2 # Makefile for the linux kernel signature checking certificates.
5 obj-
$(CONFIG_SYSTEM_TRUSTED_KEYRING
) += system_keyring.o system_certificates.o
7 ###############################################################################
9 # When a Kconfig string contains a filename, it is suitable for
10 # passing to shell commands. It is surrounded by double-quotes, and
11 # any double-quotes or backslashes within it are escaped by
14 # This is no use for dependencies or $(wildcard). We need to strip the
15 # surrounding quotes and the escaping from quotes and backslashes, and
16 # we *do* need to escape any spaces in the string. So, for example:
18 # Usage: $(eval $(call config_filename,FOO))
20 # Defines FOO_FILENAME based on the contents of the CONFIG_FOO option,
21 # transformed as described above to be suitable for use within the
24 # Also, if the filename is a relative filename and exists in the source
25 # tree but not the build tree, define FOO_SRCPREFIX as $(srctree)/ to
26 # be prefixed to *both* command invocation and dependencies.
28 # Note: We also print the filenames in the quiet_cmd_foo text, and
29 # perhaps ought to have a version specially escaped for that purpose.
30 # But it's only cosmetic, and $(patsubst "%",%,$(CONFIG_FOO)) is good
31 # enough. It'll strip the quotes in the common case where there's no
32 # space and it's a simple filename, and it'll retain the quotes when
33 # there's a space. There are some esoteric cases in which it'll print
34 # the wrong thing, but we don't really care. The actual dependencies
35 # and commands *do* get it right, with various combinations of single
36 # and double quotes, backslashes and spaces in the filenames.
38 ###############################################################################
40 quote
:= $(firstword " ")
43 space_escape
:= %%%SPACE
%%%
45 define config_filename
46 ifneq ($$(CONFIG_
$(1)),"")
47 $(1)_FILENAME
:= $$(subst \\,\
,$$(subst \
$$(quote
),$$(quote
),$$(subst $$(space_escape
),\
$$(space
),$$(patsubst "%",%,$$(subst $$(space
),$$(space_escape
),$$(CONFIG_
$(1)))))))
48 ifneq ($$(patsubst /%,%,$$(firstword $$($(1)_FILENAME
))),$$(firstword $$($(1)_FILENAME
)))
50 ifeq ($$(wildcard $$($(1)_FILENAME
)),)
51 ifneq ($$(wildcard $$(srctree
)/$$($(1)_FILENAME
)),)
52 $(1)_SRCPREFIX
:= $(srctree
)/
59 ###############################################################################
61 ifeq ($(CONFIG_SYSTEM_TRUSTED_KEYRING
),y
)
63 $(eval
$(call config_filename
,SYSTEM_TRUSTED_KEYS
))
65 # GCC doesn't include .incbin files in -MD generated dependencies (PR#66871)
66 $(obj
)/system_certificates.o
: $(obj
)/x509_certificate_list
68 # Cope with signing_key.x509 existing in $(srctree) not $(objtree)
69 AFLAGS_system_certificates.o
:= -I
$(srctree
)
71 quiet_cmd_extract_certs
= EXTRACT_CERTS
$(patsubst "%",%,$(2))
72 cmd_extract_certs
= scripts
/extract-cert
$(2) $@ ||
( rm $@
; exit
1)
74 targets
+= x509_certificate_list
75 $(obj
)/x509_certificate_list
: scripts
/extract-cert
$(SYSTEM_TRUSTED_KEYS_SRCPREFIX
)$(SYSTEM_TRUSTED_KEYS_FILENAME
) FORCE
76 $(call if_changed
,extract_certs
,$(SYSTEM_TRUSTED_KEYS_SRCPREFIX
)$(CONFIG_SYSTEM_TRUSTED_KEYS
))
79 clean-files
:= x509_certificate_list .x509.list
81 ifeq ($(CONFIG_MODULE_SIG
),y
)
82 ###############################################################################
84 # If module signing is requested, say by allyesconfig, but a key has not been
85 # supplied, then one will need to be generated to make sure the build does not
86 # fail and that the kernel may be used afterwards.
88 ###############################################################################
89 ifndef CONFIG_MODULE_SIG_HASH
90 $(error Could not determine digest type to use from kernel config
)
93 # We do it this way rather than having a boolean option for enabling an
94 # external private key, because 'make randconfig' might enable such a
95 # boolean option and we unfortunately can't make it depend on !RANDCONFIG.
96 ifeq ($(CONFIG_MODULE_SIG_KEY
),"certs/signing_key.pem")
97 $(obj
)/signing_key.pem
: $(obj
)/x509.genkey
99 @echo
"### Now generating an X.509 key pair to be used for signing modules."
101 @echo
"### If this takes a long time, you might wish to run rngd in the"
102 @echo
"### background to keep the supply of entropy topped up. It"
103 @echo
"### needs to be run as root, and uses a hardware random"
104 @echo
"### number generator if one is available."
106 openssl req
-new
-nodes
-utf8
-$(CONFIG_MODULE_SIG_HASH
) -days
36500 \
107 -batch
-x509
-config
$(obj
)/x509.genkey \
108 -outform PEM
-out
$(obj
)/signing_key.pem \
109 -keyout
$(obj
)/signing_key.pem
2>&1
111 @echo
"### Key pair generated."
115 @echo Generating X
.509 key generation config
117 @echo
>>$@
"default_bits = 4096"
118 @echo
>>$@
"distinguished_name = req_distinguished_name"
119 @echo
>>$@
"prompt = no"
120 @echo
>>$@
"string_mask = utf8only"
121 @echo
>>$@
"x509_extensions = myexts"
123 @echo
>>$@
"[ req_distinguished_name ]"
124 @echo
>>$@
"#O = Unspecified company"
125 @echo
>>$@
"CN = Build time autogenerated kernel key"
126 @echo
>>$@
"#emailAddress = unspecified.user@unspecified.company"
128 @echo
>>$@
"[ myexts ]"
129 @echo
>>$@
"basicConstraints=critical,CA:FALSE"
130 @echo
>>$@
"keyUsage=digitalSignature"
131 @echo
>>$@
"subjectKeyIdentifier=hash"
132 @echo
>>$@
"authorityKeyIdentifier=keyid"
135 $(eval
$(call config_filename
,MODULE_SIG_KEY
))
137 # If CONFIG_MODULE_SIG_KEY isn't a PKCS#11 URI, depend on it
138 ifeq ($(patsubst pkcs11
:%,%,$(firstword $(MODULE_SIG_KEY_FILENAME
))),$(firstword $(MODULE_SIG_KEY_FILENAME
)))
139 X509_DEP
:= $(MODULE_SIG_KEY_SRCPREFIX
)$(MODULE_SIG_KEY_FILENAME
)
142 # GCC PR#66871 again.
143 $(obj
)/system_certificates.o
: $(obj
)/signing_key.x509
145 $(obj
)/signing_key.x509
: scripts
/extract-cert
include/config
/module
/sig
/key.h
$(X509_DEP
)
146 $(call cmd
,extract_certs
,$(MODULE_SIG_KEY_SRCPREFIX
)$(CONFIG_MODULE_SIG_KEY
))