From: Denis Osterland-Heim <denis.osterland@diehl.com>
To: "ptxdist@pengutronix.de" <ptxdist@pengutronix.de>,
"m.olbrich@pengutronix.de" <m.olbrich@pengutronix.de>
Cc: "mkl@pengutronix.de" <mkl@pengutronix.de>
Subject: Re: [ptxdist] [PATCH] kernel: do not strip signed modules
Date: Tue, 30 Mar 2021 09:53:25 +0000 [thread overview]
Message-ID: <80f5ae32a550bc68f16db2bb4b18327cf1862c99.camel@diehl.com> (raw)
In-Reply-To: <20210330075346.GA4162561@pengutronix.de>
Hi,
Thanks for the input.
>$(mod_strip_cmd) $(2)/$(notdir $@) ; \
>$(mod_sign_cmd) $(2)/$(notdir $@) $(patsubst %,|| true,$(KBUILD_EXTMOD)) ; \
from scripts/Makefile.modinst
As far as I got it, with INSTALL_MOD_STRIP="--strip-debug -R .GCC.command.line" in KERNEL_MAKE_OPT
and always strip=n in targetinstall it should work identically with signed modules and without.
What do you and Marc think?
Regards, Denis
Am Dienstag, den 30.03.2021, 09:53 +0200 schrieb Michael Olbrich:
> On Tue, Mar 30, 2021 at 06:08:10AM +0000, Denis Osterland-Heim wrote:
> > If CONFIG_MODULE_SIG_ALL is set in kernelconfig then modules will be
> > automatically signed during the modules_install phase of a kernel build.
> >
> > Signed modules are BRITTLE as the signature is outside of the defined ELF
> > container. Thus they MAY NOT be stripped once the signature is computed
> > and attached. Note the entire module is the signed payload, including any
> > and all debug information present at the time of signing.
>
> Hmm, we had the same issue at some point. The solution was a local copy of
> the shell code that does the stripping and installing. I think we added
> some code to sign the Modules again.
> The result was nice, but the whole thing was rather invasive and makes
> assumptions on how the module signing works internally in the kernel.
> So it was not something that I wanted to merge mainline that way.
>
> In general, I like this approach better. But there are two issues with it.
>
> 1. There are redundant options and if the uses gets it wrong then it wont
> fail at build time. We can get this from the kernelconfig:
> '$(shell ptxd_get_kconfig $(KERNEL_CONFIG) CONFIG_MODULE_SIG_ALL)' I think.
> But we have to make sure that it's not evaluated too early. To avoid
> slowing down ptxdist startup.
>
> 2. The modules are not stripped at all. So we should set
> INSTALL_MOD_STRIP=1 in this case.
>
> Marc, what do you think?
>
> Michael
>
> > See: https://www.kernel.org/doc/html/latest/admin-guide/module-signing.html
> > Signed-off-by: Denis Osterland-Heim <denis.osterland@diehl.com>
> > ---
> > platforms/kernel.in | 7 +++++++
> > rules/kernel.make | 3 ++-
> > 2 files changed, 9 insertions(+), 1 deletion(-)
> >
> > diff --git a/platforms/kernel.in b/platforms/kernel.in
> > index 68899c0f7..8b9473b03 100644
> > --- a/platforms/kernel.in
> > +++ b/platforms/kernel.in
> > @@ -32,6 +32,13 @@ config KERNEL_MODULES
> > default y
> > prompt "build kernel-modules"
> >
> > +config KERNEL_MODULES_SIGNED
> > +bool "kernel-modules are signed on install"
> > +depends on KERNEL_MODULES
> > +help
> > + Set this to y if CONFIG_MODULE_SIG_ALL is y in kernelconfig.
> > + Otherwise the strip would damage automatically generated signature.
> > +
> > config KERNEL_MODULES_INSTALL
> > bool
> > default y
> > diff --git a/rules/kernel.make b/rules/kernel.make
> > index ea748fc8a..c964bd672 100644
> > --- a/rules/kernel.make
> > +++ b/rules/kernel.make
> > @@ -313,7 +313,8 @@ ifdef PTXCONF_KERNEL_MODULES_INSTALL
> > @$(call install_fixup, kernel-modules, AUTHOR,"Robert Schwebel <r.schwebel@pengutronix.de>")
> > @$(call install_fixup, kernel-modules, DESCRIPTION,missing)
> >
> > -@$(call install_glob, kernel-modules, 0, 0, -, /lib/modules, *.ko,, k)
> > +@$(call install_glob, kernel-modules, 0, 0, -, /lib/modules, *.ko,, \
> > +$(call ptx/ifdef,PTXCONF_KERNEL_MODULES_SIGNED,n,k))
> > @$(call install_glob, kernel-modules, 0, 0, -, /lib/modules,, *.ko */build */source, n)
> >
> > @$(call install_finish, kernel-modules)
> > --
> > 2.31.1
> >
> > _______________________________________________
> > ptxdist mailing list
> > ptxdist@pengutronix.de
> > To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
Diehl Connectivity Solutions GmbH
Geschäftsführung: Horst Leonberger
Sitz der Gesellschaft: Nürnberg - Registergericht: Amtsgericht
Nürnberg: HRB 32315
________________________________
Der Inhalt der vorstehenden E-Mail ist nicht rechtlich bindend. Diese E-Mail enthaelt vertrauliche und/oder rechtlich geschuetzte Informationen.
Informieren Sie uns bitte, wenn Sie diese E-Mail faelschlicherweise erhalten haben. Bitte loeschen Sie in diesem Fall die Nachricht.
Jede unerlaubte Form der Reproduktion, Bekanntgabe, Aenderung, Verteilung und/oder Publikation dieser E-Mail ist strengstens untersagt.
- Informationen zum Datenschutz, insbesondere zu Ihren Rechten, erhalten Sie unter:
https://www.diehl.com/group/de/transparenz-und-informationspflichten/
The contents of the above mentioned e-mail is not legally binding. This e-mail contains confidential and/or legally protected information. Please inform us if you have received this e-mail by
mistake and delete it in such a case. Each unauthorized reproduction, disclosure, alteration, distribution and/or publication of this e-mail is strictly prohibited.
- For general information on data protection and your respective rights please visit:
https://www.diehl.com/group/en/transparency-and-information-obligations/
_______________________________________________
ptxdist mailing list
ptxdist@pengutronix.de
To unsubscribe, send a mail with subject "unsubscribe" to ptxdist-request@pengutronix.de
next prev parent reply other threads:[~2021-03-30 9:53 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-30 6:08 Denis Osterland-Heim
2021-03-30 7:53 ` Michael Olbrich
2021-03-30 8:22 ` Marc Kleine-Budde
2021-03-30 8:39 ` Michael Olbrich
2021-03-30 8:57 ` Marc Kleine-Budde
2021-03-30 9:53 ` Denis Osterland-Heim [this message]
2021-03-30 10:03 ` m.olbrich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=80f5ae32a550bc68f16db2bb4b18327cf1862c99.camel@diehl.com \
--to=denis.osterland@diehl.com \
--cc=m.olbrich@pengutronix.de \
--cc=mkl@pengutronix.de \
--cc=ptxdist@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox