LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH] builddeb: fix stripped module signatures if CONFIG_DEBUG_INFO and CONFIG_MODULE_SIG_ALL are set
@ 2015-03-16  8:20 Andrey Skvortsov
  2015-04-21 13:58 ` Michal Marek
  0 siblings, 1 reply; 8+ messages in thread
From: Andrey Skvortsov @ 2015-03-16  8:20 UTC (permalink / raw)
  To: Michal Marek, linux-kbuild, linux-kernel, Ben Hutchings; +Cc: Andrey Skvortsov

If CONFIG_MODULE_SIG_ALL is set, then user expects that all modules are
automatically signed in the result package, as it's for rpm-pkg, binrpm-pkg,
tar, tar-*. For deb-pkg this is correct only if CONFIG_DEBUG_INFO
is NOT set. In that case deb-package contains signed modules.

But if CONFIG_DEBUG_INFO is set, builddeb creates separate package with
debug information. To do that, debug information from all modules
is copied into separate files by objcopy. And loadable kernel modules are
stripped afterwards. Stripping removes previously (during modules_install)
added signatures from loadable kernel modules. Therefore final deb-package
contains unsigned modules despite of set option CONFIG_MODULE_SIG_ALL.

This patch resigns all stripped modules if CONFIG_MODULE_SIG_ALL is set
to solve this problem.

Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
---
 scripts/package/builddeb |    6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/scripts/package/builddeb b/scripts/package/builddeb
index 88dbf23..977c4d7 100755
--- a/scripts/package/builddeb
+++ b/scripts/package/builddeb
@@ -162,6 +162,12 @@ if grep -q '^CONFIG_MODULES=y' $KCONFIG_CONFIG ; then
 			# then add a link to those
 			$OBJCOPY --add-gnu-debuglink=$dbg_dir/usr/lib/debug/$module $tmpdir/$module
 		done
+
+                # resign stripped modules
+                MODULE_SIG_ALL="$(grep -s '^CONFIG_MODULE_SIG_ALL=y' $KCONFIG_CONFIG || true)"
+                if [ -n "$MODULE_SIG_ALL" ]; then
+	            	INSTALL_MOD_PATH="$tmpdir" $MAKE KBUILD_SRC= modules_sign
+                fi
 	fi
 fi
 
-- 
1.7.10.4


^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [PATCH] builddeb: fix stripped module signatures if CONFIG_DEBUG_INFO and CONFIG_MODULE_SIG_ALL are set
  2015-03-16  8:20 [PATCH] builddeb: fix stripped module signatures if CONFIG_DEBUG_INFO and CONFIG_MODULE_SIG_ALL are set Andrey Skvortsov
@ 2015-04-21 13:58 ` Michal Marek
  2015-04-22 15:57   ` maximilian attems
  0 siblings, 1 reply; 8+ messages in thread
From: Michal Marek @ 2015-04-21 13:58 UTC (permalink / raw)
  To: Andrey Skvortsov, Ben Hutchings, maximilian attems
  Cc: linux-kbuild, linux-kernel

(added Max to Cc)

On 2015-03-16 09:20, Andrey Skvortsov wrote:
> If CONFIG_MODULE_SIG_ALL is set, then user expects that all modules are
> automatically signed in the result package, as it's for rpm-pkg, binrpm-pkg,
> tar, tar-*. For deb-pkg this is correct only if CONFIG_DEBUG_INFO
> is NOT set. In that case deb-package contains signed modules.
> 
> But if CONFIG_DEBUG_INFO is set, builddeb creates separate package with
> debug information. To do that, debug information from all modules
> is copied into separate files by objcopy. And loadable kernel modules are
> stripped afterwards. Stripping removes previously (during modules_install)
> added signatures from loadable kernel modules. Therefore final deb-package
> contains unsigned modules despite of set option CONFIG_MODULE_SIG_ALL.
> 
> This patch resigns all stripped modules if CONFIG_MODULE_SIG_ALL is set
> to solve this problem.
> 
> Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>

Max, Ben, are you fine with this patch? It looks OK to me, the
modules_sign target has been added for this very purpose.

