From: Georgy Yakovlev <gyakovlev@gentoo.org>
To: gentoo-dev@lists.gentoo.org
Cc: Georgy Yakovlev <gyakovlev@gentoo.org>
Subject: [gentoo-dev] [PATCH] eclass/linux-mod.eclass: add module signing support
Date: Thu, 20 Sep 2018 22:13:04 -0700 [thread overview]
Message-ID: <20180921051304.115704-1-gyakovlev@gentoo.org> (raw)
This commit adds some eclass variables and private functions
and a new global useflag.
Example config, part of make.conf
USE="... module-sign ..."
KERNEL_MODULE_SIG_KEY="/secure/location/kernel.pem"
And possible kernel options:
CONFIG_MODULE_SIG=y
CONFIG_MODULE_SIG_FORCE=y
CONFIG_MODULE_SIG_ALL=y
CONFIG_MODULE_SIG_SHA512=y
CONFIG_MODULE_SIG_HASH="sha512"
NOTE to libressl users: libressl does not support anything
except CONFIG_MODULE_SIG_SHA1=y CONFIG_MODULE_SIG_HASH="sha1"
Even if user does not follow key creation procedure and
just enables module encryption while configuring kernel eclass "just works".
All the signing happens in pkg_preinst.
This means that binpkg users are expected to
have keys and sign modules on target system, not on builder.
I've been using this since March and have not encountered
a single problem with various out-of-tree kernel modules
Tested so far:
virtualbox-modules
nvidia-drivers
zfs & co
wireguard
and many more
If an ebuild uses Kbuild and/or runs linux-mod_pkg_preinst(), signing should work.
All the signing happens as root, this means user can have the
keys stored with secure permissions and mount as required.
If user configured kernel to require signed modules the eclass
will detect it and refuse to emerge if useflag is not enabled.
I'll appreciate your testing and feedbak.
NOTE to amdgpu users: if you use CONFIG_HSA_AMD, you'll want to have
CONFIG_HSA_AMD=y
having it as a module fails to sing for some reason, it's something in
kernel/kbuild and not related to this eclass change.
Closes: https://bugs.gentoo.org/447352
Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org>
---
eclass/linux-mod.eclass | 109 ++++++++++++++++++++++++++++++++++++++--
profiles/use.desc | 1 +
2 files changed, 106 insertions(+), 4 deletions(-)
diff --git a/eclass/linux-mod.eclass b/eclass/linux-mod.eclass
index e5b5ec782f0..540b55286f8 100644
--- a/eclass/linux-mod.eclass
+++ b/eclass/linux-mod.eclass
@@ -132,6 +132,20 @@
# @DESCRIPTION:
# It's a read-only variable. It contains the extension of the kernel modules.
+# @ECLASS-VARIABLE: KERNEL_MODULE_SIG_KEY
+# @USER_VARIABLE
+# @DEFAULT_UNSET
+# @DESCRIPTION:
+# A string, containing absolute path to the private key file.
+# eclass will use value of CONFIG_MODULE_SIG_KEY extracted from .config
+# if KERNEL_MODULE_SIG_KEY is not set by user.
+#
+# Example:
+# @CODE
+# KERNEL_MODULE_SIG_KEY="/secure/location/kernel.pem"
+# @CODE
+# Assumes that "/secure/location/kernel.x509" public key file exists.
+
inherit eutils linux-info multilib
EXPORT_FUNCTIONS pkg_setup pkg_preinst pkg_postinst src_install src_compile pkg_postrm
@@ -144,13 +158,16 @@ esac
0) die "EAPI=${EAPI} is not supported with MODULES_OPTIONAL_USE_IUSE_DEFAULT due to lack of IUSE defaults" ;;
esac
-IUSE="kernel_linux ${MODULES_OPTIONAL_USE:+${_modules_optional_use_iuse_default}}${MODULES_OPTIONAL_USE}"
+IUSE="module-sign kernel_linux ${MODULES_OPTIONAL_USE:+${_modules_optional_use_iuse_default}}${MODULES_OPTIONAL_USE}"
SLOT="0"
RDEPEND="${MODULES_OPTIONAL_USE}${MODULES_OPTIONAL_USE:+? (} kernel_linux? ( virtual/modutils ) ${MODULES_OPTIONAL_USE:+)}"
DEPEND="${RDEPEND}
${MODULES_OPTIONAL_USE}${MODULES_OPTIONAL_USE:+? (}
sys-apps/sed
- kernel_linux? ( virtual/linux-sources virtual/libelf )
+ kernel_linux? (
+ virtual/linux-sources virtual/libelf
+ module-sign? ( || ( dev-libs/openssl dev-libs/libressl ) )
+ )
${MODULES_OPTIONAL_USE:+)}"
# eclass utilities
@@ -352,6 +369,84 @@ get-KERNEL_CC() {
echo "${kernel_cc}"
}
+# @FUNCTION: _check_sig_force
+# @INTERNAL
+# @DESCRIPTION:
+# Check if kernel requires module signing and die
+# if modules are not going to be signed.
+_check_sig_force() {
+ debug-print-function ${FUNCNAME} "${@}"
+
+ if linux_chkconfig_present MODULE_SIG_FORCE; then
+ if use !module-sign; then
+ eerror "kernel .config has MODULE_SIG_FORCE=y option set"
+ eerror "This means that kernel requires all modules"
+ eerror "to be signed and verified before loading"
+ eerror "please enable USE=\"module-sign\" or reconfigure your kernel"
+ eerror "otherwise loading the module will fail"
+ die "signature required"
+ fi
+ fi
+}
+
+# @FUNCTION: _sign_module
+# @INTERNAL
+# @USAGE: <filename>
+# @DESCRIPTION:
+# Sign a kernel module
+_sign_module() {
+ debug-print-function ${FUNCNAME} "${@}"
+
+ local dotconfig_sig_hash dotconfig_sig_key
+ local sign_binary_path sig_key_path sig_x509_path
+ local module
+
+ # extract values from kernel .config
+ # extracted key path is not full, e.g. "certs/signing_key.pem"
+ dotconfig_sig_hash="$(linux_chkconfig_string MODULE_SIG_HASH)"
+ dotconfig_sig_key="$(linux_chkconfig_string MODULE_SIG_KEY)"
+
+ # sign-file binary chokes on double quotes
+ dotconfig_sig_hash=${dotconfig_sig_hash//\"/}
+ dotconfig_sig_key=${dotconfig_sig_key//\"/}
+
+ sign_binary_path="${KV_OUT_DIR}/scripts/sign-file"
+ sig_key_path="${KERNEL_MODULE_SIG_KEY:-${KV_OUT_DIR}/${dotconfig_sig_key}}"
+ sig_x509_path="${sig_key_path/.pem/.x509}"
+
+ module=${1##*/}
+
+ # some checks, because sign-file is dumb and produces cryptic errors
+ [[ -w "${1}" ]] || die "${1} not found or not writable"
+ grep -qFL '~Module signature appended~' "${1}" && die "${module} already signed"
+ [[ -x "${sign_binary_path}" ]] || die "${sign_binary_path} not found or not executable"
+ [[ -r "${sig_key_path}" ]] || die "Private key ${sig_key_path} not found or not readable"
+ [[ -r "${sig_x509_path}" ]] || die "Public key ${sig_x509_path} not found or not readable"
+
+ einfo "Signing ${module} using ${sig_key_path}:${dotconfig_sig_hash}"
+ "${sign_binary_path}" \
+ "${dotconfig_sig_hash}" "${sig_key_path}" "${sig_x509_path}" \
