forked from torvalds/linux
-
Notifications
You must be signed in to change notification settings - Fork 17
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Move certificate handling to its own directory
Move certificate handling out of the kernel/ directory and into a certs/ directory to get all the weird stuff in one place and move the generated signing keys into this directory. Signed-off-by: David Howells <[email protected]> Reviewed-by: David Woodhouse <[email protected]>
- Loading branch information
Showing
10 changed files
with
212 additions
and
195 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2589,6 +2589,15 @@ S: Supported | |
| F: Documentation/filesystems/ceph.txt | ||
| F: fs/ceph/ | ||
|
|
||
| CERTIFICATE HANDLING: | ||
| M: David Howells <[email protected]> | ||
| M: David Woodhouse <[email protected]> | ||
| L: [email protected] | ||
| S: Maintained | ||
| F: Documentation/module-signing.txt | ||
| F: certs/ | ||
| F: scripts/extract-cert.c | ||
|
|
||
| CERTIFIED WIRELESS USB (WUSB) SUBSYSTEM: | ||
| L: [email protected] | ||
| S: Orphan | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| menu "Certificates for signature checking" | ||
|
|
||
| config MODULE_SIG_KEY | ||
| string "File name or PKCS#11 URI of module signing key" | ||
| default "certs/signing_key.pem" | ||
| depends on MODULE_SIG | ||
| help | ||
| Provide the file name of a private key/certificate in PEM format, | ||
| or a PKCS#11 URI according to RFC7512. The file should contain, or | ||
| the URI should identify, both the certificate and its corresponding | ||
| private key. | ||
|
|
||
| If this option is unchanged from its default "certs/signing_key.pem", | ||
| then the kernel will automatically generate the private key and | ||
| certificate as described in Documentation/module-signing.txt | ||
|
|
||
| config SYSTEM_TRUSTED_KEYRING | ||
| bool "Provide system-wide ring of trusted keys" | ||
| depends on KEYS | ||
| help | ||
| Provide a system keyring to which trusted keys can be added. Keys in | ||
| the keyring are considered to be trusted. Keys may be added at will | ||
| by the kernel from compiled-in data and from hardware key stores, but | ||
| userspace may only add extra keys if those keys can be verified by | ||
| keys already in the keyring. | ||
|
|
||
| Keys in this keyring are used by module signature checking. | ||
|
|
||
| config SYSTEM_TRUSTED_KEYS | ||
| string "Additional X.509 keys for default system keyring" | ||
| depends on SYSTEM_TRUSTED_KEYRING | ||
| help | ||
| If set, this option should be the filename of a PEM-formatted file | ||
| containing trusted X.509 certificates to be included in the default | ||
| system keyring. Any certificate used for module signing is implicitly | ||
| also trusted. | ||
|
|
||
| NOTE: If you previously provided keys for the system keyring in the | ||
| form of DER-encoded *.x509 files in the top-level build directory, | ||
| those are no longer used. You will need to set this option instead. | ||
|
|
||
| endmenu |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,147 @@ | ||
| # | ||
| # Makefile for the linux kernel signature checking certificates. | ||
| # | ||
|
|
||
| obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o | ||
|
|
||
| ############################################################################### | ||
| # | ||
| # When a Kconfig string contains a filename, it is suitable for | ||
| # passing to shell commands. It is surrounded by double-quotes, and | ||
| # any double-quotes or backslashes within it are escaped by | ||
| # backslashes. | ||
| # | ||
| # This is no use for dependencies or $(wildcard). We need to strip the | ||
| # surrounding quotes and the escaping from quotes and backslashes, and | ||
| # we *do* need to escape any spaces in the string. So, for example: | ||
| # | ||
| # Usage: $(eval $(call config_filename,FOO)) | ||
| # | ||
| # Defines FOO_FILENAME based on the contents of the CONFIG_FOO option, | ||
| # transformed as described above to be suitable for use within the | ||
| # makefile. | ||
| # | ||
| # Also, if the filename is a relative filename and exists in the source | ||
| # tree but not the build tree, define FOO_SRCPREFIX as $(srctree)/ to | ||
| # be prefixed to *both* command invocation and dependencies. | ||
| # | ||
| # Note: We also print the filenames in the quiet_cmd_foo text, and | ||
| # perhaps ought to have a version specially escaped for that purpose. | ||
| # But it's only cosmetic, and $(patsubst "%",%,$(CONFIG_FOO)) is good | ||
| # enough. It'll strip the quotes in the common case where there's no | ||
| # space and it's a simple filename, and it'll retain the quotes when | ||
| # there's a space. There are some esoteric cases in which it'll print | ||
| # the wrong thing, but we don't really care. The actual dependencies | ||
| # and commands *do* get it right, with various combinations of single | ||
| # and double quotes, backslashes and spaces in the filenames. | ||
