Skip to contentSkip to conversation

kbuild: enable use of password-protected signing keys

PATCH In review Emily Maier 2 participants 2 messages Feb 13, 2014 – Mar 14, 2014

Subsystems (2)
Documentation Kbuild
lore
Share & tools
lore

Emily Maier

author
#0 lore raw

PATCH v2 1/1 kbuild: enable use of password-protected signing keys

Currently, the module signing script assumes that the private key is not password-protected. This patch makes it somewhat more secure by checking of a password file ("signing_key.pass") exists and passing it to OpenSSL if so.

Version 2 changes: removed command line password passing from the Makefile, the password file is now autodetected by the Perl signing script.

Signed-off-by Emily Maier <[email protected]>
---
 Documentation/dontdiff                          |    1 +
 Documentation/module-signing.txt                |    3 +++
 scripts/sign-file                               |   13 ++++++++++---
 5 files changed, 15 insertions(+), 4 deletions(-)
Documentation/dontdiff +1 -0
diff -uprN -X linux-3.13.2-devel/Documentation/dontdiff linux-3.13.2/Documentation/dontdiff linux-3.13.2-devel/Documentation/dontdiff
@@ -214,6 +214,7 @@ setup
 setup.bin
 setup.elf
 sImage
+signing_key.*
 sm_tbl*
 split-include
 syscalltab.h
Documentation/module-signing.txt +3 -0
diff -uprN -X linux-3.13.2-devel/Documentation/dontdiff linux-3.13.2/Documentation/module-signing.txt linux-3.13.2-devel/Documentation/module-signing.txt
@@ -137,6 +137,9 @@ generate the public/private key files:
 	   -config x509.genkey -outform DER -out signing_key.x509 \
 	   -keyout signing_key.priv
 
+If you want to use a signing key with a password, write it to a file called
+"signing_key.pass". For security, make sure it is owned by root with 600
+permissions.
 
 =========================
 PUBLIC KEYS IN THE KERNEL
scripts/sign-file +10 -3
diff -uprN -X linux-3.13.2-devel/Documentation/dontdiff linux-3.13.2/scripts/sign-file linux-3.13.2-devel/scripts/sign-file
@@ -365,9 +365,16 @@ if ($signature_file) {
 	# comprises the signature with no metadata attached.
 	#
 	my $pid;
-	$pid = open2(*read_from, *write_to,
-		     "openssl rsautl -sign -inkey $private_key -keyform PEM") ||
-	    die "openssl rsautl";
+	my $passfile = "signing_key.pass";
+	if (-e $passfile) {
+		$pid = open2(*read_from, *write_to,
+		             "openssl rsautl -sign -inkey $private_key -keyform PEM \\
+		              -passin file:$passfile") || die "openssl rsautl";
+	} else {
+		$pid = open2(*read_from, *write_to,
+			     "openssl rsautl -sign -inkey $private_key -keyform PEM") ||
+		    die "openssl rsautl";
+	}
 	binmode write_to;
 	print write_to $prologue . $digest || die "pipe to openssl rsautl";
 	close(write_to) || die "pipe to openssl rsautl";
#1 lore raw
Quoted 4 lines · Emily Maier

Currently, the module signing script assumes that the private key is not password-protected. This patch makes it somewhat more secure by checking of a password file ("signing_key.pass") exists and passing it to OpenSSL if so.

I doubt that this makes the key any more secure.

Michal