* [PATCH] Documentation: module-signing: Mention default_x509.genkey template
@ 2023-05-11 4:38 Bagas Sanjaya
2023-05-11 16:55 ` Masahiro Yamada
2023-05-24 2:13 ` Jarkko Sakkinen
0 siblings, 2 replies; 6+ messages in thread
From: Bagas Sanjaya @ 2023-05-11 4:38 UTC (permalink / raw)
To: Linux Keyrings, Linux Kernel Build System, Linux Documentation,
Linux Kernel Mailing List
Cc: David Howells, David Woodhouse, Jonathan Corbet, Masahiro Yamada,
Bagas Sanjaya
Commit f3a2ba44e93e2c ("certs: check-in the default x509 config file")
adds default x509 keypair config file template, but forgets to mention
it in kernel module signing documentation. Update the doc accordingly.
Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
---
Documentation/admin-guide/module-signing.rst | 41 ++++++++------------
1 file changed, 17 insertions(+), 24 deletions(-)
diff --git a/Documentation/admin-guide/module-signing.rst b/Documentation/admin-guide/module-signing.rst
index 7d7c7c8a545ca6..365d60a6245f17 100644
--- a/Documentation/admin-guide/module-signing.rst
+++ b/Documentation/admin-guide/module-signing.rst
@@ -133,46 +133,39 @@ kernel so that it can be used to check the signatures as the modules are
loaded.
Under normal conditions, when ``CONFIG_MODULE_SIG_KEY`` is unchanged from its
-default, the kernel build will automatically generate a new keypair using
-openssl if one does not exist in the file::
-
- certs/signing_key.pem
-
+default, the kernel build will automatically generate a new keypair in
+``certs/signing_key.pem`` using openssl if it doesn't exist,
during the building of vmlinux (the public part of the key needs to be built
-into vmlinux) using parameters in the::
-
- certs/x509.genkey
-
+into vmlinux) using parameters in the ``certs/x509.genkey`` configuration
file (which is also generated if it does not already exist).
-It is strongly recommended that you provide your own x509.genkey file.
-
-Most notably, in the x509.genkey file, the req_distinguished_name section
-should be altered from the default::
+If you'd like to provide alternative configuration, copy
+``certs/default_x509.genkey`` to ``certs/x509.genkey`` and edit the copy
+instead. Most likely, you will want to edit the ``req_distinguished_name``
+section, which identifies the resulting keypair. For example::
[ req_distinguished_name ]
- #O = Unspecified company
- CN = Build time autogenerated kernel key
- #emailAddress = unspecified.user@unspecified.company
+ O = Example company
+ CN = Example kernel build
+ emailAddress = user@example.com
The generated RSA key size can also be set with::
[ req ]
default_bits = 4096
-
-It is also possible to manually generate the key private/public files using the
-x509.genkey key generation configuration file in the root node of the Linux
-kernel sources tree and the openssl command. The following is an example to
-generate the public/private key files::
+Optionally, you can also manually generate the keypair so that the same
+keypair can be used in multiple builds. To generate it::
openssl req -new -nodes -utf8 -sha256 -days 36500 -batch -x509 \
-config x509.genkey -outform PEM -out kernel_key.pem \
-keyout kernel_key.pem
-The full pathname for the resulting kernel_key.pem file can then be specified
-in the ``CONFIG_MODULE_SIG_KEY`` option, and the certificate and key therein will
-be used instead of an autogenerated keypair.
+See :manpage:`openssl-req(1)` for the explanation.
+
+The full pathname for the resulting ``kernel_key.pem`` file can then be
+specified in the ``CONFIG_MODULE_SIG_KEY`` option, and the certificate and key
+therein will be used instead of an autogenerated keypair.
=========================
base-commit: ac9a78681b921877518763ba0e89202254349d1b
--
An old man doll... just what I always wanted! - Clara
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] Documentation: module-signing: Mention default_x509.genkey template
2023-05-11 4:38 [PATCH] Documentation: module-signing: Mention default_x509.genkey template Bagas Sanjaya
@ 2023-05-11 16:55 ` Masahiro Yamada
2023-05-12 2:36 ` Bagas Sanjaya
2023-05-24 2:40 ` Bagas Sanjaya
2023-05-24 2:13 ` Jarkko Sakkinen
1 sibling, 2 replies; 6+ messages in thread
From: Masahiro Yamada @ 2023-05-11 16:55 UTC (permalink / raw)
To: Bagas Sanjaya
Cc: Linux Keyrings, Linux Kernel Build System, Linux Documentation,
Linux Kernel Mailing List, David Howells, David Woodhouse,
Jonathan Corbet
On Thu, May 11, 2023 at 1:39 PM Bagas Sanjaya <bagasdotme@gmail.com> wrote:
>
> Commit f3a2ba44e93e2c ("certs: check-in the default x509 config file")
> adds default x509 keypair config file template, but forgets to mention
> it in kernel module signing documentation.
