Djam/kernel-6.1
1
0
Fork 0
mirror of https://abf.rosa.ru/djam/kernel-6.1.git synced 2025-02-25 00:02:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Verify that modules are signed (multithreaded)

Browse source
This commit is contained in:
Mikhail Novosyolov 2019-11-11 21:16:01 +03:00
parent 3a8564ce81
commit f05348d4fa
1 changed files with 31 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
kernel.spec
View file

@ -4,7 +4,7 @@
%define sublevel 7 %define sublevel 7
# Release number. Increase this before a rebuild. # Release number. Increase this before a rebuild.
%define rpmrel 5 %define rpmrel 6
%define fullrpmrel %{rpmrel} %define fullrpmrel %{rpmrel}
%define rpmtag %{disttag} %define rpmtag %{disttag}
@ -63,6 +63,7 @@
%define certs_dir_rnd %{src_dir}/certs_%{vendor}_rnd %define certs_dir_rnd %{src_dir}/certs_%{vendor}_rnd
%define certs_signing_key_rnd %{certs_dir_rnd}/signing_key.pem %define certs_signing_key_rnd %{certs_dir_rnd}/signing_key.pem
%define certs_key_config_rnd %{certs_dir_rnd}/x509.genkey %define certs_key_config_rnd %{certs_dir_rnd}/x509.genkey
%define certs_verify_tmp %{certs_dir_rnd}/verify.tmp
# %%certs_email_rnd expansion has bashisms # %%certs_email_rnd expansion has bashisms
%define _buildshell /bin/bash %define _buildshell /bin/bash
# On ABF, %%packager == $username <$email> # On ABF, %%packager == $username <$email>
@ -249,6 +250,8 @@ BuildRequires: pkgconfig(libcrypto)
%if %{enhanced_security} %if %{enhanced_security}
# To generate keys # To generate keys
BuildRequires: openssl BuildRequires: openssl
# To verify signatures (find, xargs, hexdump)
BuildRequires: findutils util-linux
%endif %endif
# might be useful too: # might be useful too:
@ -1003,6 +1006,33 @@ cd %src_dir
rm -rf %{buildroot} rm -rf %{buildroot}
cp -a %{temp_root} %{buildroot} cp -a %{temp_root} %{buildroot}
%if %{enhanced_security}
# Multithreaded verification that every kernel module
# has a signature attached to it
mkdir -p "%{certs_dir_rnd}"
echo 0 > %{certs_verify_tmp}
_verify_signature(){
if [ -z "$1" ] || [ ! -f "$1" ]; then return; fi
if hexdump -C "$1" | awk -F '|' '{print $2}' | tr -d '\n' | \
grep -q '~Module signature appended~'
then
echo $(($(cat %{certs_verify_tmp})+1)) > %{certs_verify_tmp}
else
echo "ERROR: Module $1 has no signature attached to it!"
exit 1
fi
}
export -f _verify_signature
find %{target_modules} -name '*.ko' -print0 | sort -u | \
xargs --null -P "$(nproc)" -I {} "$SHELL" -x -c '_verify_signature "{}"'
if [ "$(cat %{certs_verify_tmp})" -lt 1 ]; then
echo "ERROR: seems that signatures of none modules were verified!"
exit 1
fi
cat %{certs_verify_tmp}
rm -f %{certs_verify_tmp}
%endif
# compressing modules # compressing modules
%if %{build_modxz} %if %{build_modxz}
find %{target_modules} -name "*.ko" | %kxargs xz -6e find %{target_modules} -name "*.ko" | %kxargs xz -6e