* [PATCH] MODSIGN: Fix including certificate twice when the signing_key.x509 already exists
@ 2013-02-21 11:23 Chun-Yi Lee
2013-02-21 14:16 ` David Howells
0 siblings, 1 reply; 3+ messages in thread
From: Chun-Yi Lee @ 2013-02-21 11:23 UTC (permalink / raw)
To: rusty, dhowells
Cc: linux-kernel, Chun-Yi Lee, Josh Boyer, Randy Dunlap, Herbert Xu,
David S. Miller, Michal Marek
This issue was found in devel-pekey branch on linux-modsign.git tree. The
x509_certificate_list includes certificate twice when the signing_key.x509
already exists.
We can reproduce this issue by making kernel twice, the build log of
second time looks like this:
...
CHK kernel/config_data.h
CERTS kernel/x509_certificate_list
- Including cert /ramdisk/working/joey/linux-modsign/signing_key.x509
- Including cert signing_key.x509
...
Actually the build path was the same with the srctree path when building
kernel. It causes the size of bzImage increased by packaging certificates
twice.
Cc: David Howells <dhowells@redhat.com>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Josh Boyer <jwboyer@redhat.com>
Cc: Randy Dunlap <rdunlap@xenotime.net>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Michal Marek <mmarek@suse.com>
Signed-off-by: Chun-Yi Lee <jlee@suse.com>
---
kernel/Makefile | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
diff --git a/kernel/Makefile b/kernel/Makefile
index 0ca8c0a..ecbe73f 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -142,7 +142,10 @@ $(obj)/timeconst.h: $(src)/timeconst.pl FORCE
#
###############################################################################
ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y)
-X509_CERTIFICATES-y := $(wildcard *.x509) $(wildcard $(srctree)/*.x509)
+X509_CERTIFICATES-y := $(wildcard *.x509)
+ifneq ($(shell pwd), $(srctree))
+X509_CERTIFICATES-y += $(wildcard $(srctree)/*.x509)
+endif
X509_CERTIFICATES-$(CONFIG_MODULE_SIG) += signing_key.x509
X509_CERTIFICATES := $(sort $(X509_CERTIFICATES-y))
--
1.6.4.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] MODSIGN: Fix including certificate twice when the signing_key.x509 already exists
2013-02-21 11:23 [PATCH] MODSIGN: Fix including certificate twice when the signing_key.x509 already exists Chun-Yi Lee
@ 2013-02-21 14:16 ` David Howells
2013-02-22 8:38 ` joeyli
0 siblings, 1 reply; 3+ messages in thread
From: David Howells @ 2013-02-21 14:16 UTC (permalink / raw)
To: Chun-Yi Lee
Cc: dhowells, rusty, linux-kernel, Chun-Yi Lee, Josh Boyer,
Randy Dunlap, Herbert Xu, David S. Miller, Michal Marek
> +ifneq ($(shell pwd), $(srctree))
How reliable is this, I wonder?
David
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] MODSIGN: Fix including certificate twice when the signing_key.x509 already exists
2013-02-21 14:16 ` David Howells
@ 2013-02-22 8:38 ` joeyli
0 siblings, 0 replies; 3+ messages in thread
From: joeyli @ 2013-02-22 8:38 UTC (permalink / raw)
To: David Howells
Cc: rusty, linux-kernel, Josh Boyer, Randy Dunlap, Herbert Xu,
David S. Miller, Michal Marek
Hi David,
Thanks for your review and point out!
於 四,2013-02-21 於 14:16 +0000,David Howells 提到:
> > +ifneq ($(shell pwd), $(srctree))
>
> How reliable is this, I wonder?
>
> David
>
My current shell is bash, and I tried the '$(shell pwd)' in Makefile
works for grab the REAL path when the build path is a symbolic links to
kernel source directory. Looks the '$(shell pwd)' in Makefile was call
'/bin/pwd' but not 'the shell builtin pwd'.
But, in case the behavior is different between shells, I think used
'$(shell /bin/pwd)' will be better for make sure we call /bin/pwd from
coreutils.
I will send a second version of this patch, please consider for accept
if we need this change.
Thanks a lot!
Joey Lee
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-02-22 8:39 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-02-21 11:23 [PATCH] MODSIGN: Fix including certificate twice when the signing_key.x509 already exists Chun-Yi Lee
2013-02-21 14:16 ` David Howells
2013-02-22 8:38 ` joeyli
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).