From patchwork Tue Apr 26 18:52:01 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Benjamin Poirier X-Patchwork-Id: 8943231 Return-Path: X-Original-To: patchwork-linux-kbuild@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 6B8FB9F1D3 for ; Tue, 26 Apr 2016 18:52:24 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 903592013D for ; Tue, 26 Apr 2016 18:52:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 956AD20138 for ; Tue, 26 Apr 2016 18:52:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752483AbcDZSwV (ORCPT ); Tue, 26 Apr 2016 14:52:21 -0400 Received: from mx2.suse.de ([195.135.220.15]:34080 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752273AbcDZSwV (ORCPT ); Tue, 26 Apr 2016 14:52:21 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay1.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id CDE6DABF6; Tue, 26 Apr 2016 18:52:17 +0000 (UTC) From: Benjamin Poirier To: Steven Rostedt Cc: Michal Marek , joeyli , "Yann E . MORIN " , linux-kbuild@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2] localmodconfig: Reset certificate paths Date: Tue, 26 Apr 2016 11:52:01 -0700 Message-Id: <1461696721-3001-1-git-send-email-bpoirier@suse.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <20160426185122.GA2979@f1.synalogic.ca> References: <20160426185122.GA2979@f1.synalogic.ca> Sender: linux-kbuild-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kbuild@vger.kernel.org X-Spam-Status: No, score=-7.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP When using `make localmodconfig` and friends, if the input config comes from a kernel that was built in a different environment (for example, the canonical case of using localmodconfig to trim a distribution kernel config) the key files for module signature checking will not be available and should be regenerated or omitted. Otherwise, the user will be faced with annoying errors when trying to build with the generated .config: make[1]: *** No rule to make target 'keyring.crt', needed by 'certs/x509_certificate_list'. Stop. Makefile:1576: recipe for target 'certs/' failed Signed-off-by: Benjamin Poirier --- scripts/kconfig/streamline_config.pl | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl index 01b53ec..95a6f2b 100755 --- a/scripts/kconfig/streamline_config.pl +++ b/scripts/kconfig/streamline_config.pl @@ -610,6 +610,40 @@ foreach my $line (@config_file) { next; } + if (/CONFIG_MODULE_SIG_KEY="(.+)"/) { + my $orig_cert = $1; + my $default_cert = "certs/signing_key.pem"; + + # Check that the logic in this script still matches the one in Kconfig + if (!defined($depends{"MODULE_SIG_KEY"}) || + $depends{"MODULE_SIG_KEY"} !~ /"\Q$default_cert\E"/) { + print STDERR "WARNING: MODULE_SIG_KEY assertion failure, ", + "update needed to ", __FILE__, " line ", __LINE__, "\n"; + print; + } elsif ($orig_cert ne $default_cert && ! -f $orig_cert) { + print STDERR "Module signature verification enabled but ", + "module signing key \"$orig_cert\" not found. Resetting ", + "signing key to default value.\n"; + print "CONFIG_MODULE_SIG_KEY=\"$default_cert\"\n"; + } else { + print; + } + next; + } + + if (/CONFIG_SYSTEM_TRUSTED_KEYS="(.+)"/) { + my $orig_keys = $1; + + if (! -f $orig_keys) { + print STDERR "System keyring enabled but keys \"$orig_keys\" ", + "not found. Resetting keys to default value.\n"; + print "CONFIG_SYSTEM_TRUSTED_KEYS=\"\"\n"; + } else { + print; + } + next; + } + if (/^(CONFIG.*)=(m|y)/) { if (defined($configs{$1})) { if ($localyesconfig) {