Thanks,
Michal

> ---
>  scripts/package/builddeb |    6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/scripts/package/builddeb b/scripts/package/builddeb
> index 88dbf23..977c4d7 100755
> --- a/scripts/package/builddeb
> +++ b/scripts/package/builddeb
> @@ -162,6 +162,12 @@ if grep -q '^CONFIG_MODULES=y' $KCONFIG_CONFIG ; then
>  			# then add a link to those
>  			$OBJCOPY --add-gnu-debuglink=$dbg_dir/usr/lib/debug/$module $tmpdir/$module
>  		done
> +
> +                # resign stripped modules
> +                MODULE_SIG_ALL="$(grep -s '^CONFIG_MODULE_SIG_ALL=y' $KCONFIG_CONFIG || true)"
> +                if [ -n "$MODULE_SIG_ALL" ]; then
> +	            	INSTALL_MOD_PATH="$tmpdir" $MAKE KBUILD_SRC= modules_sign
> +                fi
>  	fi
>  fi
>  
> 


^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [PATCH] builddeb: fix stripped module signatures if CONFIG_DEBUG_INFO and CONFIG_MODULE_SIG_ALL are set
  2015-04-21 13:58 ` Michal Marek
@ 2015-04-22 15:57   ` maximilian attems
  2015-05-04 15:37     ` Andrey Skvortsov
  0 siblings, 1 reply; 8+ messages in thread
From: maximilian attems @ 2015-04-22 15:57 UTC (permalink / raw)
  To: Michal Marek; +Cc: Andrey Skvortsov, Ben Hutchings, linux-kbuild, linux-kernel

On Tue, Apr 21, 2015 at 03:58:48PM +0200, Michal Marek wrote:
> (added Max to Cc)
> 
> On 2015-03-16 09:20, Andrey Skvortsov wrote:
> > If CONFIG_MODULE_SIG_ALL is set, then user expects that all modules are
> > automatically signed in the result package, as it's for rpm-pkg, binrpm-pkg,
> > tar, tar-*. For deb-pkg this is correct only if CONFIG_DEBUG_INFO
> > is NOT set. In that case deb-package contains signed modules.
> > 
> > But if CONFIG_DEBUG_INFO is set, builddeb creates separate package with
> > debug information. To do that, debug information from all modules
> > is copied into separate files by objcopy. And loadable kernel modules are
> > stripped afterwards. Stripping removes previously (during modules_install)
> > added signatures from loadable kernel modules. Therefore final deb-package
> > contains unsigned modules despite of set option CONFIG_MODULE_SIG_ALL.
> > 
> > This patch resigns all stripped modules if CONFIG_MODULE_SIG_ALL is set
> > to solve this problem.
> > 
> > Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
> 
> Max, Ben, are you fine with this patch? It looks OK to me, the
> modules_sign target has been added for this very purpose.
> 

Ben seems busy with the release, so jumping in. The patch looks
perfect to me.

Acked-by: maximilian attems <max@stro.at>


^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [PATCH] builddeb: fix stripped module signatures if CONFIG_DEBUG_INFO and CONFIG_MODULE_SIG_ALL are set
  2015-04-22 15:57   ` maximilian attems
@ 2015-05-04 15:37     ` Andrey Skvortsov
  2015-05-04 18:22       ` Ben Hutchings
  2015-05-06 13:30       ` Michal Marek
  0 siblings, 2 replies; 8+ messages in thread
From: Andrey Skvortsov @ 2015-05-04 15:37 UTC (permalink / raw)
  To: maximilian attems; +Cc: Michal Marek, Ben Hutchings, linux-kbuild, linux-kernel

[-- Attachment #1: Type: text/plain, Size: 1659 bytes --]

