I'm trying to build a signed .deb kernel package of
https://github.com/torvalds/linux/tree/v6.6. I've copied
certs/default_x509.genkey to certs/x509.genkey. The .config is the
one from Ubuntu 23.10's default kernel with all new options accepted
at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and
CONFIG_SYSTEM_REVOCATION_KEYS="".
This builds the kernel and modules, signs the modules, compresses the
modules and then attempts to sign the modules again. That fails,
because the .ko module files are now .ko.zst files and the file it's
trying to sign isn't there. Full failure is pasted below.
Unsetting CONFIG_MODULE_COMPRESS_ZSTD is a workaround (ie disable
module compression).
Is there a way to build a .deb of a signed kernel with compressed modules?
Thanks for any help,
Tom
INSTALL debian/linux-libc-dev/usr/include
SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko
SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or
directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko
SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or
directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko
SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko
make[6]: *** [scripts/Makefile.modinst:137:
debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko]
Error 1
make[6]: *** Waiting for unfinished jobs....
make[6]: *** [scripts/Makefile.modinst:137:
debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko]
Error 1
SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or
directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko
make[6]: *** [scripts/Makefile.modinst:137:
debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko]
Error 1
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or
directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko
make[6]: *** [scripts/Makefile.modinst:137:
debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko]
Error 1
At main.c:298:
- SSL error:FFFFFFFF80000002:system library::No such file or
directory: ../crypto/bio/bss_file.c:67
- SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko
make[6]: *** [scripts/Makefile.modinst:137:
debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko]
Error 1
make[5]: *** [Makefile:1821: modules_install] Error 2
make[4]: *** [Makefile:2036: run-command] Error 2
make[3]: *** [debian/rules:17: binary-arch] Error 2
dpkg-buildpackage: error: make -f debian/rules binary subprocess
returned exit status 2
make[2]: *** [scripts/Makefile.package:146: bindeb-pkg] Error 2
make[1]: *** [/home/tkcook/git/linux/v6.6/Makefile:1538: bindeb-pkg] Error 2
make: *** [Makefile:234: __sub-make] Error 2
On Fri, Dec 08, 2023 at 11:14:35AM +0000, Tom Cook wrote:
> I'm trying to build a signed .deb kernel package of
> https://github.com/torvalds/linux/tree/v6.6. I've copied
> certs/default_x509.genkey to certs/x509.genkey. The .config is the
> one from Ubuntu 23.10's default kernel with all new options accepted
> at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and
> CONFIG_SYSTEM_REVOCATION_KEYS="".
>
> This builds the kernel and modules, signs the modules, compresses the
> modules and then attempts to sign the modules again. That fails,
> because the .ko module files are now .ko.zst files and the file it's
> trying to sign isn't there. Full failure is pasted below.
>
> Unsetting CONFIG_MODULE_COMPRESS_ZSTD is a workaround (ie disable
> module compression).
>
Seriously? Unrelated option becomes a workaround?
> Is there a way to build a .deb of a signed kernel with compressed modules?
>
> Thanks for any help,
> Tom
>
> INSTALL debian/linux-libc-dev/usr/include
> SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko
> SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko
> At main.c:298:
> - SSL error:FFFFFFFF80000002:system library::No such file or
> directory: ../crypto/bio/bss_file.c:67
Above means that you don't have a valid certificate/keypair set in
CONFIG_MODULE_SIG_KEY. If you keep the option value on `certs/signing_key.pem`
(which is the default), the key should be automatically generated
(with your observation, only if `certs/x509.genkey` doesn't already exist).
After building the kernel with `make all`, you should check if the certificate
pointed in CONFIG_MODULE_SIG_KEY is present or not. If it isn't the case,
you have to generate the certificate yourself. For more information, see
Documentation/admin-guide/module.signing.rst in the kernel sources.
Thanks.
--
An old man doll... just what I always wanted! - Clara
On Fri, Dec 8, 2023 at 8:14 PM Tom Cook <[email protected]> wrote:
>
> I'm trying to build a signed .deb kernel package of
> https://github.com/torvalds/linux/tree/v6.6. I've copied
> certs/default_x509.genkey to certs/x509.genkey. The .config is the
> one from Ubuntu 23.10's default kernel with all new options accepted
> at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and
> CONFIG_SYSTEM_REVOCATION_KEYS="".
>
> This builds the kernel and modules, signs the modules, compresses the
> modules and then attempts to sign the modules again. That fails,
> because the .ko module files are now .ko.zst files and the file it's
> trying to sign isn't there. Full failure is pasted below.
Modules are signed before the compression.
Once you compress modules, you cannot re-sign them again unless
you decompress modules, sign them, and compress them again.
Now, the kernel can directly load compressed modules, so
perhaps allowing users to sign compressed modules might
be beneficial.
(that is, reverse the order of singing and compression)
I am not sure whether it is possible or not, though.
I added linux-modules ML.
>
> Unsetting CONFIG_MODULE_COMPRESS_ZSTD is a workaround (ie disable
> module compression).
>
> Is there a way to build a .deb of a signed kernel with compressed modules?
