, you should check if the certificate
> pointed in CONFIG_MODULE_SIG_KEY is present or not. If it isn't the case,
> you have to generate the certificate yourself. For more information, see
> Documentation/admin-guide/module.signing.rst in the kernel sources.
Sorry for being unclear - I'm not building with `make all`, I'm
building with `make deb-pkg`.
If I had to guess, I'd say the .deb depends on the uncompressed modules
rather than the dependency depending on whether module compression is turned
on or not, but it's only a guess.
Regards,
Tom
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Building signed debs
2023-12-11 10:19 ` Tom Cook
@ 2023-12-11 18:15 ` Masahiro Yamada
0 siblings, 0 replies; 6+ messages in thread
From: Masahiro Yamada @ 2023-12-11 18:15 UTC (permalink / raw)
To: Tom Cook; +Cc: linux-modules, LKML
On Mon, Dec 11, 2023 at 7:19 PM Tom Cook <tom.k.cook@gmail.com> wrote:
>
> On Sat, Dec 9, 2023 at 6:18 PM Masahiro Yamada <masahiroy@kernel.org> wrote:
> > On Fri, Dec 8, 2023 at 8:14 PM Tom Cook <tom.k.cook@gmail.com> wrote:
> > >
> > > I'm trying to build a signed .deb kernel package of
> > > https://github.com/torvalds/linux/tree/v6.6. I've copied
> > > certs/default_x509.genkey to certs/x509.genkey. The .config is the
> > > one from Ubuntu 23.10's default kernel with all new options accepted
> > > at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and
> > > CONFIG_SYSTEM_REVOCATION_KEYS="".
> > >
> > > This builds the kernel and modules, signs the modules, compresses the
> > > modules and then attempts to sign the modules again. That fails,
> > > because the .ko module files are now .ko.zst files and the file it's
> > > trying to sign isn't there. Full failure is pasted below.
> >
> >
> >
> > Modules are signed before the compression.
>
> Reading back through my earlier email, I wasn't clear that when I said "This
> builds the kernel..." I meant "`make deb-pkg` builds the kernel". I'm not
> doing anything outlandish here, I think, just expecting the build system to
> work.
>
> Regards,
> Tom
OK, I understood.
The error is caused by the following lines
in scripts/package/builddeb:
# re-sign stripped modules
if is_enabled CONFIG_MODULE_SIG_ALL; then
${MAKE} -f ${srctree}/Makefile
INSTALL_MOD_PATH="${image_pdir}" modules_sign
fi
The error happens when all of the following three
are enabled.
- CONFIG_DEBUG_INFO
- CONFIG_MODULE_SIG_ALL
- CONFIG_MODULE_COMPRESS_*
If you disable one of them, you can do deb-pkg.
--
Best Regards
Masahiro Yamada
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-12-11 18:16 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-12-08 11:14 Building signed debs Tom Cook
2023-12-08 12:06 ` Bagas Sanjaya
2023-12-11 10:24 ` Tom Cook
2023-12-09 18:17 ` Masahiro Yamada
2023-12-11 10:19 ` Tom Cook
2023-12-11 18:15 ` Masahiro Yamada
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®