aboutsummaryrefslogtreecommitdiffstats
path: root/build/cache.mk
blob: a65f310d04961032817d15ace8571ab8633af2bc (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
##############################################################################
# Copyright (c) 2015 Ericsson AB and others.
# stefan.k.berg@ericsson.com
# jonas.bjurel@ericsson.com
# All rights reserved. This program and the accompanying materials
# are made available under the terms of the Apache License, Version 2.0
# which accompanies this distribution, and is available at
# http://www.apache.org/licenses/LICENSE-2.0
##############################################################################

#############################################################################
# Cache operations - only used when building through ci/build.sh
#
# This is the global cache implementation, providing the main target "cache"
# which is called from ci/build.sh, and recursively calling the cache
# operations clean-cache, get-cache and put-cache on all $(SUBDIRS).
#############################################################################


export CACHETOOL := $(BUILD_BASE)/cache.sh

# Call sub caches
SUBGETCACHE = $(addsuffix .getcache,$(SUBDIRS))
$(SUBGETCACHE): %.getcache:
	$(MAKE) -C $* -f Makefile get-cache

SUBPUTCACHE = $(addsuffix .putcache,$(SUBDIRS))
$(SUBPUTCACHE): %.putcache:
	$(MAKE) -C $* -f Makefile put-cache

SUBCLEANCACHE = $(addsuffix .cleancache,$(SUBDIRS))
$(SUBCLEANCACHE): %.cleancache:
	$(MAKE) -C $* -f Makefile clean-cache

# Overlay implementation:
#   - clean
#   - clean cache identities
#   - get caches
#   - build iso
#   - store caches
.PHONY: cached-all
cached-all: clean clean-cache $(SUBCLEANCACHE) get-cache $(SUBGETCACHE) iso put-cache $(SUBPUTCACHE)
	@echo "Cached build is complete"


# cache: The target for ci/build.sh
.PHONY: cache
cache:
	@if [ -z "${CACHEBASE}" ]; then \
		echo "CACHEBASE not set, are you really building through build.sh?"; \
		exit 1; \
	fi
	@docker version >/dev/null 2>&1 || (echo 'No Docker installation available'; exit 1)
	@make -C docker get-cache all
	docker/runcontext $(DOCKERIMG) $(MAKE) $(MAKEFLAGS) cached-all
e("Initialise system trusted keyring\n"); system_trusted_keyring = keyring_alloc(".system_keyring", KUIDT_INIT(0), KGIDT_INIT(0), current_cred(), ((KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW | KEY_USR_READ | KEY_USR_SEARCH), KEY_ALLOC_NOT_IN_QUOTA, NULL); if (IS_ERR(system_trusted_keyring)) panic("Can't allocate system trusted keyring\n"); set_bit(KEY_FLAG_TRUSTED_ONLY, &system_trusted_keyring->flags); return 0; } /* * Must be initialised before we try and load the keys into the keyring. */ device_initcall(system_trusted_keyring_init); /* * Load the compiled-in list of X.509 certificates. */ static __init int load_system_certificate_list(void) { key_ref_t key; const u8 *p, *end; size_t plen; pr_notice("Loading compiled-in X.509 certificates\n"); p = system_certificate_list; end = p + system_certificate_list_size; while (p < end) { /* Each cert begins with an ASN.1 SEQUENCE tag and must be more * than 256 bytes in size. */ if (end - p < 4) goto dodgy_cert; if (p[0] != 0x30 && p[1] != 0x82) goto dodgy_cert; plen = (p[2] << 8) | p[3]; plen += 4; if (plen > end - p) goto dodgy_cert; key = key_create_or_update(make_key_ref(system_trusted_keyring, 1), "asymmetric", NULL, p, plen, ((KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW | KEY_USR_READ), KEY_ALLOC_NOT_IN_QUOTA | KEY_ALLOC_TRUSTED); if (IS_ERR(key)) { pr_err("Problem loading in-kernel X.509 certificate (%ld)\n", PTR_ERR(key)); } else { set_bit(KEY_FLAG_BUILTIN, &key_ref_to_ptr(key)->flags); pr_notice("Loaded X.509 cert '%s'\n", key_ref_to_ptr(key)->description); key_ref_put(key); } p += plen; } return 0; dodgy_cert: pr_err("Problem parsing in-kernel X.509 certificate list\n"); return 0; } late_initcall(load_system_certificate_list); #ifdef CONFIG_SYSTEM_DATA_VERIFICATION /** * Verify a PKCS#7-based signature on system data. * @data: The data to be verified. * @len: Size of @data. * @raw_pkcs7: The PKCS#7 message that is the signature. * @pkcs7_len: The size of @raw_pkcs7. * @usage: The use to which the key is being put. */ int system_verify_data(const void *data, unsigned long len, const void *raw_pkcs7, size_t pkcs7_len, enum key_being_used_for usage) { struct pkcs7_message *pkcs7; bool trusted; int ret; pkcs7 = pkcs7_parse_message(raw_pkcs7, pkcs7_len); if (IS_ERR(pkcs7)) return PTR_ERR(pkcs7); /* The data should be detached - so we need to supply it. */ if (pkcs7_supply_detached_data(pkcs7, data, len) < 0) { pr_err("PKCS#7 signature with non-detached data\n"); ret = -EBADMSG; goto error; } ret = pkcs7_verify(pkcs7, usage); if (ret < 0) goto error; ret = pkcs7_validate_trust(pkcs7, system_trusted_keyring, &trusted); if (ret < 0) goto error; if (!trusted) { pr_err("PKCS#7 signature not signed with a trusted key\n"); ret = -ENOKEY; } error: pkcs7_free_message(pkcs7); pr_devel("<==%s() = %d\n", __func__, ret); return ret; } EXPORT_SYMBOL_GPL(system_verify_data); #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */