blob: 2773c4afa24c0af0d8bfd73ab05a01606c292a7d
1 | # |
2 | # Makefile for the linux kernel signature checking certificates. |
3 | # |
4 | |
5 | obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o |
6 | |
7 | ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) |
8 | |
9 | $(eval $(call config_filename,SYSTEM_TRUSTED_KEYS)) |
10 | |
11 | # GCC doesn't include .incbin files in -MD generated dependencies (PR#66871) |
12 | $(obj)/system_certificates.o: $(obj)/x509_certificate_list |
13 | |
14 | # Cope with signing_key.x509 existing in $(srctree) not $(objtree) |
15 | AFLAGS_system_certificates.o := -I$(srctree) |
16 | |
17 | quiet_cmd_extract_certs = EXTRACT_CERTS $(patsubst "%",%,$(2)) |
18 | cmd_extract_certs = scripts/extract-cert $(2) $@ || ( rm $@; exit 1) |
19 | |
20 | targets += x509_certificate_list |
21 | $(obj)/x509_certificate_list: scripts/extract-cert $(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(SYSTEM_TRUSTED_KEYS_FILENAME) FORCE |
22 | $(call if_changed,extract_certs,$(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(CONFIG_SYSTEM_TRUSTED_KEYS)) |
23 | endif |
24 | |
25 | clean-files := x509_certificate_list .x509.list |
26 | |
27 | ifeq ($(CONFIG_MODULE_SIG),y) |
28 | ############################################################################### |
29 | # |
30 | # If module signing is requested, say by allyesconfig, but a key has not been |
31 | # supplied, then one will need to be generated to make sure the build does not |
32 | # fail and that the kernel may be used afterwards. |
33 | # |
34 | ############################################################################### |
35 | ifndef CONFIG_MODULE_SIG_HASH |
36 | $(error Could not determine digest type to use from kernel config) |
37 | endif |
38 | |
39 | redirect_openssl = 2>&1 |
40 | quiet_redirect_openssl = 2>&1 |
41 | silent_redirect_openssl = 2>/dev/null |
42 | |
43 | # We do it this way rather than having a boolean option for enabling an |
44 | # external private key, because 'make randconfig' might enable such a |
45 | # boolean option and we unfortunately can't make it depend on !RANDCONFIG. |
46 | ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") |
47 | $(obj)/signing_key.pem: $(obj)/x509.genkey |
48 | @$(kecho) "###" |
49 | @$(kecho) "### Now generating an X.509 key pair to be used for signing modules." |
50 | @$(kecho) "###" |
51 | @$(kecho) "### If this takes a long time, you might wish to run rngd in the" |
52 | @$(kecho) "### background to keep the supply of entropy topped up. It" |
53 | @$(kecho) "### needs to be run as root, and uses a hardware random" |
54 | @$(kecho) "### number generator if one is available." |
55 | @$(kecho) "###" |
56 | $(Q)openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ |
57 | -batch -x509 -config $(obj)/x509.genkey \ |
58 | -outform PEM -out $(obj)/signing_key.pem \ |
59 | -keyout $(obj)/signing_key.pem \ |
60 | $($(quiet)redirect_openssl) |
61 | @$(kecho) "###" |
62 | @$(kecho) "### Key pair generated." |
63 | @$(kecho) "###" |
64 | |
65 | $(obj)/x509.genkey: |
66 | @$(kecho) Generating X.509 key generation config |
67 | @echo >$@ "[ req ]" |
68 | @echo >>$@ "default_bits = 4096" |
69 | @echo >>$@ "distinguished_name = req_distinguished_name" |
70 | @echo >>$@ "prompt = no" |
71 | @echo >>$@ "string_mask = utf8only" |
72 | @echo >>$@ "x509_extensions = myexts" |
73 | @echo >>$@ |
74 | @echo >>$@ "[ req_distinguished_name ]" |
75 | @echo >>$@ "#O = Unspecified company" |
76 | @echo >>$@ "CN = Build time autogenerated kernel key" |
77 | @echo >>$@ "#emailAddress = unspecified.user@unspecified.company" |
78 | @echo >>$@ |
79 | @echo >>$@ "[ myexts ]" |
80 | @echo >>$@ "basicConstraints=critical,CA:FALSE" |
81 | @echo >>$@ "keyUsage=digitalSignature" |
82 | @echo >>$@ "subjectKeyIdentifier=hash" |
83 | @echo >>$@ "authorityKeyIdentifier=keyid" |
84 | endif |
85 | |
86 | $(eval $(call config_filename,MODULE_SIG_KEY)) |
87 | |
88 | # If CONFIG_MODULE_SIG_KEY isn't a PKCS#11 URI, depend on it |
89 | ifeq ($(patsubst pkcs11:%,%,$(firstword $(MODULE_SIG_KEY_FILENAME))),$(firstword $(MODULE_SIG_KEY_FILENAME))) |
90 | X509_DEP := $(MODULE_SIG_KEY_SRCPREFIX)$(MODULE_SIG_KEY_FILENAME) |
91 | endif |
92 | |
93 | # GCC PR#66871 again. |
94 | $(obj)/system_certificates.o: $(obj)/signing_key.x509 |
95 | |
96 | targets += signing_key.x509 |
97 | $(obj)/signing_key.x509: scripts/extract-cert $(X509_DEP) FORCE |
98 | $(call if_changed,extract_certs,$(MODULE_SIG_KEY_SRCPREFIX)$(CONFIG_MODULE_SIG_KEY)) |
99 | endif |
100 |