From: Eric Snowberg <eric.snowberg@oracle.com>
To: rdunlap@infradead.org, dhowells@redhat.com
Cc: jarkko@kernel.org, nathan@kernel.org, dwmw2@infradead.org,
keyrings@vger.kernel.org, linux-kernel@vger.kernel.org,
eric.snowberg@oracle.com
Subject: [PATCH v2] certs: Fix wrong kconfig option used for x509_revocation_list
Date: Thu, 4 Mar 2021 12:50:30 -0500 [thread overview]
Message-ID: <20210304175030.184131-1-eric.snowberg@oracle.com> (raw)
Fix a build issue when x509_revocation_list is not defined.
$ make ARCH=x86_64 O=build64 all
EXTRACT_CERTS ../
At main.c:154:
- SSL error:0909006C:PEM routines:get_name:no start line: crypto/pem/pem_lib.c:745
extract-cert: ../: Is a directory
make[2]: [../certs/Makefile:119: certs/x509_revocation_list] Error 1 (ignored)
When the new CONFIG_SYSTEM_REVOCATION_LIST was added [1], it was not carried
into the code for preloading the revocation certificates [2]. Change from
using the original CONFIG_SYSTEM_BLACKLIST_KEYRING to the new
CONFIG_SYSTEM_REVOCATION_LIST.
[1] https://lore.kernel.org/keyrings/EDA280F9-F72D-4181-93C7-CDBE95976FF7@oracle.com/T/#m562c1b27bf402190e7bb573ad20eff5b6310d08f
[2] https://lore.kernel.org/keyrings/EDA280F9-F72D-4181-93C7-CDBE95976FF7@oracle.com/T/#m07e258bf019ccbac23820fad5192ceffa74fc6ab
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
---
v2 changes:
Use the new config option for extract-cert
Use the new config option when building revocation_certificates.o
---
certs/Makefile | 5 +++--
certs/blacklist.c | 4 ++++
scripts/Makefile | 2 +-
3 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/certs/Makefile b/certs/Makefile
index e3f4926fd21e..b6db52ebf0be 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -4,7 +4,8 @@
#
obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o common.o
-obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o revocation_certificates.o common.o
+obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist.o common.o
+obj-$(CONFIG_SYSTEM_REVOCATION_LIST) += revocation_certificates.o
ifneq ($(CONFIG_SYSTEM_BLACKLIST_HASH_LIST),"")
obj-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += blacklist_hashes.o
else
@@ -105,7 +106,7 @@ $(obj)/signing_key.x509: scripts/extract-cert $(X509_DEP) FORCE
$(call if_changed,extract_certs,$(MODULE_SIG_KEY_SRCPREFIX)$(CONFIG_MODULE_SIG_KEY))
endif # CONFIG_MODULE_SIG
-ifeq ($(CONFIG_SYSTEM_BLACKLIST_KEYRING),y)
+ifeq ($(CONFIG_SYSTEM_REVOCATION_LIST),y)
$(eval $(call config_filename,SYSTEM_REVOCATION_KEYS))
diff --git a/certs/blacklist.c b/certs/blacklist.c
index 723b19c96256..c9a435b15af4 100644
--- a/certs/blacklist.c
+++ b/certs/blacklist.c
@@ -21,8 +21,10 @@
static struct key *blacklist_keyring;
+#ifdef CONFIG_SYSTEM_REVOCATION_LIST
extern __initconst const u8 revocation_certificate_list[];
extern __initconst const unsigned long revocation_certificate_list_size;
+#endif
/*
* The description must be a type prefix, a colon and then an even number of
@@ -225,6 +227,7 @@ static int __init blacklist_init(void)
*/
device_initcall(blacklist_init);
+#ifdef CONFIG_SYSTEM_REVOCATION_LIST
/*
* Load the compiled-in list of revocation X.509 certificates.
*/
@@ -237,3 +240,4 @@ static __init int load_revocation_certificate_list(void)
blacklist_keyring);
}
late_initcall(load_revocation_certificate_list);
+#endif
diff --git a/scripts/Makefile b/scripts/Makefile
index 983b785f13cb..bd0718f7c493 100644
--- a/scripts/Makefile
+++ b/scripts/Makefile
@@ -11,7 +11,7 @@ hostprogs-always-$(CONFIG_ASN1) += asn1_compiler
hostprogs-always-$(CONFIG_MODULE_SIG_FORMAT) += sign-file
hostprogs-always-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += extract-cert
hostprogs-always-$(CONFIG_SYSTEM_EXTRA_CERTIFICATE) += insert-sys-cert
- hostprogs-always-$(CONFIG_SYSTEM_BLACKLIST_KEYRING) += extract-cert
+hostprogs-always-$(CONFIG_SYSTEM_REVOCATION_LIST) += extract-cert
HOSTCFLAGS_sorttable.o = -I$(srctree)/tools/include
HOSTCFLAGS_asn1_compiler.o = -I$(srctree)/include
--
2.18.4
next reply other threads:[~2021-03-04 17:53 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-04 17:50 Eric Snowberg [this message]
2021-03-04 18:10 ` [PATCH v2] certs: Fix wrong kconfig option used for x509_revocation_list Nathan Chancellor
2021-03-05 21:50 ` David Howells
2021-03-09 2:28 ` Eric Snowberg
2021-03-09 11:46 ` David Howells
2021-03-10 19:43 ` Jarkko Sakkinen
2021-03-10 19:44 ` Jarkko Sakkinen
2021-03-11 0:04 ` Eric Snowberg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210304175030.184131-1-eric.snowberg@oracle.com \
--to=eric.snowberg@oracle.com \
--cc=dhowells@redhat.com \
--cc=dwmw2@infradead.org \
--cc=jarkko@kernel.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nathan@kernel.org \
--cc=rdunlap@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.