From: Alexander Holler <holler@ahsoftware.de>
To: Michal Marek <mmarek@suse.cz>, linux-kernel@vger.kernel.org
Cc: linux-kbuild@vger.kernel.org, David Howells <dhowells@redhat.com>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: Re: [PATCH] modsign: provide option to automatically delete the key after modules were installed
Date: Fri, 23 Jan 2015 12:54:36 +0100 [thread overview]
Message-ID: <54C2367C.4000909@ahsoftware.de> (raw)
In-Reply-To: <54C233FB.3080309@ahsoftware.de>
Am 23.01.2015 um 12:43 schrieb Alexander Holler:
> Am 23.01.2015 um 11:55 schrieb Michal Marek:
>> The .x509 file contains a certificate signed by the private key, but not
>> the private key. With some scripting, it can be used to verify the
>> module signatures.
>
>
> Assuming that doesn't change (hopefully), I'll send v2 in a few minutes
> (it just compiles in order to test it). Thanks for assuring me that
> .x509 does not and will not contain the private key.
I'm happy I did that. Just deleting the private key currently doesn't
work. A subsequent make fails:
-----------------------------
(...)
###
### Deleting the private key used to sign modules.
###
DEPMOD 3.18.3-00076-ga775cc9
[root@krabat linux]# less signing_key.x509
"signing_key.x509" may be a binary file. See it anyway?
[root@krabat linux]# make -j4 bzImage modules && make -j4 modules_install
CHK include/config/kernel.release
CHK include/generated/uapi/linux/version.h
CHK include/generated/utsrelease.h
CALL scripts/checksyscalls.sh
CHK include/generated/compile.h
X.509 certificate list changed
CHK kernel/config_data.h
CERTS kernel/x509_certificate_list
- Including cert signing_key.x509
AS kernel/system_certificates.o
LD kernel/built-in.o
LINK vmlinux
LD vmlinux.o
MODPOST vmlinux.o
GEN .version
CHK include/generated/compile.h
UPD include/generated/compile.h
CC init/version.o
LD init/built-in.o
KSYM .tmp_kallsyms1.o
KSYM .tmp_kallsyms2.o
LD vmlinux
SORTEX vmlinux
SYSMAP System.map
Building modules, stage 2.
VOFFSET arch/x86/boot/voffset.h
CC arch/x86/boot/version.o
OBJCOPY arch/x86/boot/compressed/vmlinux.bin
RELOCS arch/x86/boot/compressed/vmlinux.relocs
CC arch/x86/boot/compressed/aslr.o
LZMA arch/x86/boot/compressed/vmlinux.bin.lzma
MODPOST 747 modules
MKPIGGY arch/x86/boot/compressed/piggy.S
AS arch/x86/boot/compressed/piggy.o
LD arch/x86/boot/compressed/vmlinux
OBJCOPY arch/x86/boot/vmlinux.bin
ZOFFSET arch/x86/boot/zoffset.h
AS arch/x86/boot/header.o
LD arch/x86/boot/setup.elf
OBJCOPY arch/x86/boot/setup.bin
BUILD arch/x86/boot/bzImage
Setup is 16316 bytes (padded to 16384 bytes).
System is 3908 kB
CRC a049b366
Kernel: arch/x86/boot/bzImage is ready (#682)
INSTALL arch/x86/crypto/aes-x86_64.ko
INSTALL arch/x86/crypto/blowfish-x86_64.ko
INSTALL arch/x86/crypto/camellia-aesni-avx-x86_64.ko
INSTALL arch/x86/crypto/aesni-intel.ko
Can't read private key
(...)
-----------------------------
Maybe that's the reason I've always deleted both files, can't remember.
I will see if I find the time and passion to change the Makefile in
order to fix that. So you might either use my existing patch or wait if
I will send a new one.
Regards,
Alexander Holler
next prev parent reply other threads:[~2015-01-23 11:54 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-01-23 1:20 [PATCH] modsign: provide option to automatically delete the key after modules were installed Alexander Holler
2015-01-23 9:24 ` Michal Marek
2015-01-23 9:39 ` Alexander Holler
2015-01-23 10:15 ` Alexander Holler
2015-01-23 10:55 ` Michal Marek
2015-01-23 11:43 ` Alexander Holler
2015-01-23 11:54 ` Alexander Holler [this message]
2015-01-23 12:34 ` Alexander Holler
2015-01-23 18:26 ` Alexander Holler
2015-01-23 12:56 ` David Howells
2015-01-23 13:27 ` Alexander Holler
2015-01-23 13:35 ` Alexander Holler
2015-01-23 21:57 ` [PATCH] modsign: overwrite keys with zero before deleting them Alexander Holler
2015-01-23 22:06 ` Richard Weinberger
2015-01-23 22:16 ` Alexander Holler
2015-01-23 23:58 ` David Howells
2015-01-24 0:13 ` Alexander Holler
2015-01-24 1:27 ` Pádraig Brady
2015-01-24 10:45 ` [PATCH v2] modsign: use shred to overwrite the private key before deleting it Alexander Holler
2015-01-24 11:37 ` Alexander Holler
2015-01-24 12:09 ` Alexander Holler
2015-01-24 12:29 ` Alexander Holler
2015-01-25 2:13 ` Pádraig Brady
2015-01-25 2:43 ` Alexander Holler
2015-01-25 10:32 ` Alexander Holler
2015-01-25 10:57 ` Alexander Holler
2015-01-25 11:42 ` Alexander Holler
2015-01-25 12:04 ` Alexander Holler
2015-01-25 12:08 ` Richard Weinberger
2015-01-25 12:24 ` Alexander Holler
2015-01-25 12:28 ` Richard Weinberger
2015-01-25 12:57 ` Alexander Holler
2015-01-25 12:36 ` Alexander Holler
2015-01-25 13:46 ` Alexander Holler
2015-01-29 22:39 ` Alexander Holler
2015-07-18 21:56 ` [PATCH] modsign: provide option to automatically delete the key after modules were installed Alexander Holler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=54C2367C.4000909@ahsoftware.de \
--to=holler@ahsoftware.de \
--cc=dhowells@redhat.com \
--cc=linux-kbuild@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mmarek@suse.cz \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.