Version:  2.0.40 2.2.26 2.4.37 3.13 3.14 3.15 3.16 3.17 3.18 3.19 4.0 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9 4.10

Linux/certs/Makefile

  1 #
  2 # Makefile for the linux kernel signature checking certificates.
  3 #
  4 
  5 obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o
  6 
  7 ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING),y)
  8 
  9 $(eval $(call config_filename,SYSTEM_TRUSTED_KEYS))
 10 
 11 # GCC doesn't include .incbin files in -MD generated dependencies (PR#66871)
 12 $(obj)/system_certificates.o: $(obj)/x509_certificate_list
 13 
 14 # Cope with signing_key.x509 existing in $(srctree) not $(objtree)
 15 AFLAGS_system_certificates.o := -I$(srctree)
 16 
 17 quiet_cmd_extract_certs  = EXTRACT_CERTS   $(patsubst "%",%,$(2))
 18       cmd_extract_certs  = scripts/extract-cert $(2) $@ || ( rm $@; exit 1)
 19 
 20 targets += x509_certificate_list
 21 $(obj)/x509_certificate_list: scripts/extract-cert $(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(SYSTEM_TRUSTED_KEYS_FILENAME) FORCE
 22         $(call if_changed,extract_certs,$(SYSTEM_TRUSTED_KEYS_SRCPREFIX)$(CONFIG_SYSTEM_TRUSTED_KEYS))
 23 endif
 24 
 25 clean-files := x509_certificate_list .x509.list
 26 
 27 ifeq ($(CONFIG_MODULE_SIG),y)
 28 ###############################################################################
 29 #
 30 # If module signing is requested, say by allyesconfig, but a key has not been
 31 # supplied, then one will need to be generated to make sure the build does not
 32 # fail and that the kernel may be used afterwards.
 33 #
 34 ###############################################################################
 35 ifndef CONFIG_MODULE_SIG_HASH
 36 $(error Could not determine digest type to use from kernel config)
 37 endif
 38 
 39 redirect_openssl        = 2>&1
 40 quiet_redirect_openssl  = 2>&1
 41 silent_redirect_openssl = 2>/dev/null
 42 
 43 # We do it this way rather than having a boolean option for enabling an
 44 # external private key, because 'make randconfig' might enable such a
 45 # boolean option and we unfortunately can't make it depend on !RANDCONFIG.
 46 ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem")
 47 $(obj)/signing_key.pem: $(obj)/x509.genkey
 48         @$(kecho) "###"
 49         @$(kecho) "### Now generating an X.509 key pair to be used for signing modules."
 50         @$(kecho) "###"
 51         @$(kecho) "### If this takes a long time, you might wish to run rngd in the"
 52         @$(kecho) "### background to keep the supply of entropy topped up.  It"
 53         @$(kecho) "### needs to be run as root, and uses a hardware random"
 54         @$(kecho) "### number generator if one is available."
 55         @$(kecho) "###"
 56         $(Q)openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \
 57                 -batch -x509 -config $(obj)/x509.genkey \
 58                 -outform PEM -out $(obj)/signing_key.pem \
 59                 -keyout $(obj)/signing_key.pem \
 60                 $($(quiet)redirect_openssl)
 61         @$(kecho) "###"
 62         @$(kecho) "### Key pair generated."
 63         @$(kecho) "###"
 64 
 65 $(obj)/x509.genkey:
 66         @$(kecho) Generating X.509 key generation config
 67         @echo  >$@ "[ req ]"
 68         @echo >>$@ "default_bits = 4096"
 69         @echo >>$@ "distinguished_name = req_distinguished_name"
 70         @echo >>$@ "prompt = no"
 71         @echo >>$@ "string_mask = utf8only"
 72         @echo >>$@ "x509_extensions = myexts"
 73         @echo >>$@
 74         @echo >>$@ "[ req_distinguished_name ]"
 75         @echo >>$@ "#O = Unspecified company"
 76         @echo >>$@ "CN = Build time autogenerated kernel key"
 77         @echo >>$@ "#emailAddress = unspecified.user@unspecified.company"
 78         @echo >>$@
 79         @echo >>$@ "[ myexts ]"
 80         @echo >>$@ "basicConstraints=critical,CA:FALSE"
 81         @echo >>$@ "keyUsage=digitalSignature"
 82         @echo >>$@ "subjectKeyIdentifier=hash"
 83         @echo >>$@ "authorityKeyIdentifier=keyid"
 84 endif
 85 
 86 $(eval $(call config_filename,MODULE_SIG_KEY))
 87 
 88 # If CONFIG_MODULE_SIG_KEY isn't a PKCS#11 URI, depend on it
 89 ifeq ($(patsubst pkcs11:%,%,$(firstword $(MODULE_SIG_KEY_FILENAME))),$(firstword $(MODULE_SIG_KEY_FILENAME)))
 90 X509_DEP := $(MODULE_SIG_KEY_SRCPREFIX)$(MODULE_SIG_KEY_FILENAME)
 91 endif
 92 
 93 # GCC PR#66871 again.
 94 $(obj)/system_certificates.o: $(obj)/signing_key.x509
 95 
 96 targets += signing_key.x509
 97 $(obj)/signing_key.x509: scripts/extract-cert $(X509_DEP) FORCE
 98         $(call if_changed,extract_certs,$(MODULE_SIG_KEY_SRCPREFIX)$(CONFIG_MODULE_SIG_KEY))
 99 endif

This page was automatically generated by LXR 0.3.1 (source).  •  Linux is a registered trademark of Linus Torvalds  •  Contact us