Quantcast
Channel: Active questions tagged kernel - Stack Overflow
Viewing all articles
Browse latest Browse all 6369

Kernel compile error - cannot stat 'signing_key.priv': No such file or directory

$
0
0

I'm compiling custom kernel. I modified kernel configuration CONFIG_MODULE_SIG and CONFIG_MODULE_SIG_ALL. And followed below's site to apply this changes.
https://wiki.centos.org/HowTos/Custom_Kernel
But, After I did build the kernel with the following command:

rpmbuild -bb --target=`uname -m` --with baseonly 
--without up --without debug --without debuginfo 
--without fips --without kabichk kernel.spec 2> build-err.log | tee build-out.log

I got an rpm making error, and I checked build.err.log. In the log file, the following message was logged.

+ cp signing_key.priv signing_key.priv.sign
cp: cannot stat 'signing_key.priv': No such file or directory
error: Bad exit status from /var/tmp/rpm-tmp.LFoiHB (%build)

So, I opened /var/tmp/rpm-tmp.LFoiHB file.

#!/bin/sh

  RPM_SOURCE_DIR="/home/lsware/rpmbuild/SOURCES"
  RPM_BUILD_DIR="/home/lsware/rpmbuild/BUILD"
  RPM_OPT_FLAGS="-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches   -m64 -mtune=generic"
  RPM_LD_FLAGS="-Wl,-z,relro "
  RPM_ARCH="x86_64"
  RPM_OS="linux"
  export RPM_SOURCE_DIR RPM_BUILD_DIR RPM_OPT_FLAGS RPM_LD_FLAGS RPM_ARCH RPM_OS
  RPM_DOC_DIR="/usr/share/doc"
  export RPM_DOC_DIR
  RPM_PACKAGE_NAME="kernel"
  RPM_PACKAGE_VERSION="3.10.0"
  RPM_PACKAGE_RELEASE="1062.9.1.el7.custom_kernel"
  export RPM_PACKAGE_NAME RPM_PACKAGE_VERSION RPM_PACKAGE_RELEASE
  LANG=C
  export LANG
  unset CDPATH DISPLAY ||:
  RPM_BUILD_ROOT="/home/lsware/rpmbuild/BUILDROOT/kernel-3.10.0-1062.9.1.el7.custom_kernel.x86_64"
  export RPM_BUILD_ROOT

  PKG_CONFIG_PATH="${PKG_CONFIG_PATH}:/usr/lib64/pkgconfig:/usr/share/pkgconfig"
  export PKG_CONFIG_PATH

  set -x
  umask 022
  cd "/home/lsware/rpmbuild/BUILD"
cd 'kernel-3.10.0-1062.9.1.el7'



cp_vmlinux()
{
  eu-strip --remove-comment -o "$2""$1"
}

BuildKernel() {
    MakeTarget=$1
    KernelImage=$2
    Flavour=$3
    InstallName=${4:-vmlinuz}

    # Pick the right config file for the kernel we're building
    Config=kernel-3.10.0-x86_64${Flavour:+-${Flavour}}.config
    DevelDir=/usr/src/kernels/3.10.0-1062.9.1.el7.custom_kernel.x86_64${Flavour:+.${Flavour}}

    # When the bootable image is just the ELF kernel, strip it.
    # We already copy the unstripped file into the debuginfo package.
    if [ "$KernelImage" = vmlinux ]; then
      CopyKernel=cp_vmlinux
    else
      CopyKernel=cp
    fi

    KernelVer=3.10.0-1062.9.1.el7.custom_kernel.x86_64${Flavour:+.${Flavour}}
    echo BUILDING A KERNEL FOR ${Flavour} x86_64...

    # make sure EXTRAVERSION says what we want it to say
    perl -p -i -e "s/^EXTRAVERSION.*/EXTRAVERSION = -1062.9.1.el7.custom_kernel.x86_64${Flavour:+.${Flavour}}/" Makefile

    # and now to start the build process

    make  -s mrproper

    cp /home/lsware/rpmbuild/SOURCES/x509.genkey .  # x509.genkey
    cp /home/lsware/rpmbuild/SOURCES/extra_certificates .   # extra_certificates
    cp /home/lsware/rpmbuild/SOURCES/centos-ldup.x509 . # rheldup3.x509
    cp /home/lsware/rpmbuild/SOURCES/centos-kpatch.x509 .   # rhelkpatch1.x509

    cp configs/$Config .config

    Arch=`head -1 .config | cut -b 3-`
    echo USING ARCH=$Arch


    make -s  ARCH=$Arch oldnoconfig >/dev/null
    make -s  ARCH=$Arch V=1  KCFLAGS="" WITH_GCOV="  0" $MakeTarget 

    if [ "$Flavour" != "kdump" ]; then
        make -s  ARCH=$Arch V=1  KCFLAGS="" WITH_GCOV="  0" modules  || exit 1
    fi

    # Start installing the results
    mkdir -p $RPM_BUILD_ROOT/boot
    install -m 644 .config $RPM_BUILD_ROOT/boot/config-$KernelVer
    install -m 644 System.map $RPM_BUILD_ROOT/boot/System.map-$KernelVer

    # We estimate the size of the initramfs because rpm needs to take this size
    # into consideration when performing disk space calculations. (See bz #530778)
    dd if=/dev/zero of=$RPM_BUILD_ROOT/boot/initramfs-$KernelVer.img bs=1M count=20

    if [ -f arch/$Arch/boot/zImage.stub ]; then
      cp arch/$Arch/boot/zImage.stub $RPM_BUILD_ROOT/boot/zImage.stub-$KernelVer || :
    fi
# EFI SecureBoot signing, x86_64-only

  if [ -x /usr/bin/pesign ] &&                          \
       [ "x86_64" == "x86_64" -o                \
         "x86_64" == "aarch64" ]; then              
    if [ "07" -ge "7" -a -f /usr/bin/rpm-sign ]; then       
      nss=$(mktemp -p $PWD -d)                      
      echo > ${nss}/pwfile                      
      certutil -N -d ${nss} -f ${nss}/pwfile                
      certutil -A -n "ca" -t "CT,C," -i /home/lsware/rpmbuild/SOURCES/centos-ca-secureboot.der -d ${nss}        
      certutil -A -n "signer" -t ",c," -i /home/lsware/rpmbuild/SOURCES/centossecureboot001.crt -d ${nss}       
      sattrs=$(mktemp -p $PWD --suffix=.der)                
      /usr/bin/pesign -i $KernelImage -E ${sattrs} --certdir ${nss} --force     
      rpm-sign --key "centossecureboot001" --rsadgstsign ${sattrs}          
      /usr/bin/pesign -R ${sattrs}.sig -I ${sattrs} -i $KernelImage         \
                 --certdir ${nss} -c signer -o $KernelImage.signed          
      rm -rf ${sattrs} ${sattrs}.sig ${nss}             
    elif [ -S /var/run/pesign/socket ]; then                
      /usr/bin/pesign-client -t "OpenSC Card (Fedora Signer)"       \
                        -c "/CN=Fedora Secure Boot Signer"      \
                        -i $KernelImage -o $KernelImage.signed  -s          
    else                                
      /usr/bin/pesign  -c "Red Hat Test Certificate"            \
                 -i $KernelImage -o $KernelImage.signed  -s                 
    fi                                  
  else                                  
    if [ -n "$KernelImage" -a -n "$KernelImage.signed" ]; then              
      mv $KernelImage $KernelImage.signed                           
    elif [ -n "$KernelImage" -a -n "" ]; then               
      touch                             
    fi                                  
  fi                                    
  if [ ! -s -o $KernelImage.signed ]; then                      
    if [ -e "$KernelImage.signed" ]; then                       
      rm -f $KernelImage.signed                         
    fi                                  
    exit 1                              
  fi ;
    mv $KernelImage.signed $KernelImage
    $CopyKernel $KernelImage $RPM_BUILD_ROOT/boot/$InstallName-$KernelVer
    chmod 755 $RPM_BUILD_ROOT/boot/$InstallName-$KernelVer

    # hmac sign the kernel for FIPS
    echo "Creating hmac file: $RPM_BUILD_ROOT/boot/.vmlinuz-$KernelVer.hmac"
    ls -l $RPM_BUILD_ROOT/boot/$InstallName-$KernelVer
    sha512hmac $RPM_BUILD_ROOT/boot/$InstallName-$KernelVer | sed -e "s,$RPM_BUILD_ROOT,,"> $RPM_BUILD_ROOT/boot/.vmlinuz-$KernelVer.hmac;

    mkdir -p $RPM_BUILD_ROOT/lib/modules/$KernelVer
    mkdir -p $RPM_BUILD_ROOT/lib/modules/$KernelVer/kernel
    if [ "$Flavour" != "kdump" ]; then
        # Override $(mod-fw) because we don't want it to install any firmware
        # we'll get it from the linux-firmware package and we don't want conflicts
        make -s   ARCH=$Arch INSTALL_MOD_PATH=$RPM_BUILD_ROOT modules_install KERNELRELEASE=$KernelVer mod-fw=
    fi
    make -s  ARCH=$Arch INSTALL_MOD_PATH=$RPM_BUILD_ROOT vdso_install KERNELRELEASE=$KernelVer
    if [ ! -s ldconfig-kernel.conf ]; then
      echo > ldconfig-kernel.conf "\
# Placeholder file, no vDSO hwcap entries used in this kernel."
    fi
    /usr/bin/install -D -m 444 ldconfig-kernel.conf $RPM_BUILD_ROOT/etc/ld.so.conf.d/kernel-$KernelVer.conf

