From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 392C5158013 for ; Mon, 11 Dec 2023 11:56:13 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 8E7F92BC03A; Mon, 11 Dec 2023 11:56:10 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 503252BC021 for ; Mon, 11 Dec 2023 11:56:10 +0000 (UTC) Message-ID: Subject: Re: [gentoo-dev] [PATCH v4] kernel-build.eclass: work around permissions issue with module signing From: =?UTF-8?Q?Micha=C5=82_G=C3=B3rny?= To: gentoo-dev@lists.gentoo.org Date: Mon, 11 Dec 2023 12:56:05 +0100 In-Reply-To: <9a4fbdce-29b5-4f82-a200-86a2e0e116f0@gentoo.org> References: <20231127171224.15172-1-vimproved@inventati.org> <6b3aea364b6c4fd0cc9622216aa5add0b1c342ba.camel@gentoo.org> <8f848f1b-7f70-49df-8840-54df6ee35b66@gentoo.org> <032d787a4f6375c61c7eb010feee2b87fa3f6b80.camel@gentoo.org> <9a4fbdce-29b5-4f82-a200-86a2e0e116f0@gentoo.org> Organization: Gentoo Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-wj9kUm6xkoQjVIm/tvyc" User-Agent: Evolution 3.50.1 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply MIME-Version: 1.0 X-Archives-Salt: a23b2548-cdd7-4fd4-8386-a52840e4e556 X-Archives-Hash: 70cbcf5f9178267e3c79e9a627a54644 --=-wj9kUm6xkoQjVIm/tvyc Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, 2023-12-11 at 12:28 +0100, Andrew Ammerlaan wrote: > > > diff --git a/eclass/kernel-build.eclass b/eclass/kernel-build.eclass > > > index f5529c319f9fc..94b499f82fc1e 100644 > > > --- a/eclass/kernel-build.eclass > > > +++ b/eclass/kernel-build.eclass > > > @@ -114,6 +114,13 @@ kernel-build_pkg_setup() { > > > =C2=A0=C2=A0=C2=A0 python-any-r1_pkg_setup > > > =C2=A0=C2=A0=C2=A0 if [[ ${KERNEL_IUSE_MODULES_SIGN} ]]; then > > > =C2=A0=C2=A0=C2=A0 secureboot_pkg_setup > > > + if [[ -e ${MODULES_SIGN_KEY} && ${MODULES_SIGN_KEY} !=3D pkcs11:* = ]]; then > > > + if [[ -e ${MODULES_SIGN_CERT} && ${MODULES_SIGN_CERT} !=3D > > > ${MODULES_SIGN_KEY} ]]; then > > > + MODULES_SIGN_KEY_CONTENTS=3D"$(cat "${MODULES_SIGN_CERT}" > > > "${MODULES_SIGN_KEY}" || die)" > >=20 > > You can use $(<...) builtin instead of calling cat(1). > >=20 >=20 >=20 > I don't have a strong preference, but I used cat here for esthetic=20 > symmetry reasons with the line above. Anyway, here's v4: >=20 > =C2=A0From 3890c558ff93b9cdb608a3bbcf4c3039f456b571 Mon Sep 17 00:00:00 2= 001 > From: Violet Purcell > Date: Mon, 27 Nov 2023 12:12:09 -0500 > Subject: [PATCH] kernel-build.eclass: work around permissions issue with > =C2=A0=C2=A0module signing >=20 > Currently, using a custom path for MODULES_SIGN_KEY requires the key to > be readable by portage:portage. This is not ideal for security, since > the file has to be either owned by portage:portage or readable by all > users in this case. Instead, export the contents of MODULES_SIGN_KEY to > a variable in pkg_setup, and then create a temporary file with it in > src_configure to ensure that the temporary key is readable by the user > that the kernel is being built as. The variable is then unset so it does > not end up in the final environment file. >=20 > Co-authored-by: Andrew Ammerlaan > Signed-off-by: Violet Purcell > --- > =C2=A0=C2=A0eclass/kernel-build.eclass | 18 ++++++++++++------ > =C2=A0=C2=A01 file changed, 12 insertions(+), 6 deletions(-) >=20 > diff --git a/eclass/kernel-build.eclass b/eclass/kernel-build.eclass > index f5529c319f9fc..6b692dc4f9a08 100644 > --- a/eclass/kernel-build.eclass > +++ b/eclass/kernel-build.eclass > @@ -114,6 +114,13 @@ kernel-build_pkg_setup() { > =C2=A0=C2=A0 python-any-r1_pkg_setup > =C2=A0=C2=A0 if [[ ${KERNEL_IUSE_MODULES_SIGN} ]]; then > =C2=A0=C2=A0 secureboot_pkg_setup > + if [[ -e ${MODULES_SIGN_KEY} && ${MODULES_SIGN_KEY} !=3D pkcs11:* ]]; = then > + if [[ -e ${MODULES_SIGN_CERT} && ${MODULES_SIGN_CERT} !=3D=20 > ${MODULES_SIGN_KEY} ]]; then > + MODULES_SIGN_KEY_CONTENTS=3D"$(cat "${MODULES_SIGN_CERT}"=20 > "${MODULES_SIGN_KEY}" || die)" > + else > + MODULES_SIGN_KEY_CONTENTS=3D"$(< "${MODULES_SIGN_KEY}")" > + fi > + fi > =C2=A0=C2=A0 fi > =C2=A0=C2=A0} >=20 > @@ -422,12 +429,11 @@ kernel-build_merge_configs() { > =C2=A0=C2=A0 CONFIG_MODULE_SIG_FORCE=3Dy > =C2=A0=C2=A0 CONFIG_MODULE_SIG_${MODULES_SIGN_HASH^^}=3Dy > =C2=A0=C2=A0 EOF > - if [[ -e ${MODULES_SIGN_KEY} && -e ${MODULES_SIGN_CERT} && > - ${MODULES_SIGN_KEY} !=3D ${MODULES_SIGN_CERT} && > - ${MODULES_SIGN_KEY} !=3D pkcs11:* ]] > - then > - cat "${MODULES_SIGN_CERT}" "${MODULES_SIGN_KEY}" >=20 > "${T}/kernel_key.pem" || die > - MODULES_SIGN_KEY=3D"${T}/kernel_key.pem" > + if [[ -n ${MODULES_SIGN_KEY_CONTENTS} ]]; then > + (umask 066 && touch "${T}/kernel_key.pem" || die) > + echo "${MODULES_SIGN_KEY_CONTENTS}" > "${T}/kernel_key.pem" || die > + unset MODULES_SIGN_KEY_CONTENTS > + export MODULES_SIGN_KEY=3D"${T}/kernel_key.pem" > =C2=A0=C2=A0 fi > =C2=A0=C2=A0 if [[ ${MODULES_SIGN_KEY} =3D=3D pkcs11:* || -r ${MODULES_= SIGN_KEY} ]];=20 > then > =C2=A0=C2=A0 echo "CONFIG_MODULE_SIG_KEY=3D\"${MODULES_SIGN_KEY}\"" \ LGTM but I didn't test it. --=20 Best regards, Micha=C5=82 G=C3=B3rny --=-wj9kUm6xkoQjVIm/tvyc Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- iQFGBAABCgAwFiEEx2qEUJQJjSjMiybFY5ra4jKeJA4FAmV2+NUSHG1nb3JueUBn ZW50b28ub3JnAAoJEGOa2uIyniQOkrUH/ip+7YKxHRz6DeIhNdvCygjlugv8Hncs meGngUriq/vD+Ne4WgNNnSzCsLV+l3I/imebEseAk4NVl0FV4fXUZfXDefkik5Sw HpIJWnFrdZO5P9nxHX9iD2ZRd3aBGFG6c+el8U/fbVwyji6J6cKbK9PatKXrz75h oDoX0T20YX5QOTBKnd3KKF0X6tIbICwufGqYTgzj/exuRzPeRbLhXQAj4PA4iXwg tseJZlgWHLtBAiKa8QAz8Ne9NgMNOAUxn4sfb4PA4d36Feh3rl0wzPmR6vBX2FUA NrNQEzkZPRczoWNbxgVxHuRFCR3jbzZWf6RvY1m7zkIr36HGVEyemBc= =zYb3 -----END PGP SIGNATURE----- --=-wj9kUm6xkoQjVIm/tvyc--