| Message ID | 20230823115048.823011-7-masahiroy@kernel.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [1/8] kbuild: do not run depmod for 'make modules_sign' | expand |
On Wed 23 Aug 2023 20:50:47 GMT, Masahiro Yamada wrote: > Commit d890f510c8e4 ("MODSIGN: Add modules_sign make target") introduced > 'make modules_sign' to manually sign modules. > > Some time later, commit d9d8d7ed498e ("MODSIGN: Add option to not sign > modules during modules_install") introduced CONFIG_MODULE_SIG_ALL. > If it was disabled, mod_sign_cmd was set to no-op ('true' command). > It affected not only 'make modules_install' but also 'make modules_sign'. > With CONFIG_MODULE_SIG_ALL=n, 'make modules_install' did not sign modules > and 'make modules_sign' could not sign modules either. > > Kbuild has kept that behavior, and nobody has complained about it, but > I think it is weird. > > CONFIG_MODULE_SIG_ALL=n should turn off signing only for modules_install. > If users want to sign modules manually, they should be allowed to use > 'make modules_sign'. > > Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> > --- Reviewed-by: Nicolas Schier <nicolas@fjasle.eu> > > scripts/Makefile.modinst | 9 +++++---- > 1 file changed, 5 insertions(+), 4 deletions(-) > > diff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst > index dc7c54669082..33d424a3f265 100644 > --- a/scripts/Makefile.modinst > +++ b/scripts/Makefile.modinst > @@ -106,7 +106,6 @@ endif > # Signing > # Don't stop modules_install even if we can't sign external modules. > # > -ifeq ($(CONFIG_MODULE_SIG_ALL),y) > ifeq ($(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)),) > sig-key := $(if $(wildcard $(CONFIG_MODULE_SIG_KEY)),,$(srctree)/)$(CONFIG_MODULE_SIG_KEY) > else > @@ -115,13 +114,15 @@ endif > quiet_cmd_sign = SIGN $@ > cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) "$(sig-key)" certs/signing_key.x509 $@ \ > $(if $(KBUILD_EXTMOD),|| true) > -else > + > +ifeq ($(modules_sign_only),) > + > +# During modules_install, modules are signed only when CONFIG_MODULE_SIG_ALL=y. > +ifndef CONFIG_MODULE_SIG_ALL > quiet_cmd_sign := > cmd_sign := : > endif > > -ifeq ($(modules_sign_only),) > - > $(dst)/%.ko: $(extmod_prefix)%.ko FORCE > $(call cmd,install) > $(call cmd,strip) > -- > 2.39.2
diff --git a/scripts/Makefile.modinst b/scripts/Makefile.modinst index dc7c54669082..33d424a3f265 100644 --- a/scripts/Makefile.modinst +++ b/scripts/Makefile.modinst @@ -106,7 +106,6 @@ endif # Signing # Don't stop modules_install even if we can't sign external modules. # -ifeq ($(CONFIG_MODULE_SIG_ALL),y) ifeq ($(filter pkcs11:%, $(CONFIG_MODULE_SIG_KEY)),) sig-key := $(if $(wildcard $(CONFIG_MODULE_SIG_KEY)),,$(srctree)/)$(CONFIG_MODULE_SIG_KEY) else @@ -115,13 +114,15 @@ endif quiet_cmd_sign = SIGN $@ cmd_sign = scripts/sign-file $(CONFIG_MODULE_SIG_HASH) "$(sig-key)" certs/signing_key.x509 $@ \ $(if $(KBUILD_EXTMOD),|| true) -else + +ifeq ($(modules_sign_only),) + +# During modules_install, modules are signed only when CONFIG_MODULE_SIG_ALL=y. +ifndef CONFIG_MODULE_SIG_ALL quiet_cmd_sign := cmd_sign := : endif -ifeq ($(modules_sign_only),) - $(dst)/%.ko: $(extmod_prefix)%.ko FORCE $(call cmd,install) $(call cmd,strip)
Commit d890f510c8e4 ("MODSIGN: Add modules_sign make target") introduced 'make modules_sign' to manually sign modules. Some time later, commit d9d8d7ed498e ("MODSIGN: Add option to not sign modules during modules_install") introduced CONFIG_MODULE_SIG_ALL. If it was disabled, mod_sign_cmd was set to no-op ('true' command). It affected not only 'make modules_install' but also 'make modules_sign'. With CONFIG_MODULE_SIG_ALL=n, 'make modules_install' did not sign modules and 'make modules_sign' could not sign modules either. Kbuild has kept that behavior, and nobody has complained about it, but I think it is weird. CONFIG_MODULE_SIG_ALL=n should turn off signing only for modules_install. If users want to sign modules manually, they should be allowed to use 'make modules_sign'. Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> --- scripts/Makefile.modinst | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)