| Message ID | 1479787880-31811-2-git-send-email-mkayaalp@linux.vnet.ibm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com> wrote: > Include a random filled binary in vmlinux at the space reserved with > CONFIG_SYSTEM_EXTRA_CERTIFICATE. This results in an uncompressed reserved > area inside the bzImage as well, so that it can be replaced with an actual > certificate later (after the bzImage is distributed). You haven't said *why* you need an incompressible buffer. I presume it's something to do with the decompression wrapper. David -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
> On Nov 25, 2016, at 4:06 AM, David Howells <dhowells@redhat.com> wrote: > > Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com> wrote: > >> Include a random filled binary in vmlinux at the space reserved with >> CONFIG_SYSTEM_EXTRA_CERTIFICATE. This results in an uncompressed reserved >> area inside the bzImage as well, so that it can be replaced with an actual >> certificate later (after the bzImage is distributed). > > You haven't said *why* you need an incompressible buffer. I presume it's > something to do with the decompression wrapper. > After you replace zeroes with a certificate and compress again, the image size increases. Then, repackaging the bzImage becomes difficult. From the commit message of 3/4: > This patch adds the capability of extracting the > vmlinux, inserting the certificate, and repackaging the result into a > bzImage. > > It only works if the resulting compressed vmlinux is smaller than the > original. Otherwise re-linking would be required. To make the reserved > space allocate actual space in bzImage, incompressible bytes are > inserted into the vmlinux as a placeholder for the extra certificate. Mehmet -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/certs/Makefile b/certs/Makefile index 2773c4a..294c8bf 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -9,7 +9,12 @@ ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y) $(eval $(call config_filename,SYSTEM_TRUSTED_KEYS)) # GCC doesn't include .incbin files in -MD generated dependencies (PR#66871) -$(obj)/system_certificates.o: $(obj)/x509_certificate_list +ifeq ($(CONFIG_SYSTEM_EXTRA_CERTIFICATE),y) +system_certs_incbin = $(obj)/x509_certificate_list $(obj)/extra_cert_placeholder +else +system_certs_incbin = $(obj)/x509_certificate_list +endif +$(obj)/system_certificates.o: $(system_certs_incbin) # Cope with signing_key.x509 existing in $(srctree) not $(objtree) AFLAGS_system_certificates.o := -I$(srctree) @@ -17,12 +22,22 @@ AFLAGS_system_certificates.o := -I$(srctree) quiet_cmd_extract_certs = EXTRACT_CERTS $(patsubst "%",%,$(2)) cmd_extract_certs = scripts/extract-cert $(2) $@ || ( rm $@; exit 1) -targets += x509_certificate_list +targets += $(system_certs_incbin) $(obj)/x509_certificate_list: scripts/extract-cert $(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(SYSTEM_TRUSTED_KEYS_FILENAME) FORCE $(call if_changed,extract_certs,$(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(CONFIG_SYSTEM_TRUSTED_KEYS)) + +ifeq ($(CONFIG_SYSTEM_EXTRA_CERTIFICATE),y) +# Generate incompressible bytes. Use seed to make it reproducible +quiet_cmd_placeholder = EXTRA_CERT_PLACEHOLDER + cmd_placeholder = perl -e 'srand(0); printf("%c", int(rand(256))) for (1..$(2))' > $@ + +$(obj)/extra_cert_placeholder: FORCE + $(call if_changed,placeholder,$(CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE)) +endif + endif -clean-files := x509_certificate_list .x509.list +clean-files := $(system_certs_incbin) .x509.list ifeq ($(CONFIG_MODULE_SIG),y) ############################################################################### diff --git a/certs/system_certificates.S b/certs/system_certificates.S index c9ceb71..02b9222 100644 --- a/certs/system_certificates.S +++ b/certs/system_certificates.S @@ -17,7 +17,7 @@ __cert_list_end: .globl VMLINUX_SYMBOL(system_extra_cert) .size system_extra_cert, CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE VMLINUX_SYMBOL(system_extra_cert): - .fill CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE, 1, 0 + .incbin "certs/extra_cert_placeholder" .align 4 .globl VMLINUX_SYMBOL(system_extra_cert_used)
Include a random filled binary in vmlinux at the space reserved with CONFIG_SYSTEM_EXTRA_CERTIFICATE. This results in an uncompressed reserved area inside the bzImage as well, so that it can be replaced with an actual certificate later (after the bzImage is distributed). Signed-off-by: Mehmet Kayaalp <mkayaalp@linux.vnet.ibm.com> --- certs/Makefile | 21 ++++++++++++++++++--- certs/system_certificates.S | 2 +- 2 files changed, 19 insertions(+), 4 deletions(-)