    # And save the headers/makefiles etc for building modules against
    #
    # This all looks scary, but the end result is supposed to be:
    # * all arch relevant include/ files
    # * all Makefile/Kconfig files
    # * all script/ files

    rm -f $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
    rm -f $RPM_BUILD_ROOT/lib/modules/$KernelVer/source
    mkdir -p $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
    (cd $RPM_BUILD_ROOT/lib/modules/$KernelVer ; ln -s build source)
    # dirs for additional modules per module-init-tools, kbuild/modules.txt
    mkdir -p $RPM_BUILD_ROOT/lib/modules/$KernelVer/extra
    mkdir -p $RPM_BUILD_ROOT/lib/modules/$KernelVer/updates
    mkdir -p $RPM_BUILD_ROOT/lib/modules/$KernelVer/weak-updates
    # first copy everything
    cp --parents `find  -type f -name "Makefile*" -o -name "Kconfig*"` $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
    cp Module.symvers $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
    cp System.map $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
    if [ -s Module.markers ]; then
      cp Module.markers $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
    fi

    # create the kABI metadata for use in packaging
    # NOTENOTE: the name symvers is used by the rpm backend
    # NOTENOTE: to discover and run the /usr/lib/rpm/fileattrs/kabi.attr
    # NOTENOTE: script which dynamically adds exported kernel symbol
    # NOTENOTE: checksums to the rpm metadata provides list.
    # NOTENOTE: if you change the symvers name, update the backend too
    echo "**** GENERATING kernel ABI metadata ****"
    gzip -c9 < Module.symvers > $RPM_BUILD_ROOT/boot/symvers-$KernelVer.gz





    # then drop all but the needed Makefiles/Kconfig files
    rm -rf $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/Documentation
    rm -rf $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/scripts
    rm -rf $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/include
    cp .config $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
    cp -a scripts $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
    if [ -d arch/$Arch/scripts ]; then
      cp -a arch/$Arch/scripts $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/arch/$Arch || :
    fi
    if [ -f arch/$Arch/*lds ]; then
      cp -a arch/$Arch/*lds $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/arch/%Arch || :
    fi
    rm -f $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/scripts/*.o
    rm -f $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/scripts/*/*.o
    if [ -d arch/x86/include ]; then
      cp -a --parents arch/x86/include $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/
    fi
    cp -a include $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/include

    # copy objtool for kernel-devel (needed for building external modules)
    if grep -q CONFIG_STACK_VALIDATION=y .config; then
      mkdir -p $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/tools/objtool
      cp -a tools/objtool/objtool $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/tools/objtool
    fi

    # Make sure the Makefile and version.h have a matching timestamp so that
    # external modules can be built
    touch -r $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/Makefile $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/include/generated/uapi/linux/version.h
    touch -r $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/.config $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/include/generated/autoconf.h
    # Copy .config to include/config/auto.conf so "make prepare" is unnecessary.
    cp $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/.config $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/include/config/auto.conf


    find $RPM_BUILD_ROOT/lib/modules/$KernelVer -name "*.ko" -type f >modnames

    # mark modules executable so that strip-to-file can strip them
    xargs --no-run-if-empty chmod u+x < modnames

    # Generate a list of modules for block and networking.

    grep -F /drivers/ modnames | xargs --no-run-if-empty nm -upA |
    sed -n 's,^.*/\([^/]*\.ko\):  *U \(.*\)$,\1 \2,p'> drivers.undef

    collect_modules_list()
    {
      sed -r -n -e "s/^([^ ]+) \\.?($2)\$/\\1/p" drivers.undef |
      LC_ALL=C sort -u > $RPM_BUILD_ROOT/lib/modules/$KernelVer/modules.$1
      if [ ! -z "$3" ]; then
        sed -r -e "/^($3)\$/d" -i $RPM_BUILD_ROOT/lib/modules/$KernelVer/modules.$1
      fi
    }

    collect_modules_list networking 'register_netdev|ieee80211_register_hw|usbnet_probe|phy_driver_register|rt2x00(pci|usb)_probe|register_netdevice'
    collect_modules_list block 'ata_scsi_ioctl|scsi_add_host|scsi_add_host_with_dma|blk_alloc_queue|blk_init_queue|register_mtd_blktrans|scsi_esp_register|scsi_register_device_handler|blk_queue_physical_block_size''pktcdvd.ko|dm-mod.ko'
    collect_modules_list drm 'drm_open|drm_init'
    collect_modules_list modesetting 'drm_crtc_init'