On 22 Apr, maximilian attems wrote:
> On Tue, Apr 21, 2015 at 03:58:48PM +0200, Michal Marek wrote:
> > (added Max to Cc)
> > 
> > On 2015-03-16 09:20, Andrey Skvortsov wrote:
> > > If CONFIG_MODULE_SIG_ALL is set, then user expects that all modules are
> > > automatically signed in the result package, as it's for rpm-pkg, binrpm-pkg,
> > > tar, tar-*. For deb-pkg this is correct only if CONFIG_DEBUG_INFO
> > > is NOT set. In that case deb-package contains signed modules.
> > > 
> > > But if CONFIG_DEBUG_INFO is set, builddeb creates separate package with
> > > debug information. To do that, debug information from all modules
> > > is copied into separate files by objcopy. And loadable kernel modules are
> > > stripped afterwards. Stripping removes previously (during modules_install)
> > > added signatures from loadable kernel modules. Therefore final deb-package
> > > contains unsigned modules despite of set option CONFIG_MODULE_SIG_ALL.
> > > 
> > > This patch resigns all stripped modules if CONFIG_MODULE_SIG_ALL is set
> > > to solve this problem.
> > > 
> > > Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
> > 
> > Max, Ben, are you fine with this patch? It looks OK to me, the
> > modules_sign target has been added for this very purpose.
> > 
> 
> Ben seems busy with the release, so jumping in. The patch looks
> perfect to me.
> 
> Acked-by: maximilian attems <max@stro.at>
> 
Maximilian, thanks for the review.

Michal, are we waiting for Ben's acknowledge too?

-- 
Best regards,
Andrey Skvortsov

Secure e-mail with gnupg: See http://www.gnupg.org/
PGP Key ID: 0x57A3AEAD



[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [PATCH] builddeb: fix stripped module signatures if CONFIG_DEBUG_INFO and CONFIG_MODULE_SIG_ALL are set
  2015-05-04 15:37     ` Andrey Skvortsov
@ 2015-05-04 18:22       ` Ben Hutchings
  2015-05-06 13:30       ` Michal Marek
  1 sibling, 0 replies; 8+ messages in thread
From: Ben Hutchings @ 2015-05-04 18:22 UTC (permalink / raw)
  To: Andrey Skvortsov
  Cc: maximilian attems, Michal Marek, linux-kbuild, linux-kernel

[-- Attachment #1: Type: text/plain, Size: 1785 bytes --]

On Mon, 2015-05-04 at 18:37 +0300, Andrey Skvortsov wrote:
> On 22 Apr, maximilian attems wrote:
> > On Tue, Apr 21, 2015 at 03:58:48PM +0200, Michal Marek wrote:
> > > (added Max to Cc)
> > > 
> > > On 2015-03-16 09:20, Andrey Skvortsov wrote:
> > > > If CONFIG_MODULE_SIG_ALL is set, then user expects that all modules are
> > > > automatically signed in the result package, as it's for rpm-pkg, binrpm-pkg,
> > > > tar, tar-*. For deb-pkg this is correct only if CONFIG_DEBUG_INFO
> > > > is NOT set. In that case deb-package contains signed modules.
> > > > 
> > > > But if CONFIG_DEBUG_INFO is set, builddeb creates separate package with
> > > > debug information. To do that, debug information from all modules
> > > > is copied into separate files by objcopy. And loadable kernel modules are
> > > > stripped afterwards. Stripping removes previously (during modules_install)
> > > > added signatures from loadable kernel modules. Therefore final deb-package
> > > > contains unsigned modules despite of set option CONFIG_MODULE_SIG_ALL.
> > > > 
> > > > This patch resigns all stripped modules if CONFIG_MODULE_SIG_ALL is set
> > > > to solve this problem.
> > > > 
> > > > Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
> > > 
> > > Max, Ben, are you fine with this patch? It looks OK to me, the
> > > modules_sign target has been added for this very purpose.
> > > 
> > 
> > Ben seems busy with the release, so jumping in. The patch looks
> > perfect to me.
> > 
> > Acked-by: maximilian attems <max@stro.at>
> > 
> Maximilian, thanks for the review.
> 
> Michal, are we waiting for Ben's acknowledge too?