| # | ||
| ############################################################################### | ||
| # | ||
| quote := $(firstword " ") | ||
| space := | ||
| space += | ||
| space_escape := %%%SPACE%%% | ||
| # | ||
| define config_filename | ||
| ifneq ($$(CONFIG_$(1)),"") | ||
| $(1)_FILENAME := $$(subst \\,\,$$(subst \$$(quote),$$(quote),$$(subst $$(space_escape),\$$(space),$$(patsubst "%",%,$$(subst $$(space),$$(space_escape),$$(CONFIG_$(1))))))) | ||
| ifneq ($$(patsubst /%,%,$$(firstword $$($(1)_FILENAME))),$$(firstword $$($(1)_FILENAME))) | ||
| else | ||
| ifeq ($$(wildcard $$($(1)_FILENAME)),) | ||
| ifneq ($$(wildcard $$(srctree)/$$($(1)_FILENAME)),) | ||
| $(1)_SRCPREFIX := $(srctree)/ | ||
| endif | ||
| endif | ||
| endif | ||
| endif | ||
| endef | ||
| # | ||
| ############################################################################### | ||
|
|
||
| ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) | ||
|
|
||
| $(eval $(call config_filename,SYSTEM_TRUSTED_KEYS)) | ||
|
|
||
| # GCC doesn't include .incbin files in -MD generated dependencies (PR#66871) | ||
| $(obj)/system_certificates.o: $(obj)/x509_certificate_list | ||
|
|
||
| # Cope with signing_key.x509 existing in $(srctree) not $(objtree) | ||
| AFLAGS_system_certificates.o := -I$(srctree) | ||
|
|
||
| quiet_cmd_extract_certs = EXTRACT_CERTS $(patsubst "%",%,$(2)) | ||
| cmd_extract_certs = scripts/extract-cert $(2) $@ || ( rm $@; exit 1) | ||
|
|
||
| targets += x509_certificate_list | ||
| $(obj)/x509_certificate_list: scripts/extract-cert $(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(SYSTEM_TRUSTED_KEYS_FILENAME) FORCE | ||
| $(call if_changed,extract_certs,$(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(CONFIG_SYSTEM_TRUSTED_KEYS)) | ||
| endif | ||
|
|
||
| clean-files := x509_certificate_list .x509.list | ||
|
|
||
| ifeq ($(CONFIG_MODULE_SIG),y) | ||
| ############################################################################### | ||
| # | ||
| # If module signing is requested, say by allyesconfig, but a key has not been | ||
| # supplied, then one will need to be generated to make sure the build does not | ||
| # fail and that the kernel may be used afterwards. | ||
| # | ||
| ############################################################################### | ||
| ifndef CONFIG_MODULE_SIG_HASH | ||
| $(error Could not determine digest type to use from kernel config) | ||
| endif | ||
|
|
||
| # We do it this way rather than having a boolean option for enabling an | ||
| # external private key, because 'make randconfig' might enable such a | ||
| # boolean option and we unfortunately can't make it depend on !RANDCONFIG. | ||
| ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") | ||
| $(obj)/signing_key.pem: $(obj)/x509.genkey | ||
| @echo "###" | ||
| @echo "### Now generating an X.509 key pair to be used for signing modules." | ||
| @echo "###" | ||
| @echo "### If this takes a long time, you might wish to run rngd in the" | ||
| @echo "### background to keep the supply of entropy topped up. It" | ||
| @echo "### needs to be run as root, and uses a hardware random" | ||
| @echo "### number generator if one is available." | ||
| @echo "###" | ||
| openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ | ||
| -batch -x509 -config $(obj)/x509.genkey \ | ||
| -outform PEM -out $(obj)/signing_key.pem \ | ||
| -keyout $(obj)/signing_key.pem 2>&1 | ||
| @echo "###" | ||
| @echo "### Key pair generated." | ||
| @echo "###" | ||
|
|
||
| $(obj)/x509.genkey: | ||
| @echo Generating X.509 key generation config | ||
| @echo >$@ "[ req ]" | ||
| @echo >>$@ "default_bits = 4096" | ||
| @echo >>$@ "distinguished_name = req_distinguished_name" | ||
| @echo >>$@ "prompt = no" | ||
| @echo >>$@ "string_mask = utf8only" | ||
| @echo >>$@ "x509_extensions = myexts" | ||
| @echo >>$@ | ||
| @echo >>$@ "[ req_distinguished_name ]" | ||
| @echo >>$@ "#O = Unspecified company" | ||
| @echo >>$@ "CN = Build time autogenerated kernel key" | ||
| @echo >>$@ "#emailAddress = [email protected]" | ||
| @echo >>$@ | ||
| @echo >>$@ "[ myexts ]" | ||
| @echo >>$@ "basicConstraints=critical,CA:FALSE" | ||
| @echo >>$@ "keyUsage=digitalSignature" | ||
| @echo >>$@ "subjectKeyIdentifier=hash" | ||
| @echo >>$@ "authorityKeyIdentifier=keyid" | ||
| endif | ||
|
|
||
| $(eval $(call config_filename,MODULE_SIG_KEY)) | ||
|
|
||
| # If CONFIG_MODULE_SIG_KEY isn't a PKCS#11 URI, depend on it | ||
| ifeq ($(patsubst pkcs11:%,%,$(firstword $(MODULE_SIG_KEY_FILENAME))),$(firstword $(MODULE_SIG_KEY_FILENAME))) | ||
| X509_DEP := $(MODULE_SIG_KEY_SRCPREFIX)$(MODULE_SIG_KEY_FILENAME) | ||
| endif | ||
|
|
||
| # GCC PR#66871 again. | ||
| $(obj)/system_certificates.o: $(obj)/signing_key.x509 | ||
|
|
||
| $(obj)/signing_key.x509: scripts/extract-cert include/config/module/sig/key.h $(X509_DEP) | ||
| $(call cmd,extract_certs,$(MODULE_SIG_KEY_SRCPREFIX)$(CONFIG_MODULE_SIG_KEY)) | ||
| endif |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.