I'm compiling custom kernel. I modified kernel configuration CONFIG_MODULE_SIG
and CONFIG_MODULE_SIG_ALL
. And followed below's site to apply this changes.
https://wiki.centos.org/HowTos/Custom_Kernel
But, After I did build the kernel with the following command:
rpmbuild -bb --target=`uname -m` --with baseonly
--without up --without debug --without debuginfo
--without fips --without kabichk kernel.spec 2> build-err.log | tee build-out.log
I got an rpm making error, and I checked build.err.log. In the log file, the following message was logged.
+ cp signing_key.priv signing_key.priv.sign
cp: cannot stat 'signing_key.priv': No such file or directory
error: Bad exit status from /var/tmp/rpm-tmp.LFoiHB (%build)
So, I opened /var/tmp/rpm-tmp.LFoiHB file.
#!/bin/sh
RPM_SOURCE_DIR="/home/lsware/rpmbuild/SOURCES"
RPM_BUILD_DIR="/home/lsware/rpmbuild/BUILD"
RPM_OPT_FLAGS="-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic"
RPM_LD_FLAGS="-Wl,-z,relro "
RPM_ARCH="x86_64"
RPM_OS="linux"
export RPM_SOURCE_DIR RPM_BUILD_DIR RPM_OPT_FLAGS RPM_LD_FLAGS RPM_ARCH RPM_OS
RPM_DOC_DIR="/usr/share/doc"
export RPM_DOC_DIR
RPM_PACKAGE_NAME="kernel"
RPM_PACKAGE_VERSION="3.10.0"
RPM_PACKAGE_RELEASE="1062.9.1.el7.custom_kernel"
export RPM_PACKAGE_NAME RPM_PACKAGE_VERSION RPM_PACKAGE_RELEASE
LANG=C
export LANG
unset CDPATH DISPLAY ||:
RPM_BUILD_ROOT="/home/lsware/rpmbuild/BUILDROOT/kernel-3.10.0-1062.9.1.el7.custom_kernel.x86_64"
export RPM_BUILD_ROOT
PKG_CONFIG_PATH="${PKG_CONFIG_PATH}:/usr/lib64/pkgconfig:/usr/share/pkgconfig"
export PKG_CONFIG_PATH
set -x
umask 022
cd "/home/lsware/rpmbuild/BUILD"
cd 'kernel-3.10.0-1062.9.1.el7'
cp_vmlinux()
{
eu-strip --remove-comment -o "$2""$1"
}
BuildKernel() {
MakeTarget=$1
KernelImage=$2
Flavour=$3
InstallName=${4:-vmlinuz}
# Pick the right config file for the kernel we're building
Config=kernel-3.10.0-x86_64${Flavour:+-${Flavour}}.config
DevelDir=/usr/src/kernels/3.10.0-1062.9.1.el7.custom_kernel.x86_64${Flavour:+.${Flavour}}
# When the bootable image is just the ELF kernel, strip it.
# We already copy the unstripped file into the debuginfo package.
if [ "$KernelImage" = vmlinux ]; then
CopyKernel=cp_vmlinux
else
CopyKernel=cp
fi
KernelVer=3.10.0-1062.9.1.el7.custom_kernel.x86_64${Flavour:+.${Flavour}}
echo BUILDING A KERNEL FOR ${Flavour} x86_64...
