leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MODSIGN: Use the same digest for the autogen key sig as for the module sig

Browse Source 
Use the same digest type for the autogenerated key signature as for the module
signature so that the hash algorithm is guaranteed to be present in the kernel.

Without this, the X.509 certificate loader may reject the X.509 certificate so
generated because it was self-signed and the signature will be checked against
itself - but this won't work if the digest algorithm must be loaded as a
module.

The symptom is that the key fails to load with the following message emitted
into the kernel log:

	MODSIGN: Problem loading in-kernel X.509 certificate (-65)

the error in brackets being -ENOPKG.  What you should see is something like:

	MODSIGN: Loaded cert 'Magarathea: Glacier signing key: 9588321144239a119d3406d4c4cf1fbae1836fa0'

Note that this doesn't apply to certificates that are not self-signed as we
don't check those currently as they require the parent CA certificate to be
available.

Reported-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is contained in:
David Howells 2012-09-28 11:16:57 +01:00 committed by Rusty Russell
parent 80d65e58e9
commit 5e8cb1e441
1 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
kernel/Makefile
View File

@ -149,6 +149,26 @@ kernel/modsign_pubkey.o: signing_key.x509 extra_certificates
# fail and that the kernel may be used afterwards. # fail and that the kernel may be used afterwards.
# #
############################################################################### ###############################################################################
sign_key_with_hash :=
ifeq ($(CONFIG_MODULE_SIG_SHA1),y)
sign_key_with_hash := -sha1
endif
ifeq ($(CONFIG_MODULE_SIG_SHA224),y)
sign_key_with_hash := -sha224
endif
ifeq ($(CONFIG_MODULE_SIG_SHA256),y)
sign_key_with_hash := -sha256
endif
ifeq ($(CONFIG_MODULE_SIG_SHA384),y)
sign_key_with_hash := -sha384
endif
ifeq ($(CONFIG_MODULE_SIG_SHA512),y)
sign_key_with_hash := -sha512
endif
ifeq ($(sign_key_with_hash),)
$(error Could not determine digest type to use from kernel config)
endif
signing_key.priv signing_key.x509: x509.genkey signing_key.priv signing_key.x509: x509.genkey
@echo "###" @echo "###"
@echo "### Now generating an X.509 key pair to be used for signing modules." @echo "### Now generating an X.509 key pair to be used for signing modules."
@ -160,7 +180,7 @@ signing_key.priv signing_key.x509: x509.genkey
@echo "###" @echo "###"
@echo "### rngd -r /dev/hwrandom" @echo "### rngd -r /dev/hwrandom"
@echo "###" @echo "###"
openssl req -new -nodes -utf8 -sha1 -days 36500 -batch \ openssl req -new -nodes -utf8 $(sign_key_with_hash) -days 36500 -batch \
-x509 -config x509.genkey \ -x509 -config x509.genkey \
-outform DER -out signing_key.x509 \ -outform DER -out signing_key.x509 \
-keyout signing_key.priv -keyout signing_key.priv