>
> Thanks for any help,
> Tom
>
> INSTALL debian/linux-libc-dev/usr/include
> SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko
> SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko
> At main.c:298:
> - SSL error:FFFFFFFF80000002:system library::No such file or
> directory: ../crypto/bio/bss_file.c:67
> - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
> sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko
> SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko
> At main.c:298:
> - SSL error:FFFFFFFF80000002:system library::No such file or
> directory: ../crypto/bio/bss_file.c:67
> - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
> sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko
> SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko
> make[6]: *** [scripts/Makefile.modinst:137:
> debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/amd/amd-uncore.ko]
> Error 1
> make[6]: *** Waiting for unfinished jobs....
> make[6]: *** [scripts/Makefile.modinst:137:
> debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/intel/intel-cstate.ko]
> Error 1
> SIGN debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko
> At main.c:298:
> - SSL error:FFFFFFFF80000002:system library::No such file or
> directory: ../crypto/bio/bss_file.c:67
> - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
> sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko
> make[6]: *** [scripts/Makefile.modinst:137:
> debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/events/rapl.ko]
> Error 1
> At main.c:298:
> - SSL error:FFFFFFFF80000002:system library::No such file or
> directory: ../crypto/bio/bss_file.c:67
> - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
> sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko
> make[6]: *** [scripts/Makefile.modinst:137:
> debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/cpu/mce/mce-inject.ko]
> Error 1
> At main.c:298:
> - SSL error:FFFFFFFF80000002:system library::No such file or
> directory: ../crypto/bio/bss_file.c:67
> - SSL error:10000080:BIO routines::no such file: ../crypto/bio/bss_file.c:75
> sign-file: debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko
> make[6]: *** [scripts/Makefile.modinst:137:
> debian/linux-image/lib/modules/6.6.0-local/kernel/arch/x86/kernel/msr.ko]
> Error 1
> make[5]: *** [Makefile:1821: modules_install] Error 2
> make[4]: *** [Makefile:2036: run-command] Error 2
> make[3]: *** [debian/rules:17: binary-arch] Error 2
> dpkg-buildpackage: error: make -f debian/rules binary subprocess
> returned exit status 2
> make[2]: *** [scripts/Makefile.package:146: bindeb-pkg] Error 2
> make[1]: *** [/home/tkcook/git/linux/v6.6/Makefile:1538: bindeb-pkg] Error 2
> make: *** [Makefile:234: __sub-make] Error 2
--
Best Regards
Masahiro Yamada
On Sat, Dec 9, 2023 at 6:18 PM Masahiro Yamada <[email protected]> wrote:
> On Fri, Dec 8, 2023 at 8:14 PM Tom Cook <[email protected]> wrote:
> >
> > I'm trying to build a signed .deb kernel package of
> > https://github.com/torvalds/linux/tree/v6.6. I've copied
> > certs/default_x509.genkey to certs/x509.genkey. The .config is the
> > one from Ubuntu 23.10's default kernel with all new options accepted
> > at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and
> > CONFIG_SYSTEM_REVOCATION_KEYS="".
> >
> > This builds the kernel and modules, signs the modules, compresses the
> > modules and then attempts to sign the modules again. That fails,
> > because the .ko module files are now .ko.zst files and the file it's
> > trying to sign isn't there. Full failure is pasted below.
>
>
>
> Modules are signed before the compression.
Reading back through my earlier email, I wasn't clear that when I said "This
builds the kernel..." I meant "`make deb-pkg` builds the kernel". I'm not
doing anything outlandish here, I think, just expecting the build system to
work.
Regards,
Tom
On Mon, Dec 11, 2023 at 7:19 PM Tom Cook <[email protected]> wrote:
>
> On Sat, Dec 9, 2023 at 6:18 PM Masahiro Yamada <[email protected]> wrote:
> > On Fri, Dec 8, 2023 at 8:14 PM Tom Cook <[email protected]> wrote:
> > >
> > > I'm trying to build a signed .deb kernel package of
> > > https://github.com/torvalds/linux/tree/v6.6. I've copied
> > > certs/default_x509.genkey to certs/x509.genkey. The .config is the
> > > one from Ubuntu 23.10's default kernel with all new options accepted
> > > at their default and CONFIG_SYSTEM_TRUSTED_KEYS="" and
> > > CONFIG_SYSTEM_REVOCATION_KEYS="".
> > >
> > > This builds the kernel and modules, signs the modules, compresses the
> > > modules and then attempts to sign the modules again. That fails,
> > > because the .ko module files are now .ko.zst files and the file it's
> > > trying to sign isn't there. Full failure is pasted below.
> >
> >
> >
> > Modules are signed before the compression.
>
> Reading back through my earlier email, I wasn't clear that when I said "This
> builds the kernel..." I meant "`make deb-pkg` builds the kernel". I'm not
> doing anything outlandish here, I think, just expecting the build system to
> work.
>
> Regards,
> Tom
OK, I understood.
The error is caused by the following lines
in scripts/package/builddeb:
# re-sign stripped modules
if is_enabled CONFIG_MODULE_SIG_ALL; then
${MAKE} -f ${srctree}/Makefile
INSTALL_MOD_PATH="${image_pdir}" modules_sign
fi
The error happens when all of the following three
are enabled.
- CONFIG_DEBUG_INFO
- CONFIG_MODULE_SIG_ALL
- CONFIG_MODULE_COMPRESS_*
If you disable one of them, you can do deb-pkg.
--
Best Regards
Masahiro Yamada