# make sure EXTRAVERSION says what we want it to say
perl -p -i -e "s/^EXTRAVERSION.*/EXTRAVERSION = -1062.9.1.el7.custom_kernel.x86_64${Flavour:+.${Flavour}}/" Makefile
# and now to start the build process
make -s mrproper
cp /home/lsware/rpmbuild/SOURCES/x509.genkey . # x509.genkey
cp /home/lsware/rpmbuild/SOURCES/extra_certificates . # extra_certificates
cp /home/lsware/rpmbuild/SOURCES/centos-ldup.x509 . # rheldup3.x509
cp /home/lsware/rpmbuild/SOURCES/centos-kpatch.x509 . # rhelkpatch1.x509
cp configs/$Config .config
Arch=`head -1 .config | cut -b 3-`
echo USING ARCH=$Arch
make -s ARCH=$Arch oldnoconfig >/dev/null
make -s ARCH=$Arch V=1 KCFLAGS="" WITH_GCOV=" 0" $MakeTarget
if [ "$Flavour" != "kdump" ]; then
make -s ARCH=$Arch V=1 KCFLAGS="" WITH_GCOV=" 0" modules || exit 1
fi
# Start installing the results
mkdir -p $RPM_BUILD_ROOT/boot
install -m 644 .config $RPM_BUILD_ROOT/boot/config-$KernelVer
install -m 644 System.map $RPM_BUILD_ROOT/boot/System.map-$KernelVer
# We estimate the size of the initramfs because rpm needs to take this size
# into consideration when performing disk space calculations. (See bz #530778)
dd if=/dev/zero of=$RPM_BUILD_ROOT/boot/initramfs-$KernelVer.img bs=1M count=20
if [ -f arch/$Arch/boot/zImage.stub ]; then
cp arch/$Arch/boot/zImage.stub $RPM_BUILD_ROOT/boot/zImage.stub-$KernelVer || :
fi
# EFI SecureBoot signing, x86_64-only
if [ -x /usr/bin/pesign ] && \
[ "x86_64" == "x86_64" -o \
"x86_64" == "aarch64" ]; then
if [ "07" -ge "7" -a -f /usr/bin/rpm-sign ]; then
nss=$(mktemp -p $PWD -d)
echo > ${nss}/pwfile
certutil -N -d ${nss} -f ${nss}/pwfile
certutil -A -n "ca" -t "CT,C," -i /home/lsware/rpmbuild/SOURCES/centos-ca-secureboot.der -d ${nss}
certutil -A -n "signer" -t ",c," -i /home/lsware/rpmbuild/SOURCES/centossecureboot001.crt -d ${nss}
sattrs=$(mktemp -p $PWD --suffix=.der)
/usr/bin/pesign -i $KernelImage -E ${sattrs} --certdir ${nss} --force
rpm-sign --key "centossecureboot001" --rsadgstsign ${sattrs}
/usr/bin/pesign -R ${sattrs}.sig -I ${sattrs} -i $KernelImage \
--certdir ${nss} -c signer -o $KernelImage.signed
rm -rf ${sattrs} ${sattrs}.sig ${nss}
elif [ -S /var/run/pesign/socket ]; then
/usr/bin/pesign-client -t "OpenSC Card (Fedora Signer)" \
-c "/CN=Fedora Secure Boot Signer" \
-i $KernelImage -o $KernelImage.signed -s
else
/usr/bin/pesign -c "Red Hat Test Certificate" \
-i $KernelImage -o $KernelImage.signed -s
fi
else
if [ -n "$KernelImage" -a -n "$KernelImage.signed" ]; then
mv $KernelImage $KernelImage.signed
elif [ -n "$KernelImage" -a -n "" ]; then
touch
fi
fi
if [ ! -s -o $KernelImage.signed ]; then
if [ -e "$KernelImage.signed" ]; then
rm -f $KernelImage.signed
fi
exit 1
fi ;
mv $KernelImage.signed $KernelImage
$CopyKernel $KernelImage $RPM_BUILD_ROOT/boot/$InstallName-$KernelVer
chmod 755 $RPM_BUILD_ROOT/boot/$InstallName-$KernelVer
# hmac sign the kernel for FIPS
echo "Creating hmac file: $RPM_BUILD_ROOT/boot/.vmlinuz-$KernelVer.hmac"
ls -l $RPM_BUILD_ROOT/boot/$InstallName-$KernelVer
sha512hmac $RPM_BUILD_ROOT/boot/$InstallName-$KernelVer | sed -e "s,$RPM_BUILD_ROOT,,"> $RPM_BUILD_ROOT/boot/.vmlinuz-$KernelVer.hmac;
mkdir -p $RPM_BUILD_ROOT/lib/modules/$KernelVer
mkdir -p $RPM_BUILD_ROOT/lib/modules/$KernelVer/kernel
if [ "$Flavour" != "kdump" ]; then
# Override $(mod-fw) because we don't want it to install any firmware
# we'll get it from the linux-firmware package and we don't want conflicts
make -s ARCH=$Arch INSTALL_MOD_PATH=$RPM_BUILD_ROOT modules_install KERNELRELEASE=$KernelVer mod-fw=
fi
make -s ARCH=$Arch INSTALL_MOD_PATH=$RPM_BUILD_ROOT vdso_install KERNELRELEASE=$KernelVer
