user/sven/linux.git/scripts/Makefile, branch v5.4.203

scripts: set proper OpenSSL include dir also for sign-file

2021-02-26T09:10:27Z

commit fe968c41ac4f4ec9ffe3c4cf16b72285f5e9674f upstream. Fixes: 2cea4a7a1885 ("scripts: use pkg-config to locate libcrypto") Signed-off-by: Rolf Eike Beer Cc: stable@vger.kernel.org # 5.6.x Signed-off-by: Masahiro Yamada Signed-off-by: Greg Kroah-Hartman

scripts: use pkg-config to locate libcrypto

2021-02-26T09:10:27Z

commit 2cea4a7a1885bd0c765089afc14f7ff0eb77864e upstream. Otherwise build fails if the headers are not in the default location. While at it also ask pkg-config for the libs, with fallback to the existing value. Signed-off-by: Rolf Eike Beer Cc: stable@vger.kernel.org # 5.6.x Signed-off-by: Masahiro Yamada Signed-off-by: Greg Kroah-Hartman

Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

2019-09-28T02:37:27Z

Pull integrity updates from Mimi Zohar: "The major feature in this time is IMA support for measuring and appraising appended file signatures. In addition are a couple of bug fixes and code cleanup to use struct_size(). In addition to the PE/COFF and IMA xattr signatures, the kexec kernel image may be signed with an appended signature, using the same scripts/sign-file tool that is used to sign kernel modules. Similarly, the initramfs may contain an appended signature. This contained a lot of refactoring of the existing appended signature verification code, so that IMA could retain the existing framework of calculating the file hash once, storing it in the IMA measurement list and extending the TPM, verifying the file's integrity based on a file hash or signature (eg. xattrs), and adding an audit record containing the file hash, all based on policy. (The IMA support for appended signatures patch set was posted and reviewed 11 times.) The support for appended signature paves the way for adding other signature verification methods, such as fs-verity, based on a single system-wide policy. The file hash used for verifying the signature and the signature, itself, can be included in the IMA measurement list" * 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: ima_api: Use struct_size() in kzalloc() ima: use struct_size() in kzalloc() sefltest/ima: support appended signatures (modsig) ima: Fix use after free in ima_read_modsig() MODSIGN: make new include file self contained ima: fix freeing ongoing ahash_request ima: always return negative code for error ima: Store the measurement again when appraising a modsig ima: Define ima-modsig template ima: Collect modsig ima: Implement support for module-style appended signatures ima: Factor xattr_verify() out of ima_appraise_measurement() ima: Add modsig appraise_type option for module-style appended signatures integrity: Select CONFIG_KEYS instead of depending on it PKCS#7: Introduce pkcs7_get_digest() PKCS#7: Refactor verify_pkcs7_signature() MODSIGN: Export module signature definitions ima: initialize the "template" field with the default template

kbuild: pkg: clean up package files/dirs from the top Makefile

2019-08-24T22:39:21Z

I am not a big fan of the $(objtree)/ hack for clean-files/clean-dirs. These are created in the top of $(objtree), so let's clean them up from the top Makefile. Signed-off-by: Masahiro Yamada

MODSIGN: Export module signature definitions

2019-08-05T22:39:56Z

IMA will use the module_signature format for append signatures, so export the relevant definitions and factor out the code which verifies that the appended signature trailer is valid. Also, create a CONFIG_MODULE_SIG_FORMAT option so that IMA can select it and be able to use mod_check_sig() without having to depend on either CONFIG_MODULE_SIG or CONFIG_MODULES. s390 duplicated the definition of struct module_signature so now they can use the new header instead. Signed-off-by: Thiago Jung Bauermann Acked-by: Jessica Yu Reviewed-by: Philipp Rudo Cc: Heiko Carstens Signed-off-by: Mimi Zohar

kbuild: remove build_unifdef target in scripts/Makefile

2019-06-15T10:57:01Z

Since commit 2aedcd098a94 ("kbuild: suppress annoying "... is up to date." message"), if_changed and friends nicely suppress "is up to date" messages. We do not need per-Makefile tricks. Signed-off-by: Masahiro Yamada

scripts/gdb: do not descend into scripts/gdb from scripts

2019-02-27T12:40:09Z

Currently, Kbuild descends from scripts/Makefile to scripts/gdb/Makefile just for creating symbolic links, but it does not need to do it so early. Merge the two descending paths to simplify the code. Signed-off-by: Masahiro Yamada Reviewed-by: Kieran Bingham

kbuild: descend into scripts/gcc-plugins/ via scripts/Makefile

2018-12-01T14:09:38Z

Now that 'archprepare' depends on 'scripts', Kbuild can descend into scripts/gcc-plugins in a more standard way. Signed-off-by: Masahiro Yamada Reviewed-by: Kees Cook

kbuild: move modpost out of 'scripts' target

2018-12-01T14:09:34Z

I am eagar to build under the scripts/ directory only with $(HOSTCC), but scripts/mod/ highly depends on the $(CC) and target arch headers. That it why the 'scripts' target must depend on 'asm-generic', 'gcc-plugins', and $(autoksyms_h). Move it to the 'prepare0' stage. I know this is a cheesy workaround, but better than the current situation. Signed-off-by: Masahiro Yamada

kbuild: consolidate Devicetree dtb build rules

2018-10-02T14:23:21Z

There is nothing arch specific about building dtb files other than their location under /arch/*/boot/dts/. Keeping each arch aligned is a pain. The dependencies and supported targets are all slightly different. Also, a cross-compiler for each arch is needed, but really the host compiler preprocessor is perfectly fine for building dtbs. Move the build rules to a common location and remove the arch specific ones. This is done in a single step to avoid warnings about overriding rules. The build dependencies had been a mixture of 'scripts' and/or 'prepare'. These pull in several dependencies some of which need a target compiler (specifically devicetable-offsets.h) and aren't needed to build dtbs. All that is really needed is dtc, so adjust the dependencies to only be dtc. This change enables support 'dtbs_install' on some arches which were missing the target. Acked-by: Will Deacon Acked-by: Paul Burton Acked-by: Ley Foon Tan Acked-by: Masahiro Yamada Cc: Michal Marek Cc: Vineet Gupta Cc: Russell King Cc: Catalin Marinas Cc: Yoshinori Sato Cc: Michal Simek Cc: Ralf Baechle Cc: James Hogan Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: Chris Zankel Cc: Max Filippov Cc: linux-kbuild@vger.kernel.org Cc: linux-snps-arc@lists.infradead.org Cc: linux-arm-kernel@lists.infradead.org Cc: uclinux-h8-devel@lists.sourceforge.jp Cc: linux-mips@linux-mips.org Cc: nios2-dev@lists.rocketboards.org Cc: linuxppc-dev@lists.ozlabs.org Cc: linux-xtensa@linux-xtensa.org Signed-off-by: Rob Herring