archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 04:44:45 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
linux/include
History
Dimitri John Ledkov d50f210913
kbuild: align modinfo section for Secureboot Authenticode EDK2 compat 
Previously linker scripts would always generate vmlinuz that has sections
aligned. And thus padded (correct Authenticode calculation) and unpadded
calculation would be same. As in https://github.com/rhboot/pesign userspace
tool would produce the same authenticode digest for both of the following
commands:

    pesign --padding --hash --in ./arch/x86_64/boot/bzImage
    pesign --nopadding --hash --in ./arch/x86_64/boot/bzImage

The commit 3e86e4d74c ("kbuild: keep .modinfo section in
vmlinux.unstripped") added .modinfo section of variable length. Depending
on kernel configuration it may or may not be aligned.

All userspace signing tooling correctly pads such section to calculation
spec compliant authenticode digest.

However, if bzImage is not further processed and is attempted to be loaded
directly by EDK2 firmware, it calculates unpadded Authenticode digest and
fails to correct accept/reject such kernel builds even when propoer
Authenticode values are enrolled in db/dbx. One can say EDK2 requires
aligned/padded kernels in Secureboot.

Thus add ALIGN(8) to the .modinfo section, to esure kernels irrespective of
modinfo contents can be loaded by all existing EDK2 firmware builds.

Fixes: 3e86e4d74c ("kbuild: keep .modinfo section in vmlinux.unstripped")
Cc: stable@vger.kernel.org
Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@surgut.co.uk>
Link: https://patch.msgid.link/20251026202100.679989-1-dimitri.ledkov@surgut.co.uk
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2025-10-27 16:21:24 -07:00
..
acpi More power management updates for 6.18-rc1 2025-10-07 09:39:51 -07:00
asm-generic kbuild: align modinfo section for Secureboot Authenticode EDK2 compat 2025-10-27 16:21:24 -07:00
clocksource clocksource/drivers/arm_arch_timer_mmio: Switch over to standalone driver 2025-09-23 12:31:50 +02:00
crypto This update includes the following changes: 2025-10-04 14:59:29 -07:00
cxl
drm drm/gpuvm: Fix kernel-doc warning for drm_gpuvm_map_req.map 2025-10-15 18:37:05 +02:00
dt-bindings There's a bunch of patches here across drivers/clk/ to migrate drivers to use 2025-10-07 09:28:37 -07:00
hyperv hyperv: Remove the spurious null directive line 2025-10-02 21:21:24 +00:00
keys KEYS: trusted_tpm1: Move private functionality out of public header 2025-09-27 21:05:06 +03:00
kunit linux_kselftest-kunit-6.18-rc1 2025-10-01 19:15:11 -07:00
kvm KVM: arm64: Kill leftovers of ad-hoc timer userspace access 2025-10-13 14:42:41 +01:00
linux hid-for-linus-2025101701 2025-10-18 08:18:18 -10:00
math-emu
media
memory
misc
net net/ip6_tunnel: Prevent perpetual tunnel growth 2025-10-13 17:43:46 -07:00
pcmcia
ras
rdma
rv kernel-6.18-rc1.clone3 2025-09-29 10:36:50 -07:00
scsi SCSI misc on 20251002 2025-10-03 19:17:48 -07:00
soc There's a bunch of patches here across drivers/clk/ to migrate drivers to use 2025-10-07 09:28:37 -07:00
sound ASoC: tas2781: Support more newly-released amplifiers tas58xx in the driver 2025-10-13 11:08:09 +01:00
target
trace dma-mapping fixes for Linux 6.18: 2025-10-07 12:48:06 -07:00
uapi ARM: 2025-10-18 07:07:14 -10:00
ufs scsi: ufs: core: Include UTP error in INT_FATAL_ERRORS 2025-09-30 16:10:29 -04:00
vdso Updates for the VDSO subsystem: 2025-09-30 16:58:21 -07:00
video
xen
Kbuild