if [ ! -s ldconfig-kernel.conf ]; then
echo > ldconfig-kernel.conf "\
# Placeholder file, no vDSO hwcap entries used in this kernel."
fi
/usr/bin/install -D -m 444 ldconfig-kernel.conf $RPM_BUILD_ROOT/etc/ld.so.conf.d/kernel-$KernelVer.conf
# And save the headers/makefiles etc for building modules against
#
# This all looks scary, but the end result is supposed to be:
# * all arch relevant include/ files
# * all Makefile/Kconfig files
# * all script/ files
rm -f $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
rm -f $RPM_BUILD_ROOT/lib/modules/$KernelVer/source
mkdir -p $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
(cd $RPM_BUILD_ROOT/lib/modules/$KernelVer ; ln -s build source)
# dirs for additional modules per module-init-tools, kbuild/modules.txt
mkdir -p $RPM_BUILD_ROOT/lib/modules/$KernelVer/extra
mkdir -p $RPM_BUILD_ROOT/lib/modules/$KernelVer/updates
mkdir -p $RPM_BUILD_ROOT/lib/modules/$KernelVer/weak-updates
# first copy everything
cp --parents `find -type f -name "Makefile*" -o -name "Kconfig*"` $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
cp Module.symvers $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
cp System.map $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
if [ -s Module.markers ]; then
cp Module.markers $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
fi
# create the kABI metadata for use in packaging
# NOTENOTE: the name symvers is used by the rpm backend
# NOTENOTE: to discover and run the /usr/lib/rpm/fileattrs/kabi.attr
# NOTENOTE: script which dynamically adds exported kernel symbol
# NOTENOTE: checksums to the rpm metadata provides list.
# NOTENOTE: if you change the symvers name, update the backend too
echo "**** GENERATING kernel ABI metadata ****"
gzip -c9 < Module.symvers > $RPM_BUILD_ROOT/boot/symvers-$KernelVer.gz
# then drop all but the needed Makefiles/Kconfig files
rm -rf $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/Documentation
rm -rf $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/scripts
rm -rf $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/include
cp .config $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
cp -a scripts $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
if [ -d arch/$Arch/scripts ]; then
cp -a arch/$Arch/scripts $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/arch/$Arch || :
fi
if [ -f arch/$Arch/*lds ]; then
cp -a arch/$Arch/*lds $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/arch/%Arch || :
fi
rm -f $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/scripts/*.o
rm -f $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/scripts/*/*.o
if [ -d arch/x86/include ]; then
cp -a --parents arch/x86/include $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/
fi
cp -a include $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/include
# copy objtool for kernel-devel (needed for building external modules)
if grep -q CONFIG_STACK_VALIDATION=y .config; then
mkdir -p $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/tools/objtool
cp -a tools/objtool/objtool $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/tools/objtool
fi
# Make sure the Makefile and version.h have a matching timestamp so that
# external modules can be built
touch -r $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/Makefile $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/include/generated/uapi/linux/version.h
touch -r $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/.config $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/include/generated/autoconf.h
# Copy .config to include/config/auto.conf so "make prepare" is unnecessary.
cp $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/.config $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/include/config/auto.conf
find $RPM_BUILD_ROOT/lib/modules/$KernelVer -name "*.ko" -type f >modnames
# mark modules executable so that strip-to-file can strip them
xargs --no-run-if-empty chmod u+x < modnames
# Generate a list of modules for block and networking.
grep -F /drivers/ modnames | xargs --no-run-if-empty nm -upA |
sed -n 's,^.*/\([^/]*\.ko\): *U \(.*\)$,\1 \2,p'> drivers.undef
collect_modules_list()
{
sed -r -n -e "s/^([^ ]+) \\.?($2)\$/\\1/p" drivers.undef |
LC_ALL=C sort -u > $RPM_BUILD_ROOT/lib/modules/$KernelVer/modules.$1
if [ ! -z "$3" ]; then
sed -r -e "/^($3)\$/d" -i $RPM_BUILD_ROOT/lib/modules/$KernelVer/modules.$1
fi
}
collect_modules_list networking 'register_netdev|ieee80211_register_hw|usbnet_probe|phy_driver_register|rt2x00(pci|usb)_probe|register_netdevice'
collect_modules_list block 'ata_scsi_ioctl|scsi_add_host|scsi_add_host_with_dma|blk_alloc_queue|blk_init_queue|register_mtd_blktrans|scsi_esp_register|scsi_register_device_handler|blk_queue_physical_block_size''pktcdvd.ko|dm-mod.ko'
collect_modules_list drm 'drm_open|drm_init'
collect_modules_list modesetting 'drm_crtc_init'
# detect missing or incorrect license tags
rm -f modinfo
while read i
do
echo -n "${i#$RPM_BUILD_ROOT/lib/modules/$KernelVer/} ">> modinfo
/sbin/modinfo -l $i >> modinfo
done < modnames
grep -E -v 'GPL( v2)?$|Dual BSD/GPL$|Dual MPL/GPL$|GPL and additional rights$' modinfo && exit 1