Don't wait for me.

Ben.

-- 
Ben Hutchings
If you seem to know what you are doing, you'll be given more to do.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [PATCH] builddeb: fix stripped module signatures if CONFIG_DEBUG_INFO and CONFIG_MODULE_SIG_ALL are set
  2015-05-04 15:37     ` Andrey Skvortsov
  2015-05-04 18:22       ` Ben Hutchings
@ 2015-05-06 13:30       ` Michal Marek
  2015-05-08 11:11         ` Andrey Skvortsov
  2015-05-08 13:47         ` maximilian attems
  1 sibling, 2 replies; 8+ messages in thread
From: Michal Marek @ 2015-05-06 13:30 UTC (permalink / raw)
  To: Andrey Skvortsov
  Cc: maximilian attems, Ben Hutchings, linux-kbuild, linux-kernel

On 2015-05-04 17:37, Andrey Skvortsov wrote:
> On 22 Apr, maximilian attems wrote:
>> On Tue, Apr 21, 2015 at 03:58:48PM +0200, Michal Marek wrote:
>>> (added Max to Cc)
>>>
>>> On 2015-03-16 09:20, Andrey Skvortsov wrote:
>>>> If CONFIG_MODULE_SIG_ALL is set, then user expects that all modules are
>>>> automatically signed in the result package, as it's for rpm-pkg, binrpm-pkg,
>>>> tar, tar-*. For deb-pkg this is correct only if CONFIG_DEBUG_INFO
>>>> is NOT set. In that case deb-package contains signed modules.
>>>>
>>>> But if CONFIG_DEBUG_INFO is set, builddeb creates separate package with
>>>> debug information. To do that, debug information from all modules
>>>> is copied into separate files by objcopy. And loadable kernel modules are
>>>> stripped afterwards. Stripping removes previously (during modules_install)
>>>> added signatures from loadable kernel modules. Therefore final deb-package
>>>> contains unsigned modules despite of set option CONFIG_MODULE_SIG_ALL.
>>>>
>>>> This patch resigns all stripped modules if CONFIG_MODULE_SIG_ALL is set
>>>> to solve this problem.
>>>>
>>>> Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
>>>
>>> Max, Ben, are you fine with this patch? It looks OK to me, the
>>> modules_sign target has been added for this very purpose.
>>>
>>
>> Ben seems busy with the release, so jumping in. The patch looks
>> perfect to me.
>>
>> Acked-by: maximilian attems <max@stro.at>
>>
> Maximilian, thanks for the review.
> 
> Michal, are we waiting for Ben's acknowledge too?

I applied the patch to kbuild.git#misc now, after fixing the whitespace.
Andrey, please use tabs for indentation, especially when the surrounding
code is already using this style.

Michal

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [PATCH] builddeb: fix stripped module signatures if CONFIG_DEBUG_INFO and CONFIG_MODULE_SIG_ALL are set
  2015-05-06 13:30       ` Michal Marek
@ 2015-05-08 11:11         ` Andrey Skvortsov
  2015-05-08 13:47         ` maximilian attems
  1 sibling, 0 replies; 8+ messages in thread
From: Andrey Skvortsov @ 2015-05-08 11:11 UTC (permalink / raw)
  To: Michal Marek; +Cc: maximilian attems, Ben Hutchings, linux-kbuild, linux-kernel

[-- Attachment #1: Type: text/plain, Size: 2168 bytes --]