    # detect missing or incorrect license tags
    rm -f modinfo
    while read i
    do
      echo -n "${i#$RPM_BUILD_ROOT/lib/modules/$KernelVer/} ">> modinfo
      /sbin/modinfo -l $i >> modinfo
    done < modnames

    grep -E -v 'GPL( v2)?$|Dual BSD/GPL$|Dual MPL/GPL$|GPL and additional rights$' modinfo && exit 1

    rm -f modinfo modnames

    # Save off the .tmp_versions/ directory.  We'll use it in the
    # __debug_install_post macro below to sign the right things
    # Also save the signing keys so we actually sign the modules with the
    # right key.
    cp -r .tmp_versions .tmp_versions.sign${Flavour:+.${Flavour}}
    cp signing_key.priv signing_key.priv.sign${Flavour:+.${Flavour}}
    cp signing_key.x509 signing_key.x509.sign${Flavour:+.${Flavour}}

    # remove files that will be auto generated by depmod at rpm -i time
    for i in alias alias.bin builtin.bin ccwmap dep dep.bin ieee1394map inputmap isapnpmap ofmap pcimap seriomap symbols symbols.bin usbmap softdep devname
    do
      rm -f $RPM_BUILD_ROOT/lib/modules/$KernelVer/modules.$i
    done

    # Move the devel headers out of the root file system
    mkdir -p $RPM_BUILD_ROOT/usr/src/kernels
    mv $RPM_BUILD_ROOT/lib/modules/$KernelVer/build $RPM_BUILD_ROOT/$DevelDir
    ln -sf $DevelDir $RPM_BUILD_ROOT/lib/modules/$KernelVer/build

    install -Dm644 /home/lsware/rpmbuild/SOURCES/modprobe-dccp-blacklist.conf $RPM_BUILD_ROOT/etc/modprobe.d/dccp-blacklist.conf

    # prune junk from kernel-devel
    find $RPM_BUILD_ROOT/usr/src/kernels -name ".*.cmd" -exec rm -f {} \;
}

###
# DO it...
###

# prepare directories
rm -rf $RPM_BUILD_ROOT
mkdir -p $RPM_BUILD_ROOT/boot
mkdir -p $RPM_BUILD_ROOT/usr/libexec

cd linux-3.10.0-1062.9.1.el7.custom_kernel.x86_64

BuildKernel bzImage arch/x86/boot/bzImage



# perf
make  -C tools/perf -s V=1 WERROR=0 NO_LIBUNWIND=1 HAVE_CPLUS_DEMANGLE=1 NO_GTK2=1 NO_STRLCPY=1 NO_PERF_READ_VDSO32=1 NO_PERF_READ_VDSOX32=1 prefix=/usr lib=lib64 all
make  -C tools/perf -s V=1 WERROR=0 NO_LIBUNWIND=1 HAVE_CPLUS_DEMANGLE=1 NO_GTK2=1 NO_STRLCPY=1 NO_PERF_READ_VDSO32=1 NO_PERF_READ_VDSOX32=1 prefix=/usr lib=lib64 man || false

# cpupower
# make sure version-gen.sh is executable.
chmod +x tools/power/cpupower/utils/version-gen.sh
make   -C tools/power/cpupower CPUFREQ_BENCH=false
    pushd tools/power/cpupower/debug/x86_64
    make  centrino-decode powernow-k8-decode
    popd
   pushd tools/power/x86/x86_energy_perf_policy/
   make
   popd
   pushd tools/power/x86/turbostat
   make
   popd
pushd tools
make tmon
popd

pushd tools/bpf/bpftool
make
popd


# In the modsign case, we do 3 things.  1) We check the "flavour" and hard
# code the value in the following invocations.  This is somewhat sub-optimal
# but we're doing this inside of an RPM macro and it isn't as easy as it
# could be because of that.  2) We restore the .tmp_versions/ directory from
# the one we saved off in BuildKernel above.  This is to make sure we're
# signing the modules we actually built/installed in that flavour.  3) We
# grab the arch and invoke 'make modules_sign' and the mod-extra-sign.sh
# commands to actually sign the modules.
#
# We have to do all of those things _after_ find-debuginfo runs, otherwise
# that will strip the signature off of the modules.
#
# Finally, pick a module at random and check that it's signed and fail the build
# if it isn't.


###
### Special hacks for debuginfo subpackages.
###

# This macro is used by %install, so we must redefine it before that.


#
# Disgusting hack alert! We need to ensure we sign modules *after* all
# invocations of strip occur, which is in __debug_install_post if
# find-debuginfo.sh runs, and __os_install_post if not.
#

###
### install
###

But, I couldn't found what I have to do to solve this problem. What should I do.?


Viewing all articles
Browse latest Browse all 6369

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>