rm -f modinfo modnames
# Save off the .tmp_versions/ directory. We'll use it in the
# __debug_install_post macro below to sign the right things
# Also save the signing keys so we actually sign the modules with the
# right key.
cp -r .tmp_versions .tmp_versions.sign${Flavour:+.${Flavour}}
cp signing_key.priv signing_key.priv.sign${Flavour:+.${Flavour}}
cp signing_key.x509 signing_key.x509.sign${Flavour:+.${Flavour}}
# remove files that will be auto generated by depmod at rpm -i time
for i in alias alias.bin builtin.bin ccwmap dep dep.bin ieee1394map inputmap isapnpmap ofmap pcimap seriomap symbols symbols.bin usbmap softdep devname
do
rm -f $RPM_BUILD_ROOT/lib/modules/$KernelVer/modules.$i
done
# Move the devel headers out of the root file system
mkdir -p $RPM_BUILD_ROOT/usr/src/kernels
mv $RPM_BUILD_ROOT/lib/modules/$KernelVer/build $RPM_BUILD_ROOT/$DevelDir
ln -sf $DevelDir $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
install -Dm644 /home/lsware/rpmbuild/SOURCES/modprobe-dccp-blacklist.conf $RPM_BUILD_ROOT/etc/modprobe.d/dccp-blacklist.conf
# prune junk from kernel-devel
find $RPM_BUILD_ROOT/usr/src/kernels -name ".*.cmd" -exec rm -f {} \;
}
###
# DO it...
###
# prepare directories
rm -rf $RPM_BUILD_ROOT
mkdir -p $RPM_BUILD_ROOT/boot
mkdir -p $RPM_BUILD_ROOT/usr/libexec
cd linux-3.10.0-1062.9.1.el7.custom_kernel.x86_64
BuildKernel bzImage arch/x86/boot/bzImage
# perf
make -C tools/perf -s V=1 WERROR=0 NO_LIBUNWIND=1 HAVE_CPLUS_DEMANGLE=1 NO_GTK2=1 NO_STRLCPY=1 NO_PERF_READ_VDSO32=1 NO_PERF_READ_VDSOX32=1 prefix=/usr lib=lib64 all
make -C tools/perf -s V=1 WERROR=0 NO_LIBUNWIND=1 HAVE_CPLUS_DEMANGLE=1 NO_GTK2=1 NO_STRLCPY=1 NO_PERF_READ_VDSO32=1 NO_PERF_READ_VDSOX32=1 prefix=/usr lib=lib64 man || false
# cpupower
# make sure version-gen.sh is executable.
chmod +x tools/power/cpupower/utils/version-gen.sh
make -C tools/power/cpupower CPUFREQ_BENCH=false
pushd tools/power/cpupower/debug/x86_64
make centrino-decode powernow-k8-decode
popd
pushd tools/power/x86/x86_energy_perf_policy/
make
popd
pushd tools/power/x86/turbostat
make
popd
pushd tools
make tmon
popd
pushd tools/bpf/bpftool
make
popd
# In the modsign case, we do 3 things. 1) We check the "flavour" and hard
# code the value in the following invocations. This is somewhat sub-optimal
# but we're doing this inside of an RPM macro and it isn't as easy as it
# could be because of that. 2) We restore the .tmp_versions/ directory from
# the one we saved off in BuildKernel above. This is to make sure we're
# signing the modules we actually built/installed in that flavour. 3) We
# grab the arch and invoke 'make modules_sign' and the mod-extra-sign.sh
# commands to actually sign the modules.
#
# We have to do all of those things _after_ find-debuginfo runs, otherwise
# that will strip the signature off of the modules.
#
# Finally, pick a module at random and check that it's signed and fail the build
# if it isn't.
###
### Special hacks for debuginfo subpackages.
###
# This macro is used by %install, so we must redefine it before that.
#
# Disgusting hack alert! We need to ensure we sign modules *after* all
# invocations of strip occur, which is in __debug_install_post if
# find-debuginfo.sh runs, and __os_install_post if not.
#
###
### install
###
But, I couldn't found what I have to do to solve this problem. What should I do.?