MODSIGN: Add option to not sign modules during modules_install
To allow the builder to sign only a subset of modules, or to sign the modules using a key that is not available on the build machine, add CONFIG_MODULE_SIG_ALL. If this option is unset, no modules will be signed during build. The default is 'y', to preserve the current behavior. Signed-off-by: Michal Marek <mmarek@suse.cz> Acked-by: David Howells <dhowells@redhat.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is contained in:
parent
1c37c054a7
commit
d9d8d7ed49
2
Makefile
2
Makefile
|
@ -719,7 +719,7 @@ endif # INSTALL_MOD_STRIP
|
||||||
export mod_strip_cmd
|
export mod_strip_cmd
|
||||||
|
|
||||||
|
|
||||||
ifeq ($(CONFIG_MODULE_SIG),y)
|
ifdef CONFIG_MODULE_SIG_ALL
|
||||||
MODSECKEY = ./signing_key.priv
|
MODSECKEY = ./signing_key.priv
|
||||||
MODPUBKEY = ./signing_key.x509
|
MODPUBKEY = ./signing_key.x509
|
||||||
export MODPUBKEY
|
export MODPUBKEY
|
||||||
|
|
11
init/Kconfig
11
init/Kconfig
|
@ -1665,6 +1665,17 @@ config MODULE_SIG_FORCE
|
||||||
Reject unsigned modules or signed modules for which we don't have a
|
Reject unsigned modules or signed modules for which we don't have a
|
||||||
key. Without this, such modules will simply taint the kernel.
|
key. Without this, such modules will simply taint the kernel.
|
||||||
|
|
||||||
|
config MODULE_SIG_ALL
|
||||||
|
bool "Automatically sign all modules"
|
||||||
|
default y
|
||||||
|
depends on MODULE_SIG
|
||||||
|
help
|
||||||
|
Sign all modules during make modules_install. Without this option,
|
||||||
|
modules must be signed manually, using the scripts/sign-file tool.
|
||||||
|
|
||||||
|
comment "Do not forget to sign required modules with scripts/sign-file"
|
||||||
|
depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL
|
||||||
|
|
||||||
choice
|
choice
|
||||||
prompt "Which hash algorithm should modules be signed with?"
|
prompt "Which hash algorithm should modules be signed with?"
|
||||||
depends on MODULE_SIG
|
depends on MODULE_SIG
|
||||||
|
|
Loading…
Reference in New Issue
Block a user