From: Marc Kleine-Budde <mkl@pengutronix.de>
To: Michael Olbrich <m.olbrich@pengutronix.de>
Cc: Denis Osterland-Heim <denis.osterland@diehl.com>,
"ptxdist@pengutronix.de" <ptxdist@pengutronix.de>
Subject: Re: [ptxdist] [PATCH] kernel: do not strip signed modules
Date: Tue, 30 Mar 2021 10:22:40 +0200 [thread overview]
Message-ID: <20210330082240.qdw6w6q7zkthhwj2@pengutronix.de> (raw)
In-Reply-To: <20210330075346.GA4162561@pengutronix.de>
[-- Attachment #1.1: Type: text/plain, Size: 3281 bytes --]
On 30.03.2021 09:53:46, Michael Olbrich wrote:
> On Tue, Mar 30, 2021 at 06:08:10AM +0000, Denis Osterland-Heim wrote:
> > If CONFIG_MODULE_SIG_ALL is set in kernelconfig then modules will be
> > automatically signed during the modules_install phase of a kernel build.
> >
> > Signed modules are BRITTLE as the signature is outside of the defined ELF
> > container. Thus they MAY NOT be stripped once the signature is computed
> > and attached. Note the entire module is the signed payload, including any
> > and all debug information present at the time of signing.
>
> Hmm, we had the same issue at some point. The solution was a local copy of
> the shell code that does the stripping and installing. I think we added
> some code to sign the Modules again.
> The result was nice, but the whole thing was rather invasive and makes
> assumptions on how the module signing works internally in the kernel.
> So it was not something that I wanted to merge mainline that way.
>
> In general, I like this approach better. But there are two issues with it.
>
> 1. There are redundant options and if the uses gets it wrong then it wont
> fail at build time. We can get this from the kernelconfig:
> '$(shell ptxd_get_kconfig $(KERNEL_CONFIG) CONFIG_MODULE_SIG_ALL)' I think.
> But we have to make sure that it's not evaluated too early. To avoid
> slowing down ptxdist startup.
>
> 2. The modules are not stripped at all. So we should set
> INSTALL_MOD_STRIP=1 in this case.
>
> Marc, what do you think?
The current diff for module re-signing looks like this:
| # $1: file to strip
| #
| # $strip: k for kernel modules
| @@ -425,8 +15,26 @@ ptxd_install_file_strip() {
| esac
|
| files=( "${sdirs[@]/%/${dst}}" )
| install -d "${files[0]%/*}" &&
| "${strip_cmd[@]}" -o "${files[0]}" "${src}" &&
| + if [ "${strip}" = "k" -a -e "${pkg_build_dir}/scripts/sign-file" -a -n "${CONFIG_MODULE_SIG_KEY}" ]; then
| + local sig_hash
| +
| + sig_hash="$(ptxd_get_kconfig "${pkg_config}" CONFIG_MODULE_SIG_HASH)" || return
| +
| + echo "sign module:"
| + echo " file=$(ptxd_print_path ${files[0]})"
| + echo " key=${CONFIG_MODULE_SIG_KEY}"
| + echo " cert=$(ptxd_print_path ${pkg_build_dir}/certs/signing_key.x509)"
| + echo " hash=${sig_hash}"
| + echo
| + "${pkg_build_dir}/scripts/sign-file" \
| + "${sig_hash}" \
| + "${CONFIG_MODULE_SIG_KEY}" \
| + "${pkg_build_dir}/certs/signing_key.x509" \
| + "${files[0]}" || return
| + fi
| +
| for (( i=1 ; ${i} < ${#files[@]} ; i=$[i+1] )); do
| install -m "${mod_rw}" -D "${files[0]}" "${files[${i}]}" || return
| done &&
| @@ -443,658 +51,3 @@ ptxd_install_file_strip() {
| fi
| }
If we don't want to re-sign, we can use the above "if [ "${strip}" = "k"
-a ... ]" and don't strip. This means no changes in the kernel.make
files are needed.
Marc
--
Pengutronix e.K. | Marc Kleine-Budde |
Embedded Linux | https://www.pengutronix.de |
Vertretung West/Dortmund | Phone: +49-231-2826-924 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
[-- Attachment #2: Type: text/plain, Size: 181 bytes --]
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
next prev parent reply other threads:[~2021-03-30 8:22 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-30 6:08 Denis Osterland-Heim
2021-03-30 7:53 ` Michael Olbrich
2021-03-30 8:22 ` Marc Kleine-Budde [this message]
2021-03-30 8:39 ` Michael Olbrich
2021-03-30 8:57 ` Marc Kleine-Budde
2021-03-30 9:53 ` Denis Osterland-Heim
2021-03-30 10:03 ` m.olbrich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210330082240.qdw6w6q7zkthhwj2@pengutronix.de \
--to=mkl@pengutronix.de \
--cc=denis.osterland@diehl.com \
--cc=m.olbrich@pengutronix.de \
--cc=ptxdist@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox