From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Date: Tue, 30 Mar 2021 12:03:47 +0200 From: "m.olbrich@pengutronix.de" Message-ID: <20210330100347.GB12201@pengutronix.de> References: <968ee15dc49b1c81d53ef8b28f8d4c0eb50b88d4.camel@diehl.com> <20210330075346.GA4162561@pengutronix.de> <80f5ae32a550bc68f16db2bb4b18327cf1862c99.camel@diehl.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <80f5ae32a550bc68f16db2bb4b18327cf1862c99.camel@diehl.com> Subject: Re: [ptxdist] [PATCH] kernel: do not strip signed modules List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Errors-To: ptxdist-bounces@pengutronix.de Sender: "ptxdist" To: Denis Osterland-Heim Cc: "mkl@pengutronix.de" , "ptxdist@pengutronix.de" On Tue, Mar 30, 2021 at 09:53:25AM +0000, Denis Osterland-Heim wrote: > Hi, > = > Thanks for the input. > = > >$(mod_strip_cmd) $(2)/$(notdir $@) ; \ > >$(mod_sign_cmd) $(2)/$(notdir $@) $(patsubst %,|| true,$(KBUILD_EXTMOD))= ; \ > from scripts/Makefile.modinst > = > As far as I got it, with INSTALL_MOD_STRIP=3D"--strip-debug -R .GCC.comma= nd.line" in KERNEL_MAKE_OPT > and always strip=3Dn in targetinstall it should work identically with sig= ned modules and without. We should add TARGET_COMPILER_RECORD_SWITCHES to the kernel blacklist. Then .GCC.command.line won't show up at all. I've seen the kernel complain about it anyways, but I keep forgetting it. At that point only '--strip-debug' is necessary and that's the default, so INSTALL_MOD_STRIP=3D1 works too. And about always stripping: I think we should do this. In the past, we hat a separate debug nfsroot directory but that's long gone. And for kernel modules we don't actually keep a separate debug file. So we don't actually keep a unstripped version. So stripping early is fine. I think, the unstripped version remains in the build tree, so if someone needs the debug symbols, they can look there. > What do you and Marc think? I'm not a kernel developer, so Marc, does that make sense to you? Michael > Am Dienstag, den 30.03.2021, 09:53 +0200 schrieb Michael Olbrich: > > On Tue, Mar 30, 2021 at 06:08:10AM +0000, Denis Osterland-Heim wrote: > > > If CONFIG_MODULE_SIG_ALL is set in kernelconfig then modules will be > > > automatically signed during the modules_install phase of a kernel bui= ld. > > > > > > Signed modules are BRITTLE as the signature is outside of the defined= ELF > > > container. Thus they MAY NOT be stripped once the signature is comput= ed > > > and attached. Note the entire module is the signed payload, including= any > > > and all debug information present at the time of signing. > > > > Hmm, we had the same issue at some point. The solution was a local cop= y of > > the shell code that does the stripping and installing. I think we added > > some code to sign the Modules again. > > The result was nice, but the whole thing was rather invasive and makes > > assumptions on how the module signing works internally in the kernel. > > So it was not something that I wanted to merge mainline that way. > > > > In general, I like this approach better. But there are two issues with = it. > > > > 1. There are redundant options and if the uses gets it wrong then it wo= nt > > fail at build time. We can get this from the kernelconfig: > > '$(shell ptxd_get_kconfig $(KERNEL_CONFIG) CONFIG_MODULE_SIG_ALL)' I th= ink. > > But we have to make sure that it's not evaluated too early. To avoid > > slowing down ptxdist startup. > > > > 2. The modules are not stripped at all. So we should set > > INSTALL_MOD_STRIP=3D1 in this case. > > > > Marc, what do you think? > > > > Michael > > > > > See: https://www.kernel.org/doc/html/latest/admin-guide/module-signin= g.html > > > Signed-off-by: Denis Osterland-Heim > > > --- > > > platforms/kernel.in | 7 +++++++ > > > rules/kernel.make | 3 ++- > > > 2 files changed, 9 insertions(+), 1 deletion(-) > > > > > > diff --git a/platforms/kernel.in b/platforms/kernel.in > > > index 68899c0f7..8b9473b03 100644 > > > --- a/platforms/kernel.in > > > +++ b/platforms/kernel.in > > > @@ -32,6 +32,13 @@ config KERNEL_MODULES > > > default y > > > prompt "build kernel-modules" > > > > > > +config KERNEL_MODULES_SIGNED > > > +bool "kernel-modules are signed on install" > > > +depends on KERNEL_MODULES > > > +help > > > + Set this to y if CONFIG_MODULE_SIG_ALL is y in kernelconfig. > > > + Otherwise the strip would damage automatically generated signature. > > > + > > > config KERNEL_MODULES_INSTALL > > > bool > > > default y > > > diff --git a/rules/kernel.make b/rules/kernel.make > > > index ea748fc8a..c964bd672 100644 > > > --- a/rules/kernel.make > > > +++ b/rules/kernel.make > > > @@ -313,7 +313,8 @@ ifdef PTXCONF_KERNEL_MODULES_INSTALL > > > @$(call install_fixup, kernel-modules, AUTHOR,"Robert Schwebel ") > > > @$(call install_fixup, kernel-modules, DESCRIPTION,missing) > > > > > > -@$(call install_glob, kernel-modules, 0, 0, -, /lib/modules, *.ko,, = k) > > > +@$(call install_glob, kernel-modules, 0, 0, -, /lib/modules, *.ko,, \ > > > +$(call ptx/ifdef,PTXCONF_KERNEL_MODULES_SIGNED,n,k)) > > > @$(call install_glob, kernel-modules, 0, 0, -, /lib/modules,, *.ko *= /build */source, n) > > > > > > @$(call install_finish, kernel-modules) > > > -- > > > 2.31.1 > > > > > > _______________________________________________ > > > ptxdist mailing list > > > ptxdist@pengutronix.de > > > To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-req= uest@pengutronix.de > Diehl Connectivity Solutions GmbH > Gesch=E4ftsf=FChrung: Horst Leonberger > Sitz der Gesellschaft: N=FCrnberg - Registergericht: Amtsgericht > N=FCrnberg: HRB 32315 > = > ________________________________ > = > Der Inhalt der vorstehenden E-Mail ist nicht rechtlich bindend. Diese E-M= ail enthaelt vertrauliche und/oder rechtlich geschuetzte Informationen. > Informieren Sie uns bitte, wenn Sie diese E-Mail faelschlicherweise erhal= ten haben. Bitte loeschen Sie in diesem Fall die Nachricht. > Jede unerlaubte Form der Reproduktion, Bekanntgabe, Aenderung, Verteilung= und/oder Publikation dieser E-Mail ist strengstens untersagt. > = > - Informationen zum Datenschutz, insbesondere zu Ihren Rechten, erhalten = Sie unter: > = > https://www.diehl.com/group/de/transparenz-und-informationspflichten/ > = > The contents of the above mentioned e-mail is not legally binding. This e= -mail contains confidential and/or legally protected information. Please in= form us if you have received this e-mail by > mistake and delete it in such a case. Each unauthorized reproduction, dis= closure, alteration, distribution and/or publication of this e-mail is stri= ctly prohibited. > = > - For general information on data protection and your respective rights p= lease visit: > = > https://www.diehl.com/group/en/transparency-and-information-obligations/ > = > = -- = Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | _______________________________________________ ptxdist mailing list ptxdist@pengutronix.de To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@p= engutronix.de