Messages in this thread | | | Subject | Re: linux-next: Tree for Apr 16 (IMA appraise causing build error) | From | Randy Dunlap <> | Date | Fri, 16 Apr 2021 11:53:53 -0700 |
| |
On 4/16/21 4:36 AM, Stephen Rothwell wrote: > Hi all, > > Changes since 20210415: >
I noticed this build error message (on an i386 build):
../certs/Makefile:52: *** Could not determine digest type to use from kernel config. Stop.
and when I was checking on why it happened, I noticed that # CONFIG_MODULES is not set
and hence ifndef CONFIG_MODULE_SIG_HASH $(error Could not determine digest type to use from kernel config) endif
CONFIG_MODULE_SIG_HASH is not set/enabled/defined.
However, the .config file does have CONFIG_IMA_APPRAISE=y # CONFIG_IMA_ARCH_POLICY is not set # CONFIG_IMA_APPRAISE_BUILD_POLICY is not set CONFIG_IMA_APPRAISE_BOOTPARAM=y CONFIG_IMA_APPRAISE_MODSIG=y
as well as CONFIG_MODULE_SIG_FORMAT=y
due to a "select" by IMA_APPRAISE_MODSIG. (although I see that MODULE_SIG_FORMAT does not depend on MODULES)
Is there anything that you can do (or recommend) to prevent the build error?
BTW, it looks like this: config IMA_APPRAISE_REQUIRE_MODULE_SIGS bool "Appraise kernel modules signatures" depends on IMA_APPRAISE_BUILD_POLICY
could also depend on MODULES.
Full i386 randconfig file is attached.
thanks. -- ~Randy Reported-by: Randy Dunlap <rdunlap@infradead.org> [unhandled content-type:application/gzip] | |