Merge tag 'modsign-pkcs7-20150812-3' of...

# Leavings from module signing

#

extra_certificates

signing_key.pem

signing_key.priv

signing_key.x509

x509.genkey

The value can be overridden in which case the default value is ignored.

KBUILD_SIGN_PIN

--------------------------------------------------

This variable allows a passphrase or PIN to be passed to the sign-file

utility when signing kernel modules, if the private key requires such.

KBUILD_MODPOST_WARN

--------------------------------------------------

KBUILD_MODPOST_WARN can be set to avoid errors in case of undefined

     their signatures checked without causing a dependency loop.

 (4) "File name or PKCS#11 URI of module signing key" (CONFIG_MODULE_SIG_KEY)

     Setting this option to something other than its default of

     "signing_key.pem" will disable the autogeneration of signing keys and

     allow the kernel modules to be signed with a key of your choosing.

     The string provided should identify a file containing both a private

     key and its corresponding X.509 certificate in PEM form, or — on

     systems where the OpenSSL ENGINE_pkcs11 is functional — a PKCS#11 URI

     as defined by RFC7512. In the latter case, the PKCS#11 URI should

     reference both a certificate and a private key.

     If the PEM file containing the private key is encrypted, or if the

     PKCS#11 token requries a PIN, this can be provided at build time by

     means of the KBUILD_SIGN_PIN variable.

 (5) "Additional X.509 keys for default system keyring" (CONFIG_SYSTEM_TRUSTED_KEYS)

     This option can be set to the filename of a PEM-encoded file containing

     additional certificates which will be included in the system keyring by

     default.

Note that enabling module signing adds a dependency on the OpenSSL devel

packages to the kernel build processes for the tool that does the signing.

=======================

GENERATING SIGNING KEYS

=======================

kernel so that it can be used to check the signatures as the modules are

loaded.

Under normal conditions, the kernel build will automatically generate a new

keypair using openssl if one does not exist in the files:

Under normal conditions, when CONFIG_MODULE_SIG_KEY is unchanged from its

default, the kernel build will automatically generate a new keypair using

openssl if one does not exist in the file:

	signing_key.priv

	signing_key.x509

	signing_key.pem

during the building of vmlinux (the public part of the key needs to be built

into vmlinux) using parameters in the:

generate the public/private key files:

	openssl req -new -nodes -utf8 -sha256 -days 36500 -batch -x509 \

	   -config x509.genkey -outform DER -out signing_key.x509 \

	   -keyout signing_key.priv

	   -config x509.genkey -outform PEM -out kernel_key.pem \

	   -keyout kernel_key.pem

The full pathname for the resulting kernel_key.pem file can then be specified

in the CONFIG_MODULE_SIG_KEY option, and the certificate and key therein will

be used instead of an autogenerated keypair.

=========================

	302d2d52 I------     1 perm 1f010000     0     0 asymmetri Fedora kernel signing key: d69a84e6bce3d216b979e9505b3e3ef9a7118079: X509.RSA a7118079 []

	...

Beyond the public key generated specifically for module signing, any file

placed in the kernel source root directory or the kernel build root directory

whose name is suffixed with ".x509" will be assumed to be an X.509 public key

and will be added to the keyring.

Beyond the public key generated specifically for module signing, additional

trusted certificates can be provided in a PEM-encoded file referenced by the

CONFIG_SYSTEM_TRUSTED_KEYS configuration option.

Further, the architecture code may take public keys from a hardware store and

add those in also (e.g. from the UEFI key database).

the Linux kernel source tree.  The script requires 4 arguments:

	1.  The hash algorithm (e.g., sha256)

	2.  The private key filename

	2.  The private key filename or PKCS#11 URI

	3.  The public key filename

	4.  The kernel module to be signed

doesn't, you should make sure that hash algorithm is either built into the

kernel or can be loaded without requiring itself.

If the private key requires a passphrase or PIN, it can be provided in the

$KBUILD_SIGN_PIN environment variable.

============================

SIGNED MODULES AND STRIPPING

# export INITRD_COMPRESS := $(INITRD_COMPRESS-y)

ifdef CONFIG_MODULE_SIG_ALL

MODSECKEY = ./signing_key.priv

MODSECKEY = $(CONFIG_MODULE_SIG_KEY)

MODPUBKEY = ./signing_key.x509

export MODPUBKEY

mod_sign_cmd = perl $(srctree)/scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(MODSECKEY) $(MODPUBKEY)

mod_sign_cmd = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) $(MODSECKEY) $(MODPUBKEY)

else

mod_sign_cmd = true

endif

		  arch/*/include/generated .tmp_objdiff

MRPROPER_FILES += .config .config.old .version .old_version \

		  Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS \

		  signing_key.priv signing_key.x509 x509.genkey		\

		  extra_certificates signing_key.x509.keyid		\

		  signing_key.pem signing_key.priv signing_key.x509	\

		  x509.genkey extra_certificates signing_key.x509.keyid	\

		  signing_key.x509.signer vmlinux-gdb.py

# clean - Delete most, but leave enough to build external modules

	int ret;

	ret = verify_pefile_signature(kernel, kernel_len,

				      system_trusted_keyring, &trusted);

				      system_trusted_keyring,

				      VERIFYING_KEXEC_PE_SIGNATURE,

				      &trusted);

	if (ret < 0)

		return ret;

	if (!trusted)