CONFIG_MODULE_SIG breaks out-of-tree modules in modpost.

CONFIG_MODULE_SIG breaks out-of-tree modules in modpost.

[Valdis Kletnieks]

[-- Attachment #1: Type: text/plain, Size: 1427 bytes --]

For starters, yes, I *do* understand the security issues involved, and
no, I *don't* want to hear about NVidia evilness, because this looks like
a modpost problem not an NVidia problem.

I built next-20121011 with CONFIG_MODULE_SIG=y, and MODULE_SIG_FORCE=n,
so that I could test the feature, and just accept that the nvidia module was going
to hand me 2 taints instead of one.

But then, building the NVidia module a wondrous thing happened, and it threw a
most inexplicable error:

  cp /usr/src/valdis/NVIDIA-Linux-x86_64-304.51/kernel/nvidia.ko.unsigned /usr/src/valdis/NVIDIA-Linux-x86_64-304.51/kernel/nvidia.ko.stripped && strip -x -g /usr/src/valdis/NVIDIA-Linux-x86_64-304.51/kernel/nvidia.ko.stripped && /usr/bin/eu-strip /usr/src/valdis/NVIDIA-Linux-x86_64-304.51/kernel/nvidia.ko.stripped
/bin/sh: -c: line 0: syntax error near unexpected token `;'
/bin/sh: -c: line 0: `set -e;  ; echo 'cmd_/usr/src/valdis/NVIDIA-Linux-x86_64-304.51/kernel/nvidia.ko := ' > /usr/src/valdis/NVIDIA-Linux-x86_64-304.51/kernel/.nvidia.ko.cmd'

Looks like somebody left a $(FOO) unset between the 2 ';' characters.  I wasn't
able to follow the way scripts/Makefile.modpost worked well enough to figure out
where that line gets built, there's way too many 'set -e' in the scripts/ tree.

Building with MODULE_SIG=n made it build just fine.

This *MAY* be related to this RedHat bug: https://bugzilla.redhat.com/show_bug.cgi?id=655231


[-- Attachment #2: Type: application/pgp-signature, Size: 865 bytes --]

Re: CONFIG_MODULE_SIG breaks out-of-tree modules in modpost.

[David Howells]

Valdis Kletnieks <Valdis.Kletnieks@vt.edu> wrote:

> /bin/sh: -c: line 0: syntax error near unexpected token `;'
> /bin/sh: -c: line 0: `set -e;  ; echo 'cmd_/usr/src/valdis/NVIDIA-Linux-x86_64-304.51/kernel/nvidia.ko := ' > /usr/src/valdis/NVIDIA-Linux-x86_64-304.51/kernel/.nvidia.ko.cmd'

I would guess that this is from Kbuild.include's 'if_changed' macro:

	if_changed = $(if $(strip $(any-prereq) $(arg-check)),       \
		@set -e;                                             \
		$(echo-cmd) $(cmd_$(1));                             \
		echo 'cmd_$@ := $(make-cmd)' > $(dot-target).cmd)

unless nvidia.ko has its own build rules.

It looks like either $(call if_changed) got invoked with no arguments or
$(cmd_$(1)) didn't exist.

Could you find out what $(1) was by adding a bit:

	if_changed = $(if $(strip $(any-prereq) $(arg-check)),       \
		$(info XXXX $(1))				     \
		@set -e;                                             \
		$(echo-cmd) $(cmd_$(1));                             \
		echo 'cmd_$@ := $(make-cmd)' > $(dot-target).cmd)

You should see a line looking something like:

	XXX link_o_target

emitted by make just before it the error occurs.

David

Re: CONFIG_MODULE_SIG breaks out-of-tree modules in modpost.

[Wei Yongjun]

On 10/15/2012 08:19 PM, David Howells wrote:
> Valdis Kletnieks <Valdis.Kletnieks@vt.edu> wrote:
>
>> /bin/sh: -c: line 0: syntax error near unexpected token `;'
>> /bin/sh: -c: line 0: `set -e;  ; echo 'cmd_/usr/src/valdis/NVIDIA-Linux-x86_64-304.51/kernel/nvidia.ko := ' > /usr/src/valdis/NVIDIA-Linux-x86_64-304.51/kernel/.nvidia.ko.cmd'
> I would guess that this is from Kbuild.include's 'if_changed' macro:
>
> 	if_changed = $(if $(strip $(any-prereq) $(arg-check)),       \
> 		@set -e;                                             \
> 		$(echo-cmd) $(cmd_$(1));                             \
> 		echo 'cmd_$@ := $(make-cmd)' > $(dot-target).cmd)
>
> unless nvidia.ko has its own build rules.
>
> It looks like either $(call if_changed) got invoked with no arguments or
> $(cmd_$(1)) didn't exist.
>
> Could you find out what $(1) was by adding a bit:
>
> 	if_changed = $(if $(strip $(any-prereq) $(arg-check)),       \
> 		$(info XXXX $(1))				     \
> 		@set -e;                                             \
> 		$(echo-cmd) $(cmd_$(1));                             \
> 		echo 'cmd_$@ := $(make-cmd)' > $(dot-target).cmd)
>
> You should see a line looking something like:
>
> 	XXX link_o_target
>
> emitted by make just before it the error occurs.

I built linux.git tree and hit the same issue.

After change Kbuild.include, I see the $(1) is 'sign_ko_ko_stripped'.

$ grep -nr MODULE_SIG .config
276:CONFIG_MODULE_SIG=y
277:CONFIG_MODULE_SIG_FORCE=y
278:CONFIG_MODULE_SIG_SHA1=y
279:# CONFIG_MODULE_SIG_SHA224 is not set
280:# CONFIG_MODULE_SIG_SHA256 is not set
281:# CONFIG_MODULE_SIG_SHA384 is not set
282:# CONFIG_MODULE_SIG_SHA512 is not set

$ make M=net/sctp
  Building modules, stage 2.
  MODPOST 2 modules
XXXX sign_ko_stripped_ko_unsigned
  STRIP [M] net/sctp/sctp.ko.stripped
XXXX sign_ko_ko_stripped
/bin/sh: -c: line 0: syntax error near unexpected token `;'
/bin/sh: -c: line 0: `set -e;   ; echo 'cmd_net/sctp/sctp.ko := ' > net/sctp/.sctp.ko.cmd'
make[1]: *** [net/sctp/sctp.ko] Error 1
make: *** [modules] Error 2

Re: CONFIG_MODULE_SIG breaks out-of-tree modules in modpost.

[Stefan Knoblich]

I've had the same problem building dahdi-linux-2.6.1, attached
patch fixed it:

From: Stefan Knoblich <s.knoblich@axsentis.de>
Date: Tue, 16 Oct 2012 12:40:29 +0200
Subject: [PATCH] MODSIGN: Fix modpost for external modules with
 CONFIG_MODULE_SIG=y

Modpost with CONFIG_MODULE_SIG=y skips the signing step for external
modules by forcing SIGN_MODULES=0, breaking the build because
cmd_sign_ko_ko_stripped is undefined in that case:

  CC      /tmp/dahdi-linux-2.6.1/drivers/dahdi/../staging/echo/echo.mod.o
  LD [M]  /tmp/dahdi-linux-2.6.1/drivers/dahdi/../staging/echo/echo.ko.unsigned
  STRIP [M] /tmp/dahdi-linux-2.6.1/drivers/dahdi/../staging/echo/echo.ko.stripped
/bin/sh: -c: line 0: syntax error near unexpected token `;'
/bin/sh: -c: line 0: `set -e;  ; echo 'cmd_/tmp/dahdi-linux-2.6.1/drivers/dahdi/
../staging/echo/echo.ko := ' > /tmp/dahdi-linux-2.6.1/drivers/dahdi/
../staging/echo/.echo.ko.cmd'

Renaming the misnamed {quiet_,}cmd_sign_ko_ko_unsigned commands
fixes that error.

Signed-off-by: Stefan Knoblich <s.knoblich@axsentis.de>
---
 scripts/Makefile.modpost |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
index 0020891..85c0d10 100644
--- a/scripts/Makefile.modpost
+++ b/scripts/Makefile.modpost
@@ -188,8 +188,8 @@ quiet_cmd_sign_ko_ko_stripped = SIGN [M] $@
 		sh $(SCRIPTS_DIR)/sign-file $(MODSECKEY) $(MODPUBKEY) $< $@
 else
 KEYRING_DEP :=
-quiet_cmd_sign_ko_ko_unsigned = NO SIGN [M] $@
-      cmd_sign_ko_ko_unsigned = \
+quiet_cmd_sign_ko_ko_stripped = NO SIGN [M] $@
+      cmd_sign_ko_ko_stripped = \
 		cp $< $@
 endif
 
-- 
1.7.8.6