Messages in this thread | | | Subject | Re: linux-next: Tree for Apr 16 (IMA appraise causing build error) | From | Nayna <> | Date | Fri, 16 Apr 2021 16:25:25 -0400 |
| |
On 4/16/21 2:53 PM, Randy Dunlap wrote: > On 4/16/21 4:36 AM, Stephen Rothwell wrote: >> Hi all, >> >> Changes since 20210415: >> > I noticed this build error message (on an i386 build): > > ../certs/Makefile:52: *** Could not determine digest type to use from kernel config. Stop. > > and when I was checking on why it happened, I noticed that > # CONFIG_MODULES is not set > > and hence > ifndef CONFIG_MODULE_SIG_HASH > $(error Could not determine digest type to use from kernel config) > endif > > CONFIG_MODULE_SIG_HASH is not set/enabled/defined. > > However, the .config file does have > CONFIG_IMA_APPRAISE=y > # CONFIG_IMA_ARCH_POLICY is not set > # CONFIG_IMA_APPRAISE_BUILD_POLICY is not set > CONFIG_IMA_APPRAISE_BOOTPARAM=y > CONFIG_IMA_APPRAISE_MODSIG=y > > as well as > CONFIG_MODULE_SIG_FORMAT=y > > due to a "select" by IMA_APPRAISE_MODSIG. > (although I see that MODULE_SIG_FORMAT does not depend on MODULES) > > > Is there anything that you can do (or recommend) to prevent > the build error? > > > > BTW, it looks like this: > config IMA_APPRAISE_REQUIRE_MODULE_SIGS > bool "Appraise kernel modules signatures" > depends on IMA_APPRAISE_BUILD_POLICY > > could also depend on MODULES. > > > > Full i386 randconfig file is attached.
With the new patchset "ima: kernel build support for loading the kernel module signing key", there shouldn't be a difference when generating the config file between MODULE_SIG and IMA_APPRAISE_MODSIG. Both prompt for the hash algorithm.
Can you please explain how you generate randconfig? Do you use make xconfig?
Thanks & Regards,
- Nayna
| |