lkml.org 
[lkml]   [2015]   [May]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 10/8] modsign: Allow password to be specified for signing key
From
Date
On Tue, 2015-05-19 at 15:45 +0100, David Woodhouse wrote:
> We don't want this in the Kconfig since it might then get exposed in
> /proc/config.gz. So make it a parameter to Kbuild instead. This also
> means we don't have to jump through hoops to strip quotes from it, as
> we would if it was a config option.

Definitely better. (FYI, Dmitry's modsig patches from 2012 used the
keyring for safely storing a password. )

Mimi

> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
> ---
> Documentation/kbuild/kbuild.txt | 5 +++++
> Documentation/module-signing.txt | 3 +++
> scripts/sign-file.c | 27 ++++++++++++++++++++++++++-
> 3 files changed, 34 insertions(+), 1 deletion(-)
>
> diff --git a/Documentation/kbuild/kbuild.txt b/Documentation/kbuild/kbuild.txt
> index 6466704..0ff6a46 100644
> --- a/Documentation/kbuild/kbuild.txt
> +++ b/Documentation/kbuild/kbuild.txt
> @@ -174,6 +174,11 @@ The output directory is often set using "O=..." on the commandline.
>
> The value can be overridden in which case the default value is ignored.
>
> +KBUILD_SIGN_PIN
> +--------------------------------------------------
> +This variable allows a passphrase or PIN to be passed to the sign-file
> +utility when signing kernel modules, if the private key requires such.
> +
> KBUILD_MODPOST_WARN
> --------------------------------------------------
> KBUILD_MODPOST_WARN can be set to avoid errors in case of undefined
> diff --git a/Documentation/module-signing.txt b/Documentation/module-signing.txt
> index c72702e..faaa6ea 100644
> --- a/Documentation/module-signing.txt
> +++ b/Documentation/module-signing.txt
> @@ -194,6 +194,9 @@ The hash algorithm used does not have to match the one configured, but if it
> doesn't, you should make sure that hash algorithm is either built into the
> kernel or can be loaded without requiring itself.
>
> +If the private key requires a passphrase or PIN, it can be provided in the
> +$KBUILD_SIGN_PIN environment variable.
> +
>
> ============================
> SIGNED MODULES AND STRIPPING
> diff --git a/scripts/sign-file.c b/scripts/sign-file.c
> index 39aaabe..720b9bc 100755
> --- a/scripts/sign-file.c
> +++ b/scripts/sign-file.c
> @@ -80,6 +80,27 @@ static void drain_openssl_errors(void)
> } \
> } while(0)
>
> +static const char *key_pass;
> +
> +static int pem_pw_cb(char *buf, int len, int w, void *v)
> +{
> + int pwlen;
> +
> + if (!key_pass)
> + return -1;
> +
> + pwlen = strlen(key_pass);
> + if (pwlen >= len)
> + return -1;
> +
> + strcpy(buf, key_pass);
> +
> + /* If it's wrong, don't keep trying it. */
> + key_pass = NULL;
> +
> + return pwlen;
> +}
> +
> int main(int argc, char **argv)
> {
> struct module_signature sig_info = { .id_type = PKEY_ID_PKCS7 };
> @@ -96,9 +117,12 @@ int main(int argc, char **argv)
> BIO *b, *bd = NULL, *bm;
> int opt, n;
>
> + OpenSSL_add_all_algorithms();
> ERR_load_crypto_strings();
> ERR_clear_error();
>
> + key_pass = getenv("KBUILD_SIGN_PIN");
> +
> do {
> opt = getopt(argc, argv, "dp");
> switch (opt) {
> @@ -132,7 +156,8 @@ int main(int argc, char **argv)
> */
> b = BIO_new_file(private_key_name, "rb");
> ERR(!b, "%s", private_key_name);
> - private_key = PEM_read_bio_PrivateKey(b, NULL, NULL, NULL);
> + private_key = PEM_read_bio_PrivateKey(b, NULL, pem_pw_cb, NULL);
> + ERR(!private_key, "%s", private_key_name);
> BIO_free(b);
>
> b = BIO_new_file(x509_name, "rb");
> --
> 2.4.0
>
>




\
 
 \ /
  Last update: 2015-05-19 21:21    [W:1.421 / U:0.216 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site