* [ptxdist] [PATCH v2] kernel: proper handle signed modules
@ 2021-03-31 5:17 Denis Osterland-Heim
2021-03-31 7:08 ` Michael Olbrich
0 siblings, 1 reply; 2+ messages in thread
From: Denis Osterland-Heim @ 2021-03-31 5:17 UTC (permalink / raw)
To: ptxdist
[-- Attachment #1: Type: text/plain, Size: 1305 bytes --]
Diehl Connectivity Solutions GmbH
Geschäftsführung: Horst Leonberger
Sitz der Gesellschaft: Nürnberg - Registergericht: Amtsgericht
Nürnberg: HRB 32315
________________________________
Der Inhalt der vorstehenden E-Mail ist nicht rechtlich bindend. Diese E-Mail enthaelt vertrauliche und/oder rechtlich geschuetzte Informationen.
Informieren Sie uns bitte, wenn Sie diese E-Mail faelschlicherweise erhalten haben. Bitte loeschen Sie in diesem Fall die Nachricht.
Jede unerlaubte Form der Reproduktion, Bekanntgabe, Aenderung, Verteilung und/oder Publikation dieser E-Mail ist strengstens untersagt.
- Informationen zum Datenschutz, insbesondere zu Ihren Rechten, erhalten Sie unter:
https://www.diehl.com/group/de/transparenz-und-informationspflichten/
The contents of the above mentioned e-mail is not legally binding. This e-mail contains confidential and/or legally protected information. Please inform us if you have received this e-mail by
mistake and delete it in such a case. Each unauthorized reproduction, disclosure, alteration, distribution and/or publication of this e-mail is strictly prohibited.
- For general information on data protection and your respective rights please visit:
https://www.diehl.com/group/en/transparency-and-information-obligations/
[-- Attachment #2: 20210331051336.5509-1-denis.osterland.mbox --]
[-- Type: application/mbox, Size: 2745 bytes --]
[-- Attachment #3: Type: text/plain, Size: 181 bytes --]
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [ptxdist] [PATCH v2] kernel: proper handle signed modules
2021-03-31 5:17 [ptxdist] [PATCH v2] kernel: proper handle signed modules Denis Osterland-Heim
@ 2021-03-31 7:08 ` Michael Olbrich
0 siblings, 0 replies; 2+ messages in thread
From: Michael Olbrich @ 2021-03-31 7:08 UTC (permalink / raw)
To: ptxdist
On Wed, Mar 31, 2021 at 05:17:11AM +0000, Denis Osterland-Heim wrote:
> If CONFIG_MODULE_SIG_ALL is set in kernelconfig then modules will be
> automatically signed during the modules_install phase of a kernel build.
>
> Signed modules are BRITTLE as the signature is outside of the defined ELF
> container. Thus they MAY NOT be stripped once the signature is computed
> and attached. Note the entire module is the signed payload, including any
> and all debug information present at the time of signing.
>
> See: https://www.kernel.org/doc/html/latest/admin-guide/module-signing.html
> Signed-off-by: Denis Osterland-Heim <denis.osterland@diehl.com>
> ---
> v1 -> v2:
> - remove config switch
> - do not strip at targetinstall unconditionally
> - use INSTALL_MOD_STRIP kbuild option to strip modules
> - add TARGET_COMPILER_RECORD_SWITCHES to wrapper blacklist
>
> rules/kernel.make | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/rules/kernel.make b/rules/kernel.make
> index ea748fc8a..94f57285e 100644
> --- a/rules/kernel.make
> +++ b/rules/kernel.make
> @@ -38,7 +38,8 @@ KERNEL_BUILD_OOT := KEEP
>
> # use CONFIG_CC_STACKPROTECTOR if available. The rest makes no sense for the kernel
> KERNEL_WRAPPER_BLACKLIST := \
> - $(PTXDIST_LOWLEVEL_WRAPPER_BLACKLIST)
> + $(PTXDIST_LOWLEVEL_WRAPPER_BLACKLIST) \
> + TARGET_COMPILER_RECORD_SWITCHES
Oh, I meant adding this to PTXDIST_LOWLEVEL_WRAPPER_BLACKLIST. That should
be a separate commit. Adding it to any lowlevel Code may be problematic,
because that stuff is never stripped by ptxdist. It' probably not a problem
in most cases, because most custom linker scripts drop the section anyways,
but better save than sorry.
I should have made it clearer what I meant here, sorry.
Regards,
Michael
>
> # Note: for some reason, the error is not visible without the dummy '$(shell :)'
> # when running 'ptxdist -j -q go'.
> @@ -61,6 +62,7 @@ KERNEL_BASE_OPT := \
> CROSS_COMPILE=$(KERNEL_CROSS_COMPILE) \
> DEPMOD=$(PTXDIST_SYSROOT_HOST)/sbin/depmod \
> \
> + INSTALL_MOD_STRIP=1 \
> INSTALL_MOD_PATH=$(KERNEL_PKGDIR) \
> PTX_KERNEL_DIR=$(KERNEL_DIR) \
> $(call remove_quotes,$(PTXCONF_KERNEL_EXTRA_MAKEVARS))
> @@ -313,7 +315,7 @@ ifdef PTXCONF_KERNEL_MODULES_INSTALL
> @$(call install_fixup, kernel-modules, AUTHOR,"Robert Schwebel <r.schwebel@pengutronix.de>")
> @$(call install_fixup, kernel-modules, DESCRIPTION,missing)
>
> - @$(call install_glob, kernel-modules, 0, 0, -, /lib/modules, *.ko,, k)
> + @$(call install_glob, kernel-modules, 0, 0, -, /lib/modules, *.ko,, n)
> @$(call install_glob, kernel-modules, 0, 0, -, /lib/modules,, *.ko */build */source, n)
>
> @$(call install_finish, kernel-modules)
> --
> 2.31.1
>
> _______________________________________________
> ptxdist mailing list
> ptxdist@pengutronix.de
> To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-03-31 7:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-31 5:17 [ptxdist] [PATCH v2] kernel: proper handle signed modules Denis Osterland-Heim
2021-03-31 7:08 ` Michael Olbrich
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox