|
| 1 | +# |
| 2 | +# Makefile for the linux kernel signature checking certificates. |
| 3 | +# |
| 4 | + |
| 5 | +obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o |
| 6 | + |
| 7 | +############################################################################### |
| 8 | +# |
| 9 | +# When a Kconfig string contains a filename, it is suitable for |
| 10 | +# passing to shell commands. It is surrounded by double-quotes, and |
| 11 | +# any double-quotes or backslashes within it are escaped by |
| 12 | +# backslashes. |
| 13 | +# |
| 14 | +# This is no use for dependencies or $(wildcard). We need to strip the |
| 15 | +# surrounding quotes and the escaping from quotes and backslashes, and |
| 16 | +# we *do* need to escape any spaces in the string. So, for example: |
| 17 | +# |
| 18 | +# Usage: $(eval $(call config_filename,FOO)) |
| 19 | +# |
| 20 | +# Defines FOO_FILENAME based on the contents of the CONFIG_FOO option, |
| 21 | +# transformed as described above to be suitable for use within the |
| 22 | +# makefile. |
| 23 | +# |
| 24 | +# Also, if the filename is a relative filename and exists in the source |
| 25 | +# tree but not the build tree, define FOO_SRCPREFIX as $(srctree)/ to |
| 26 | +# be prefixed to *both* command invocation and dependencies. |
| 27 | +# |
| 28 | +# Note: We also print the filenames in the quiet_cmd_foo text, and |
| 29 | +# perhaps ought to have a version specially escaped for that purpose. |
| 30 | +# But it's only cosmetic, and $(patsubst "%",%,$(CONFIG_FOO)) is good |
| 31 | +# enough. It'll strip the quotes in the common case where there's no |
| 32 | +# space and it's a simple filename, and it'll retain the quotes when |
| 33 | +# there's a space. There are some esoteric cases in which it'll print |
| 34 | +# the wrong thing, but we don't really care. The actual dependencies |
| 35 | +# and commands *do* get it right, with various combinations of single |
| 36 | +# and double quotes, backslashes and spaces in the filenames. |
| 37 | +# |
| 38 | +############################################################################### |
| 39 | +# |
| 40 | +quote := $(firstword " ") |
| 41 | +space := |
| 42 | +space += |
| 43 | +space_escape := %%%SPACE%%% |
| 44 | +# |
| 45 | +define config_filename |
| 46 | +ifneq ($$(CONFIG_$(1)),"") |
| 47 | +$(1)_FILENAME := $$(subst \\,\,$$(subst \$$(quote),$$(quote),$$(subst $$(space_escape),\$$(space),$$(patsubst "%",%,$$(subst $$(space),$$(space_escape),$$(CONFIG_$(1))))))) |
| 48 | +ifneq ($$(patsubst /%,%,$$(firstword $$($(1)_FILENAME))),$$(firstword $$($(1)_FILENAME))) |
| 49 | +else |
| 50 | +ifeq ($$(wildcard $$($(1)_FILENAME)),) |
| 51 | +ifneq ($$(wildcard $$(srctree)/$$($(1)_FILENAME)),) |
| 52 | +$(1)_SRCPREFIX := $(srctree)/ |
| 53 | +endif |
| 54 | +endif |
| 55 | +endif |
| 56 | +endif |
| 57 | +endef |
| 58 | +# |
| 59 | +############################################################################### |
| 60 | + |
| 61 | +ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) |
| 62 | + |
| 63 | +$(eval $(call config_filename,SYSTEM_TRUSTED_KEYS)) |
| 64 | + |
| 65 | +# GCC doesn't include .incbin files in -MD generated dependencies (PR#66871) |
| 66 | +$(obj)/system_certificates.o: $(obj)/x509_certificate_list |
| 67 | + |
| 68 | +# Cope with signing_key.x509 existing in $(srctree) not $(objtree) |
| 69 | +AFLAGS_system_certificates.o := -I$(srctree) |
| 70 | + |
| 71 | +quiet_cmd_extract_certs = EXTRACT_CERTS $(patsubst "%",%,$(2)) |
| 72 | + cmd_extract_certs = scripts/extract-cert $(2) $@ || ( rm $@; exit 1) |
| 73 | + |
| 74 | +targets += x509_certificate_list |
| 75 | +$(obj)/x509_certificate_list: scripts/extract-cert $(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(SYSTEM_TRUSTED_KEYS_FILENAME) FORCE |
| 76 | + $(call if_changed,extract_certs,$(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(CONFIG_SYSTEM_TRUSTED_KEYS)) |
| 77 | +endif |
| 78 | + |
| 79 | +clean-files := x509_certificate_list .x509.list |
| 80 | + |
| 81 | +ifeq ($(CONFIG_MODULE_SIG),y) |
| 82 | +############################################################################### |
| 83 | +# |
| 84 | +# If module signing is requested, say by allyesconfig, but a key has not been |
| 85 | +# supplied, then one will need to be generated to make sure the build does not |
| 86 | +# fail and that the kernel may be used afterwards. |
| 87 | +# |
| 88 | +############################################################################### |
| 89 | +ifndef CONFIG_MODULE_SIG_HASH |
| 90 | +$(error Could not determine digest type to use from kernel config) |
| 91 | +endif |
| 92 | + |
| 93 | +# We do it this way rather than having a boolean option for enabling an |
| 94 | +# external private key, because 'make randconfig' might enable such a |
| 95 | +# boolean option and we unfortunately can't make it depend on !RANDCONFIG. |
| 96 | +ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") |
| 97 | +$(obj)/signing_key.pem: $(obj)/x509.genkey |
| 98 | + @echo "###" |
| 99 | + @echo "### Now generating an X.509 key pair to be used for signing modules." |
| 100 | + @echo "###" |
| 101 | + @echo "### If this takes a long time, you might wish to run rngd in the" |
| 102 | + @echo "### background to keep the supply of entropy topped up. It" |
| 103 | + @echo "### needs to be run as root, and uses a hardware random" |
| 104 | + @echo "### number generator if one is available." |
| 105 | + @echo "###" |
| 106 | + openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ |
| 107 | + -batch -x509 -config $(obj)/x509.genkey \ |
| 108 | + -outform PEM -out $(obj)/signing_key.pem \ |
| 109 | + -keyout $(obj)/signing_key.pem 2>&1 |
| 110 | + @echo "###" |
| 111 | + @echo "### Key pair generated." |
| 112 | + @echo "###" |
| 113 | + |
| 114 | +$(obj)/x509.genkey: |
| 115 | + @echo Generating X.509 key generation config |
| 116 | + @echo >$@ "[ req ]" |
| 117 | + @echo >>$@ "default_bits = 4096" |
| 118 | + @echo >>$@ "distinguished_name = req_distinguished_name" |
| 119 | + @echo >>$@ "prompt = no" |
| 120 | + @echo >>$@ "string_mask = utf8only" |
| 121 | + @echo >>$@ "x509_extensions = myexts" |
| 122 | + @echo >>$@ |
| 123 | + @echo >>$@ "[ req_distinguished_name ]" |
| 124 | + @echo >>$@ "#O = Unspecified company" |
| 125 | + @echo >>$@ "CN = Build time autogenerated kernel key" |
| 126 | + @echo >>$@ "#emailAddress = [email protected]" |
| 127 | + @echo >>$@ |
| 128 | + @echo >>$@ "[ myexts ]" |
| 129 | + @echo >>$@ "basicConstraints=critical,CA:FALSE" |
| 130 | + @echo >>$@ "keyUsage=digitalSignature" |
| 131 | + @echo >>$@ "subjectKeyIdentifier=hash" |
| 132 | + @echo >>$@ "authorityKeyIdentifier=keyid" |
| 133 | +endif |
| 134 | + |
| 135 | +$(eval $(call config_filename,MODULE_SIG_KEY)) |
| 136 | + |
| 137 | +# If CONFIG_MODULE_SIG_KEY isn't a PKCS#11 URI, depend on it |
| 138 | +ifeq ($(patsubst pkcs11:%,%,$(firstword $(MODULE_SIG_KEY_FILENAME))),$(firstword $(MODULE_SIG_KEY_FILENAME))) |
| 139 | +X509_DEP := $(MODULE_SIG_KEY_SRCPREFIX)$(MODULE_SIG_KEY_FILENAME) |
| 140 | +endif |
| 141 | + |
| 142 | +# GCC PR#66871 again. |
| 143 | +$(obj)/system_certificates.o: $(obj)/signing_key.x509 |
| 144 | + |
| 145 | +$(obj)/signing_key.x509: scripts/extract-cert include/config/module/sig/key.h $(X509_DEP) |
| 146 | + $(call cmd,extract_certs,$(MODULE_SIG_KEY_SRCPREFIX)$(CONFIG_MODULE_SIG_KEY)) |
| 147 | +endif |
0 commit comments