On 06 May, Michal Marek wrote:
> On 2015-05-04 17:37, Andrey Skvortsov wrote:
> > On 22 Apr, maximilian attems wrote:
> >> On Tue, Apr 21, 2015 at 03:58:48PM +0200, Michal Marek wrote:
> >>> (added Max to Cc)
> >>>
> >>> On 2015-03-16 09:20, Andrey Skvortsov wrote:
> >>>> If CONFIG_MODULE_SIG_ALL is set, then user expects that all modules are
> >>>> automatically signed in the result package, as it's for rpm-pkg, binrpm-pkg,
> >>>> tar, tar-*. For deb-pkg this is correct only if CONFIG_DEBUG_INFO
> >>>> is NOT set. In that case deb-package contains signed modules.
> >>>>
> >>>> But if CONFIG_DEBUG_INFO is set, builddeb creates separate package with
> >>>> debug information. To do that, debug information from all modules
> >>>> is copied into separate files by objcopy. And loadable kernel modules are
> >>>> stripped afterwards. Stripping removes previously (during modules_install)
> >>>> added signatures from loadable kernel modules. Therefore final deb-package
> >>>> contains unsigned modules despite of set option CONFIG_MODULE_SIG_ALL.
> >>>>
> >>>> This patch resigns all stripped modules if CONFIG_MODULE_SIG_ALL is set
> >>>> to solve this problem.
> >>>>
> >>>> Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
> >>>
> >>> Max, Ben, are you fine with this patch? It looks OK to me, the
> >>> modules_sign target has been added for this very purpose.
> >>>
> >>
> >> Ben seems busy with the release, so jumping in. The patch looks
> >> perfect to me.
> >>
> >> Acked-by: maximilian attems <max@stro.at>
> >>
> > Maximilian, thanks for the review.
> > 
> > Michal, are we waiting for Ben's acknowledge too?
> 
> I applied the patch to kbuild.git#misc now, after fixing the whitespace.
> Andrey, please use tabs for indentation, especially when the surrounding
> code is already using this style.

Thanks, Michal.

Sorry about whitespaces. I checked the patch with
checkpatch.pl before posting and it did not complain. I'll pay more
attention to patches for non-[ch] files.

-- 
Best regards,
Andrey Skvortsov

Secure eMail with gnupg: See http://www.gnupg.org/
PGP Key ID: 0x57A3AEAD

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

^ permalink raw reply	[flat|nested] 8+ messages in thread

* Re: [PATCH] builddeb: fix stripped module signatures if CONFIG_DEBUG_INFO and CONFIG_MODULE_SIG_ALL are set
  2015-05-06 13:30       ` Michal Marek
  2015-05-08 11:11         ` Andrey Skvortsov
@ 2015-05-08 13:47         ` maximilian attems
  1 sibling, 0 replies; 8+ messages in thread
From: maximilian attems @ 2015-05-08 13:47 UTC (permalink / raw)
  To: Michal Marek; +Cc: Andrey Skvortsov, Ben Hutchings, linux-kbuild, linux-kernel

Hello Michal,

On Wed, May 06, 2015 at 03:30:28PM +0200, Michal Marek wrote:
> 
> I applied the patch to kbuild.git#misc now, after fixing the whitespace.
> Andrey, please use tabs for indentation, especially when the surrounding
> code is already using this style.

please apply this arm thingy too:

- [PATCHv4 1/1] deb-pkg: Add device tree blobs to the package
  reviewed by ben and acked by me.
  20150203121648.046396044@rtp-net.org

 
thanks,

-- 
maks

^ permalink raw reply	[flat|nested] 8+ messages in thread

end of thread, other threads:[~2015-05-08 13:48 UTC | newest]

Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-03-16  8:20 [PATCH] builddeb: fix stripped module signatures if CONFIG_DEBUG_INFO and CONFIG_MODULE_SIG_ALL are set Andrey Skvortsov
2015-04-21 13:58 ` Michal Marek
2015-04-22 15:57   ` maximilian attems
2015-05-04 15:37     ` Andrey Skvortsov
2015-05-04 18:22       ` Ben Hutchings
2015-05-06 13:30       ` Michal Marek
2015-05-08 11:11         ` Andrey Skvortsov
2015-05-08 13:47         ` maximilian attems

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).