+ "${1}" || die "Signing ${module} failed"
+}
+
+# @FUNCTION: _sign_all_modules
+# @INTERNAL
+# @DESCRIPTION:
+# Signs all unsigned modules it finds in installation image
+# Called by linux-mod_pkg_preinst
+_sign_all_modules() {
+ debug-print-function ${FUNCNAME} "${@}"
+
+ [[ -z "${KV_OBJ}" ]] && set_kvobj
+ require_configured_kernel
+ check_kernel_built
+
+ local module
+ while read -rd '' module; do
+ _sign_module "${module}"
+ done < <(find "${ED}/lib/modules/${KV_FULL}" -name "*.${KV_OBJ}" -print0)
+}
+
# internal function
#
# FUNCTION:
@@ -583,12 +678,16 @@ linux-mod_pkg_setup() {
# External modules use kernel symbols (bug #591832)
CONFIG_CHECK+=" !TRIM_UNUSED_KSYMS"
+ # if signature is requested, check if kernel actually supports it
+ use module-sign && CONFIG_CHECK+=" MODULE_SIG"
+
linux-info_pkg_setup;
require_configured_kernel
check_kernel_built;
strip_modulenames;
[[ -n ${MODULE_NAMES} ]] && check_modules_supported
set_kvobj;
+ _check_sig_force
# Commented out with permission from johnm until a fixed version for arches
# who intentionally use different kernel and userland compilers can be
# introduced - Jason Wever <weeve@gentoo.org>, 23 Oct 2005
@@ -716,8 +815,8 @@ linux-mod_src_install() {
einfo "Installing ${modulename} module"
cd "${objdir}" || die "${objdir} does not exist"
- insinto /lib/modules/${KV_FULL}/${libdir}
- doins ${modulename}.${KV_OBJ} || die "doins ${modulename}.${KV_OBJ} failed"
+ insinto /lib/modules/"${KV_FULL}/${libdir}"
+ doins "${modulename}.${KV_OBJ}" || die "doins ${modulename}.${KV_OBJ} failed"
cd "${OLDPWD}"
generate_modulesd "${objdir}/${modulename}"
@@ -733,6 +832,8 @@ linux-mod_pkg_preinst() {
[ -d "${D}lib/modules" ] && UPDATE_DEPMOD=true || UPDATE_DEPMOD=false
[ -d "${D}lib/modules" ] && UPDATE_MODULEDB=true || UPDATE_MODULEDB=false
+ _check_sig_force
+ use module-sign && _sign_all_modules
}
# @FUNCTION: linux-mod_pkg_postinst
diff --git a/profiles/use.desc b/profiles/use.desc
index b03b5b9dade..d1da37c45fc 100644
--- a/profiles/use.desc
+++ b/profiles/use.desc
@@ -207,6 +207,7 @@ mms - Support for Microsoft Media Server (MMS) streams
mng - Add support for libmng (MNG images)
modplug - Add libmodplug support for playing SoundTracker-style music files
modules - Build the kernel modules
+module-sign - Sign the kernel modules
mono - Build Mono bindings to support dotnet type stuff
motif - Add support for the Motif toolkit
mozilla - Add support for the Mozilla web-browser
--
2.19.0
next reply other threads:[~2018-09-21 5:13 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-21 5:13 Georgy Yakovlev [this message]
2018-09-21 12:58 ` [gentoo-dev] [PATCH] eclass/linux-mod.eclass: add module signing support Alexander Tsoy
2018-09-21 22:59 ` Chí-Thanh Christopher Nguyễn
2018-09-22 2:30 ` Georgy Yakovlev
2018-09-22 2:22 ` Georgy Yakovlev
2018-10-01 8:48 ` [gentoo-dev] [PATCH 1/2] " Georgy Yakovlev
2018-10-01 8:48 ` [gentoo-dev] [PATCH 2/2] profiles: mask module signing for testing Georgy Yakovlev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180921051304.115704-1-gyakovlev@gentoo.org \
--to=gyakovlev@gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox