Am 23.01.2015 um 12:43 schrieb Alexander Holler:
Am 23.01.2015 um 11:55 schrieb Michal Marek:
The .x509 file contains a certificate signed by the private key, but not
the private key. With some scripting, it can be used to verify the
module signatures.
Assuming that doesn't change (hopefully), I'll send v2 in a few minutes
(it just compiles in order to test it). Thanks for assuring me that
.x509 does not and will not contain the private key.
I'm happy I did that. Just deleting the private key currently doesn't
work. A subsequent make fails:
-----------------------------
(...)
###
### Deleting the private key used to sign modules.
###
DEPMOD 3.18.3-00076-ga775cc9
[root@krabat linux]# less signing_key.x509
"signing_key.x509" may be a binary file. See it anyway?
[root@krabat linux]# make -j4 bzImage modules && make -j4 modules_install
CHK include/config/kernel.release
CHK include/generated/uapi/linux/version.h
CHK include/generated/utsrelease.h
CALL scripts/checksyscalls.sh
CHK include/generated/compile.h
X.509 certificate list changed
CHK kernel/config_data.h
CERTS kernel/x509_certificate_list
- Including cert signing_key.x509
AS kernel/system_certificates.o
LD kernel/built-in.o
LINK vmlinux
LD vmlinux.o
MODPOST vmlinux.o
GEN .version
CHK include/generated/compile.h
UPD include/generated/compile.h
CC init/version.o
LD init/built-in.o
KSYM .tmp_kallsyms1.o
KSYM .tmp_kallsyms2.o
LD vmlinux
SORTEX vmlinux
SYSMAP System.map
Building modules, stage 2.
VOFFSET arch/x86/boot/voffset.h
CC arch/x86/boot/version.o
OBJCOPY arch/x86/boot/compressed/vmlinux.bin
RELOCS arch/x86/boot/compressed/vmlinux.relocs
CC arch/x86/boot/compressed/aslr.o
LZMA arch/x86/boot/compressed/vmlinux.bin.lzma
MODPOST 747 modules
MKPIGGY arch/x86/boot/compressed/piggy.S
AS arch/x86/boot/compressed/piggy.o
LD arch/x86/boot/compressed/vmlinux
OBJCOPY arch/x86/boot/vmlinux.bin
ZOFFSET arch/x86/boot/zoffset.h
AS arch/x86/boot/header.o
LD arch/x86/boot/setup.elf
OBJCOPY arch/x86/boot/setup.bin
BUILD arch/x86/boot/bzImage
Setup is 16316 bytes (padded to 16384 bytes).
System is 3908 kB
CRC a049b366
Kernel: arch/x86/boot/bzImage is ready (#682)
INSTALL arch/x86/crypto/aes-x86_64.ko
INSTALL arch/x86/crypto/blowfish-x86_64.ko
INSTALL arch/x86/crypto/camellia-aesni-avx-x86_64.ko
INSTALL arch/x86/crypto/aesni-intel.ko
Can't read private key
(...)
-----------------------------
Maybe that's the reason I've always deleted both files, can't remember.
I will see if I find the time and passion to change the Makefile in
order to fix that. So you might either use my existing patch or wait if
I will send a new one.
Regards,
Alexander Holler
--
To unsubscribe from this list: send the line "unsubscribe linux-kbuild" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