What did it forget?
The current documentation looks fine to me.
> Update the doc accordingly.
>
> Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
> ---
> Documentation/admin-guide/module-signing.rst | 41 ++++++++------------
> 1 file changed, 17 insertions(+), 24 deletions(-)
>
> diff --git a/Documentation/admin-guide/module-signing.rst b/Documentation/admin-guide/module-signing.rst
> index 7d7c7c8a545ca6..365d60a6245f17 100644
> --- a/Documentation/admin-guide/module-signing.rst
> +++ b/Documentation/admin-guide/module-signing.rst
> @@ -133,46 +133,39 @@ kernel so that it can be used to check the signatures as the modules are
> loaded.
>
> Under normal conditions, when ``CONFIG_MODULE_SIG_KEY`` is unchanged from its
> -default, the kernel build will automatically generate a new keypair using
> -openssl if one does not exist in the file::
> -
> - certs/signing_key.pem
> -
> +default, the kernel build will automatically generate a new keypair in
> +``certs/signing_key.pem`` using openssl if it doesn't exist,
> during the building of vmlinux (the public part of the key needs to be built
> -into vmlinux) using parameters in the::
> -
> - certs/x509.genkey
> -
> +into vmlinux) using parameters in the ``certs/x509.genkey`` configuration
> file (which is also generated if it does not already exist).
>
> -It is strongly recommended that you provide your own x509.genkey file.
> -
> -Most notably, in the x509.genkey file, the req_distinguished_name section
> -should be altered from the default::
> +If you'd like to provide alternative configuration, copy
> +``certs/default_x509.genkey`` to ``certs/x509.genkey`` and edit the copy
> +instead. Most likely, you will want to edit the ``req_distinguished_name``
> +section, which identifies the resulting keypair. For example::
>
> [ req_distinguished_name ]
> - #O = Unspecified company
> - CN = Build time autogenerated kernel key
> - #emailAddress = unspecified.user@unspecified.company
> + O = Example company
> + CN = Example kernel build
> + emailAddress = user@example.com
>
> The generated RSA key size can also be set with::
>
> [ req ]
> default_bits = 4096
>
> -
> -It is also possible to manually generate the key private/public files using the
> -x509.genkey key generation configuration file in the root node of the Linux
> -kernel sources tree and the openssl command. The following is an example to
> -generate the public/private key files::
> +Optionally, you can also manually generate the keypair so that the same
> +keypair can be used in multiple builds. To generate it::
>
> openssl req -new -nodes -utf8 -sha256 -days 36500 -batch -x509 \
> -config x509.genkey -outform PEM -out kernel_key.pem \
> -keyout kernel_key.pem
>
> -The full pathname for the resulting kernel_key.pem file can then be specified
> -in the ``CONFIG_MODULE_SIG_KEY`` option, and the certificate and key therein will
> -be used instead of an autogenerated keypair.
> +See :manpage:`openssl-req(1)` for the explanation.
> +
> +The full pathname for the resulting ``kernel_key.pem`` file can then be
> +specified in the ``CONFIG_MODULE_SIG_KEY`` option, and the certificate and key
> +therein will be used instead of an autogenerated keypair.
>
>
> =========================
>
> base-commit: ac9a78681b921877518763ba0e89202254349d1b
> --
> An old man doll... just what I always wanted! - Clara
>
--
Best Regards
Masahiro Yamada
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Documentation: module-signing: Mention default_x509.genkey template
2023-05-11 16:55 ` Masahiro Yamada
@ 2023-05-12 2:36 ` Bagas Sanjaya
2023-05-24 2:40 ` Bagas Sanjaya
1 sibling, 0 replies; 6+ messages in thread
From: Bagas Sanjaya @ 2023-05-12 2:36 UTC (permalink / raw)
To: Masahiro Yamada
Cc: Linux Keyrings, Linux Kernel Build System, Linux Documentation,
Linux Kernel Mailing List, David Howells, David Woodhouse,
Jonathan Corbet
On 5/11/23 23:55, Masahiro Yamada wrote:
> On Thu, May 11, 2023 at 1:39 PM Bagas Sanjaya <bagasdotme@gmail.com> wrote:
>>
>> Commit f3a2ba44e93e2c ("certs: check-in the default x509 config file")
>> adds default x509 keypair config file template, but forgets to mention
>> it in kernel module signing documentation.
>
> What did it forget?
>
I mean the phrase "provide your own x509.genkey" can means
creating that config from scratch when there is already
default_x509.genkey template which can be used as a base for
adjusting certificate keypair.
--
An old man doll... just what I always wanted! - Clara
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Documentation: module-signing: Mention default_x509.genkey template
2023-05-11 4:38 [PATCH] Documentation: module-signing: Mention default_x509.genkey template Bagas Sanjaya
2023-05-11 16:55 ` Masahiro Yamada
@ 2023-05-24 2:13 ` Jarkko Sakkinen
1 sibling, 0 replies; 6+ messages in thread
From: Jarkko Sakkinen @ 2023-05-24 2:13 UTC (permalink / raw)
To: Bagas Sanjaya, Linux Keyrings, Linux Kernel Build System,
Linux Documentation, Linux Kernel Mailing List
Cc: David Howells, David Woodhouse, Jonathan Corbet, Masahiro Yamada
On Thu, 2023-05-11 at 11:38 +0700, Bagas Sanjaya wrote:
> Commit f3a2ba44e93e2c ("certs: check-in the default x509 config file")
> adds default x509 keypair config file template, but forgets to mention
> it in kernel module signing documentation. Update the doc accordingly.
>
> Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Acked-by: Jarkko Sakkinen <jarkko@kernel.org>
BR, Jarkko
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Documentation: module-signing: Mention default_x509.genkey template
2023-05-11 16:55 ` Masahiro Yamada
2023-05-12 2:36 ` Bagas Sanjaya
@ 2023-05-24 2:40 ` Bagas Sanjaya
2023-05-24 8:47 ` Masahiro Yamada
1 sibling, 1 reply; 6+ messages in thread
From: Bagas Sanjaya @ 2023-05-24 2:40 UTC (permalink / raw)
To: Masahiro Yamada
Cc: Linux Keyrings, Linux Kernel Build System, Linux Documentation,
Linux Kernel Mailing List, David Howells, David Woodhouse,
Jonathan Corbet
On 5/11/23 23:55, Masahiro Yamada wrote:
> On Thu, May 11, 2023 at 1:39 PM Bagas Sanjaya <bagasdotme@gmail.com> wrote:
>>
>> Commit f3a2ba44e93e2c ("certs: check-in the default x509 config file")
>> adds default x509 keypair config file template, but forgets to mention
>> it in kernel module signing documentation.
>
> What did it forget?
>
I mean not mentioning the template.
--
An old man doll... just what I always wanted! - Clara
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] Documentation: module-signing: Mention default_x509.genkey template
2023-05-24 2:40 ` Bagas Sanjaya
@ 2023-05-24 8:47 ` Masahiro Yamada
0 siblings, 0 replies; 6+ messages in thread
From: Masahiro Yamada @ 2023-05-24 8:47 UTC (permalink / raw)
To: Bagas Sanjaya
Cc: Linux Keyrings, Linux Kernel Build System, Linux Documentation,
Linux Kernel Mailing List, David Howells, David Woodhouse,
Jonathan Corbet
On Wed, May 24, 2023 at 11:40 AM Bagas Sanjaya <bagasdotme@gmail.com> wrote:
>
> On 5/11/23 23:55, Masahiro Yamada wrote:
> > On Thu, May 11, 2023 at 1:39 PM Bagas Sanjaya <bagasdotme@gmail.com> wrote:
> >>
> >> Commit f3a2ba44e93e2c ("certs: check-in the default x509 config file")
> >> adds default x509 keypair config file template, but forgets to mention
> >> it in kernel module signing documentation.
> >
> > What did it forget?
> >
>
> I mean not mentioning the template.
f3a2ba44e93e2c192a872f2705fe66dbf39708d6
is equivalent to what Makefile previously did.
You could manually copy certs/default_x509.genkey
if you like, but you do not need to.
>
> --
> An old man doll... just what I always wanted! - Clara
>
--
Best Regards
Masahiro Yamada
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2023-05-24 8:48 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-05-11 4:38 [PATCH] Documentation: module-signing: Mention default_x509.genkey template Bagas Sanjaya
2023-05-11 16:55 ` Masahiro Yamada
2023-05-12 2:36 ` Bagas Sanjaya
2023-05-24 2:40 ` Bagas Sanjaya
2023-05-24 8:47 ` Masahiro Yamada
2023-05-24 2:13 ` Jarkko Sakkinen
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.