rpm-build/scripts/brp-sign-kmodules.in
2021-11-03 03:11:44 +03:00

135 lines
3.7 KiB
Bash
Executable File

#!/bin/sh -e
#
# brp-sign-kmodules - sign Linux kernel modules
#
# Copyright (C) 2020 Vitaly Chikunov <vt@altlinux.org>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
. @RPMCONFIGDIR@/functions
ValidateBuildRoot
cd "$RPM_BUILD_ROOT" || exit
# We need modules and kernel tree to work.
[ -d lib/modules ] || exit 0
[ -d boot ] || exit 0
# Find kernel build root.
kbuilddir=$(find "$RPM_BUILD_DIR" -depth -maxdepth 3 -type f -name MAINTAINERS -print -quit)
kbuilddir=${kbuilddir%/*}
if [ -z "$kbuilddir" ]; then
Warning "Kernel source directory not found."
exit 0
fi
# Determine build time `.config'. Allow 2 levels for builds in O=subdir.
kconfig=$(find "$kbuilddir" -depth -maxdepth 2 -type f -name .config -print -quit)
if [ -z "$kconfig" ]; then
Warning "Kernel build output directory not found."
exit 0
fi
# Kernel output dir (from O=)
koutput=${kconfig%/.config}
# Working requirement.
if [ ! -x "$koutput/scripts/sign-file" ]; then
Warning "scripts/sign-file executable not found."
exit 0
fi
get_config() {
"$kbuilddir/scripts/config" --file "$kconfig" -s "$1"
}
MODULE_SIG_ALL=$( get_config MODULE_SIG_ALL)
MODULE_SIG_HASH=$(get_config MODULE_SIG_HASH)
MODULE_SIG_KEY=$( get_config MODULE_SIG_KEY)
MODULE_SIG_CERT=certs/signing_key.x509
if [ "$MODULE_SIG_ALL" != "y" ]; then
Warning "Module signing is not enabled (CONFIG_MODULE_SIG_ALL=$MODULE_SIG_ALL)"
exit 0
fi
if [ -z "$MODULE_SIG_HASH" ] || [ "$MODULE_SIG_HASH" = undef ]; then
Warning "Module signing hash is not set (CONFIG_MODULE_SIG_HASH)"
exit 0
fi
if [ -z "$MODULE_SIG_KEY" ] || [ "$MODULE_SIG_KEY" = undef ]; then
Warning "Module signing key is not set (CONFIG_MODULE_SIG_KEY)"
exit 0
fi
sig_key=$koutput/$MODULE_SIG_KEY
if [ ! -f "$sig_key" ]; then
Warning "Signing key not found (CONFIG_MODULE_SIG_KEY=\"$MODULE_SIG_KEY\")"
exit 0
fi
sig_cert=$koutput/$MODULE_SIG_CERT
if [ ! -f "$sig_cert" ]; then
Warning "Signing cert not found (expected $MODULE_SIG_CERT)"
exit 0
fi
find "$RPM_BUILD_ROOT/lib/modules" -name '*.ko*' > .kmodules
num=$(wc -l < .kmodules)
if [ "$num" -eq 0 ]; then
Warning "No kernel modules found for singing."
exit 0
fi
# Verify that singing is working to avoid flooding with errors later.
cd "$koutput"
t=$(mktemp)
if ! scripts/sign-file "$MODULE_SIG_HASH" "$MODULE_SIG_KEY" "$MODULE_SIG_CERT" "$t"; then
Warning "Test signing failed (scripts/sign-file error)."
exit 0
fi
rm "$t"
cd "$RPM_BUILD_ROOT"
# Determine if we should uncompress.
read -r f < .kmodules
rezip=
if [ -z "${f#*.ko.[gx]z}" ]; then
rezip=${f##*.}
rezip=${rezip/gz/gzip}
fi
nproc="$(nproc)"
if [ -n "$rezip" ]; then
Info "Uncompress ($rezip) $num modules before signing."
xargs -P"$nproc" $rezip --decompress < .kmodules
fi
cd "$koutput"
Info "Signing $num modules in $RPM_BUILD_ROOT (hash $MODULE_SIG_HASH key $MODULE_SIG_KEY)"
sed 's/\.ko\.[xg]z$/.ko/' < "$RPM_BUILD_ROOT/.kmodules" \
| xargs -P"$nproc" -n1 scripts/sign-file "$MODULE_SIG_HASH" "$MODULE_SIG_KEY" "$MODULE_SIG_CERT"
cd "$RPM_BUILD_ROOT"
if [ -n "$rezip" ]; then
Info "Compress ($rezip) $num modules after signing."
sed 's/\.ko\.[xg]z$/.ko/' < .kmodules | xargs -P"$nproc" $rezip
fi
rm .kmodules