From 227536740e5cb157fb9fa9b381178c7d34b95d3b Mon Sep 17 00:00:00 2001 From: Michal Marek Date: Fri, 25 Jan 2013 13:41:00 +1030 Subject: MODSIGN: Simplify Makefile with a Kconfig helper Signed-off-by: Michal Marek Acked-by: David Howells Signed-off-by: Rusty Russell --- init/Kconfig | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'init') diff --git a/init/Kconfig b/init/Kconfig index be8b7f55312d..fff4cb1321c5 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1697,6 +1697,15 @@ config MODULE_SIG_SHA512 endchoice +config MODULE_SIG_HASH + string + depends on MODULE_SIG + default "sha1" if MODULE_SIG_SHA1 + default "sha224" if MODULE_SIG_SHA224 + default "sha256" if MODULE_SIG_SHA256 + default "sha384" if MODULE_SIG_SHA384 + default "sha512" if MODULE_SIG_SHA512 + endif # MODULES config INIT_ALL_POSSIBLE -- cgit v1.2.3-58-ga151 From d9d8d7ed498ec65bea72dd24be7b9cd35af0c200 Mon Sep 17 00:00:00 2001 From: Michal Marek Date: Fri, 25 Jan 2013 13:41:31 +1030 Subject: MODSIGN: Add option to not sign modules during modules_install To allow the builder to sign only a subset of modules, or to sign the modules using a key that is not available on the build machine, add CONFIG_MODULE_SIG_ALL. If this option is unset, no modules will be signed during build. The default is 'y', to preserve the current behavior. Signed-off-by: Michal Marek Acked-by: David Howells Signed-off-by: Rusty Russell --- Makefile | 2 +- init/Kconfig | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) (limited to 'init') diff --git a/Makefile b/Makefile index 77ea707d8543..8e9f9efc5b39 100644 --- a/Makefile +++ b/Makefile @@ -719,7 +719,7 @@ endif # INSTALL_MOD_STRIP export mod_strip_cmd -ifeq ($(CONFIG_MODULE_SIG),y) +ifdef CONFIG_MODULE_SIG_ALL MODSECKEY = ./signing_key.priv MODPUBKEY = ./signing_key.x509 export MODPUBKEY diff --git a/init/Kconfig b/init/Kconfig index fff4cb1321c5..88f334fb403b 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1665,6 +1665,17 @@ config MODULE_SIG_FORCE Reject unsigned modules or signed modules for which we don't have a key. Without this, such modules will simply taint the kernel. +config MODULE_SIG_ALL + bool "Automatically sign all modules" + default y + depends on MODULE_SIG + help + Sign all modules during make modules_install. Without this option, + modules must be signed manually, using the scripts/sign-file tool. + +comment "Do not forget to sign required modules with scripts/sign-file" + depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL + choice prompt "Which hash algorithm should modules be signed with?" depends on MODULE_SIG -- cgit v1.2.3-58-ga151