| Message ID | 20210610125623.1553792-5-stefanb@linux.ibm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Add support for ECDSA-signed kernel modules | expand |
On Thu, Jun 10, 2021 at 08:56:23AM -0400, Stefan Berger wrote: > Adjust the previous patch due to fixes applied to the first patch > in the series. > > Fixes: 46449892e6e5 ("certs: Add support for using elliptic curve keys for signing modules") > Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> > --- > certs/Makefile | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/certs/Makefile b/certs/Makefile > index dc9f354dd5f8..4eb69bdadc79 100644 > --- a/certs/Makefile > +++ b/certs/Makefile > @@ -66,16 +66,21 @@ ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") > > ifeq ($(openssl_available),yes) > X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text) > +endif > > # Support user changing key type > ifdef CONFIG_MODULE_SIG_KEY_TYPE_ECDSA > keytype_openssl = -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 > +ifeq ($(openssl_available),yes) > $(if $(findstring id-ecPublicKey,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY))) > endif > +endif # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA > > ifdef CONFIG_MODULE_SIG_KEY_TYPE_RSA > +ifeq ($(openssl_available),yes) > $(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY))) > endif > +endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA > > $(obj)/signing_key.pem: $(obj)/x509.genkey > @$(kecho) "###" > -- > 2.29.2 > > Please check that they are applied correctly, thanks. /Jarkko
On 6/14/21 3:23 PM, Jarkko Sakkinen wrote: > On Thu, Jun 10, 2021 at 08:56:23AM -0400, Stefan Berger wrote: >> Adjust the previous patch due to fixes applied to the first patch >> in the series. >> >> Fixes: 46449892e6e5 ("certs: Add support for using elliptic curve keys for signing modules") >> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> >> --- >> certs/Makefile | 5 +++++ >> 1 file changed, 5 insertions(+) >> >> diff --git a/certs/Makefile b/certs/Makefile >> index dc9f354dd5f8..4eb69bdadc79 100644 >> --- a/certs/Makefile >> +++ b/certs/Makefile >> @@ -66,16 +66,21 @@ ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") >> >> ifeq ($(openssl_available),yes) >> X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text) >> +endif >> >> # Support user changing key type >> ifdef CONFIG_MODULE_SIG_KEY_TYPE_ECDSA >> keytype_openssl = -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 >> +ifeq ($(openssl_available),yes) >> $(if $(findstring id-ecPublicKey,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY))) >> endif >> +endif # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA >> >> ifdef CONFIG_MODULE_SIG_KEY_TYPE_RSA >> +ifeq ($(openssl_available),yes) >> $(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY))) >> endif >> +endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA >> >> $(obj)/signing_key.pem: $(obj)/x509.genkey >> @$(kecho) "###" >> -- >> 2.29.2 >> >> > Please check that they are applied correctly, thanks. No, they are not applied correctly. 2/2 shows this here: ifeq ($(openssl_available),yes) X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text) +endif + This endif is in 2/4 in v6 and should appear on your git in 1/2. How did it get into 2/2? https://lkml.org/lkml/2021/6/10/493 Stefan > > /Jarkko
On Mon, Jun 14, 2021 at 03:28:56PM -0400, Stefan Berger wrote: > > On 6/14/21 3:23 PM, Jarkko Sakkinen wrote: > > On Thu, Jun 10, 2021 at 08:56:23AM -0400, Stefan Berger wrote: > > > Adjust the previous patch due to fixes applied to the first patch > > > in the series. > > > > > > Fixes: 46449892e6e5 ("certs: Add support for using elliptic curve keys for signing modules") > > > Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> > > > --- > > > certs/Makefile | 5 +++++ > > > 1 file changed, 5 insertions(+) > > > > > > diff --git a/certs/Makefile b/certs/Makefile > > > index dc9f354dd5f8..4eb69bdadc79 100644 > > > --- a/certs/Makefile > > > +++ b/certs/Makefile > > > @@ -66,16 +66,21 @@ ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") > > > ifeq ($(openssl_available),yes) > > > X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text) > > > +endif > > > # Support user changing key type > > > ifdef CONFIG_MODULE_SIG_KEY_TYPE_ECDSA > > > keytype_openssl = -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 > > > +ifeq ($(openssl_available),yes) > > > $(if $(findstring id-ecPublicKey,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY))) > > > endif > > > +endif # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA > > > ifdef CONFIG_MODULE_SIG_KEY_TYPE_RSA > > > +ifeq ($(openssl_available),yes) > > > $(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY))) > > > endif > > > +endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA > > > $(obj)/signing_key.pem: $(obj)/x509.genkey > > > @$(kecho) "###" > > > -- > > > 2.29.2 > > > > > > > > Please check that they are applied correctly, thanks. > > No, they are not applied correctly. 2/2 shows this here: > > > ifeq ($(openssl_available),yes) > X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text) > +endif > + > > > This endif is in 2/4 in v6 and should appear on your git in 1/2. How did it > get into 2/2? > > https://lkml.org/lkml/2021/6/10/493 I assumed that the two other commits are exact same as in v4 because appropriate tags were mssing. /Jarkko
