@@ -36,16 +36,9 @@ def runstrip(file, elftype, strip, extra_strip_sections=''):
os.chmod(file, newmode)
stripcmd = [strip]
- skip_strip = False
- # kernel module: use --strip-debug and --preserve-dates (required for
- # module signing to remain valid after stripping)
+ # kernel module
if elftype & 16:
- if is_kernel_module_signed(file):
- bb.debug(1, "Skip strip on signed module %s" % file)
- skip_strip = True
- else:
- stripcmd.extend(["--strip-debug", "--remove-section=.comment",
- "--remove-section=.note", "--preserve-dates"])
+ stripcmd.extend(["--strip-debug", "--remove-section=.comment", "--remove-section=.note"])
# .so and shared library
elif ".so" in file and elftype & 8:
stripcmd.extend(["--remove-section=.comment", "--remove-section=.note", "--strip-unneeded"])
@@ -59,8 +52,7 @@ def runstrip(file, elftype, strip, extra_strip_sections=''):
stripcmd.append(file)
bb.debug(1, "runstrip: %s" % stripcmd)
- if not skip_strip:
- output = subprocess.check_output(stripcmd, stderr=subprocess.STDOUT)
+ output = subprocess.check_output(stripcmd, stderr=subprocess.STDOUT)
if newmode:
os.chmod(file, origmode)
@@ -70,13 +62,6 @@ def is_kernel_module(path):
with open(path) as f:
return mmap.mmap(f.fileno(), 0, prot=mmap.PROT_READ).find(b"vermagic=") >= 0
-# Detect if .ko module is signed
-def is_kernel_module_signed(path):
- with open(path, "rb") as f:
- f.seek(-28, 2)
- module_tail = f.read()
- return "Module signature appended" in "".join(chr(c) for c in bytearray(module_tail))
-
# Return type (bits):
# 0 - not elf
# 1 - ELF
@@ -810,11 +795,6 @@ def splitdebuginfo(file, dvar, dv, d):
debugfile = dvar + dest
sources = []
- if file.endswith(".ko") and file.find("/lib/modules/") != -1:
- if oe.package.is_kernel_module_signed(file):
- bb.debug(1, "Skip strip on signed module %s" % file)
- return (file, sources)
-
# Split the file...
bb.utils.mkdirhier(os.path.dirname(debugfile))
#bb.note("Split %s -> %s" % (file, debugfile))
Fixes [YOCTO #12927] Now kernel modules are re-signed after package stripping process. Therefore, they can be stripped and splitted securely. Reported-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com> --- changes in v4: - Re-sign kernel modules after package stripping process - Remove package-stripping skip in package.py - Add MOD_INSTALL_PREFIX variable changes in v3: - Fixing rebase issue. changes in v2: - Use the conditional INSTALL_MOD_STRIP environment variable to avoid duplicating the oe_runmake call. - Use `scripts/config` script instead of grepping .config file. --- meta/lib/oe/package.py | 26 +++----------------------- 1 file changed, 3 insertions(+), 23 deletions(-)