On 6/15/21 9:06 AM, Jarkko Sakkinen wrote: > On Mon, Jun 14, 2021 at 03:28:56PM -0400, Stefan Berger wrote: >> On 6/14/21 3:23 PM, Jarkko Sakkinen wrote: >>> On Thu, Jun 10, 2021 at 08:56:23AM -0400, Stefan Berger wrote: >>>> Adjust the previous patch due to fixes applied to the first patch >>>> in the series. >>>> >>>> Fixes: 46449892e6e5 ("certs: Add support for using elliptic curve keys for signing modules") >>>> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> >>>> --- >>>> certs/Makefile | 5 +++++ >>>> 1 file changed, 5 insertions(+) >>>> >>>> diff --git a/certs/Makefile b/certs/Makefile >>>> index dc9f354dd5f8..4eb69bdadc79 100644 >>>> --- a/certs/Makefile >>>> +++ b/certs/Makefile >>>> @@ -66,16 +66,21 @@ ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") >>>> ifeq ($(openssl_available),yes) >>>> X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text) >>>> +endif >>>> # Support user changing key type >>>> ifdef CONFIG_MODULE_SIG_KEY_TYPE_ECDSA >>>> keytype_openssl = -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 >>>> +ifeq ($(openssl_available),yes) >>>> $(if $(findstring id-ecPublicKey,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY))) >>>> endif >>>> +endif # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA >>>> ifdef CONFIG_MODULE_SIG_KEY_TYPE_RSA >>>> +ifeq ($(openssl_available),yes) >>>> $(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY))) >>>> endif >>>> +endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA >>>> $(obj)/signing_key.pem: $(obj)/x509.genkey >>>> @$(kecho) "###" >>>> -- >>>> 2.29.2 >>>> >>>> >>> Please check that they are applied correctly, thanks. >> No, they are not applied correctly. 2/2 shows this here: >> >> >> ifeq ($(openssl_available),yes) >> X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text) >> +endif >> + >> >> >> This endif is in 2/4 in v6 and should appear on your git in 1/2. How did it >> get into 2/2? >> >> https://lkml.org/lkml/2021/6/10/493 > I assumed that the two other commits are exact same as in v4 because > appropriate tags were mssing. What's in your git repo now looks good. Stefan > > /Jarkko
On Tue, Jun 15, 2021 at 09:29:08AM -0400, Stefan Berger wrote: > > On 6/15/21 9:06 AM, Jarkko Sakkinen wrote: > > On Mon, Jun 14, 2021 at 03:28:56PM -0400, Stefan Berger wrote: > > > On 6/14/21 3:23 PM, Jarkko Sakkinen wrote: > > > > On Thu, Jun 10, 2021 at 08:56:23AM -0400, Stefan Berger wrote: > > > > > Adjust the previous patch due to fixes applied to the first patch > > > > > in the series. > > > > > > > > > > Fixes: 46449892e6e5 ("certs: Add support for using elliptic curve keys for signing modules") > > > > > Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> > > > > > --- > > > > > certs/Makefile | 5 +++++ > > > > > 1 file changed, 5 insertions(+) > > > > > > > > > > diff --git a/certs/Makefile b/certs/Makefile > > > > > index dc9f354dd5f8..4eb69bdadc79 100644 > > > > > --- a/certs/Makefile > > > > > +++ b/certs/Makefile > > > > > @@ -66,16 +66,21 @@ ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") > > > > > ifeq ($(openssl_available),yes) > > > > > X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text) > > > > > +endif > > > > > # Support user changing key type > > > > > ifdef CONFIG_MODULE_SIG_KEY_TYPE_ECDSA > > > > > keytype_openssl = -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 > > > > > +ifeq ($(openssl_available),yes) > > > > > $(if $(findstring id-ecPublicKey,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY))) > > > > > endif > > > > > +endif # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA > > > > > ifdef CONFIG_MODULE_SIG_KEY_TYPE_RSA > > > > > +ifeq ($(openssl_available),yes) > > > > > $(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY))) > > > > > endif > > > > > +endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA > > > > > $(obj)/signing_key.pem: $(obj)/x509.genkey > > > > > @$(kecho) "###" > > > > > -- > > > > > 2.29.2 > > > > > > > > > > > > > > Please check that they are applied correctly, thanks. > > > No, they are not applied correctly. 2/2 shows this here: > > > > > > > > > ifeq ($(openssl_available),yes) > > > X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text) > > > +endif > > > + > > > > > > > > > This endif is in 2/4 in v6 and should appear on your git in 1/2. How did it > > > get into 2/2? > > > > > > https://lkml.org/lkml/2021/6/10/493 > > I assumed that the two other commits are exact same as in v4 because > > appropriate tags were mssing. > > What's in your git repo now looks good. OK, great. /Jarkko
diff --git a/certs/Makefile b/certs/Makefile index dc9f354dd5f8..4eb69bdadc79 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -66,16 +66,21 @@ ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") ifeq ($(openssl_available),yes) X509TEXT=$(shell openssl x509 -in $(CONFIG_MODULE_SIG_KEY) -text) +endif # Support user changing key type ifdef CONFIG_MODULE_SIG_KEY_TYPE_ECDSA keytype_openssl = -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 +ifeq ($(openssl_available),yes) $(if $(findstring id-ecPublicKey,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY))) endif +endif # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA ifdef CONFIG_MODULE_SIG_KEY_TYPE_RSA +ifeq ($(openssl_available),yes) $(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f $(CONFIG_MODULE_SIG_KEY))) endif +endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA $(obj)/signing_key.pem: $(obj)/x509.genkey @$(kecho) "###"
Adjust the previous patch due to fixes applied to the first patch in the series. Fixes: 46449892e6e5 ("certs: Add support for using elliptic curve keys for signing modules") Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> --- certs/Makefile | 5 +++++ 1 file changed, 5 insertions(+)