45

I'm currently attempting to follow Hardening Debian for the Desktop Using Grsecurity guide in order to install the 4.5.7 kernel with Grsecurity on my Kali Linux desktop.

I am following that list of instructions verbatim, except for the fact that I'm trying to use Grsecurity's test patch for the 4.5.7 kernel and I'm running Kali Linux instead of straight Debian.

Every time I attempt to compile the kernel, however, I get this error following the line "CC certs/system_keyring.o":

  CC      certs/system_keyring.o
make[2]: *** No rule to make target 'debian/certs/[email protected]', needed by 'certs/x509_certificate_list'.  Stop.
Makefile:951: recipe for target 'certs' failed
make[1]: *** [certs] Error 2
make[1]: Leaving directory '/home/jc/Downloads/linux-4.5.7'
debian/ruleset/targets/common.mk:295: recipe for target 'debian/stamp/build/kernel' failed
make: *** [debian/stamp/build/kernel] Error 2

I get this error, as I found out, for any kernel even if I apply no patches or modifications, so it has something to do with the tools I'm using to compile the kernel (apparently a system keychain of some sort). Can someone out there tell me how to fix my OS and compile my kernel?

P.S. Here is the output of cat /proc/version:

Linux version 4.6.0-kali1-amd64 ([email protected]) (gcc version 5.4.0 20160609 (Debian 5.4.0-4) ) #1 SMP Debian 4.6.2-2kali2 (2016-06-28)
Improve this question
4
  • 4
    Try commenting out the CONFIG_SYSTEM_TRUSTED_KEYS line from your .config ?
    – steve
    Commented Jul 3, 2016 at 20:41
  • I am confused you say “except for the fact that I'm trying to use Grsecurity's test patch“, and you say “even if I apply no patches". I can not work you what problem you are describing. Do you get the problem when following the instructions 100%, of is it only when applying the patch?
    – ctrl-alt-delor
    Commented Jul 3, 2016 at 20:56
  • Sorry for the confusion - I get the problem when compiling any kernel in any fashion. I am attempting to compile the kernel the same way as micah lee except for a few differences; but the problem exists whether or I not I try to include grsecurity.
    – John Doe
    Commented Jul 3, 2016 at 20:59
  • @Steve, will that affect my final build? I'd rather fix the real problem with my current setup than attempt to remove any essential keys from my new kernel.
    – John Doe
    Commented Jul 3, 2016 at 21:04

6 Answers 6

Reset to default
60

I ran into this several years ago on a Debian build. In the .config file you copied from /boot find and comment out the lines CONFIG_SYSTEM_TRUSTED_KEY and CONFIG_MODULE_SIG_KEY.

During the build you can use your own cert or just use a random one time cert.

Found the above in this thread.

Improve this answer
4
  • 8
    For me (4.8) it was CONFIG_SYSTEM_TRUSTED_KEYS
    – Pierre
    Commented Jan 15, 2017 at 11:31
  • 8
    Oneliner for a 4.19 config - sed -ri '/CONFIG_SYSTEM_TRUSTED_KEYS/s/=.+/=""/g' .config
    – Adam
    Commented Mar 4, 2019 at 6:50
  • 3
    For me (5.13) I also had to CONFIG_SYSTEM_REVOCATION_KEYS=""
    – vmemmap
    Commented Dec 31, 2021 at 12:05
  • Just to clarify further, what worked for me was commenting out all the three parameters mentioned within the reply and the comments and hit Enter to all the prompts
    – Phoenix87
    Commented Jan 10, 2022 at 14:21
19

You can change your config file .config

CONFIG_SYSTEM_TRUSTED_KEYS="debian/canonical-certs.pem"

to

CONFIG_SYSTEM_TRUSTED_KEYS=""
Improve this answer
4
8

Ran into this, install the source package through the package manager and move the debian and debian.master folders into the linux source where the makefile is located

$ sudo apt search linux-source
# don't worry about it not saying 'generic'

$ sudo apt install linux-source-<version>
$ cd /usr/src/linux-source-<version>
$ sudo tar xf linux-source-<version>.tar.gz
$ sudo mv debian linux-source-<version>/debian
$ sudo mv debian.master linux-source-<version>/debian.master
Improve this answer
1
  • I did not need to extract an archive, and could just run cp -r /usr/src/linux-source-5.19.0/debian.master . and cp -r /usr/src/linux-source-5.19.0/debian .
    – Derkades
    Commented Jan 18, 2023 at 23:11
8
  • In the folder where the kernel source is, create a debian folder. Create a certs folder in it.
  • Create a file named debian-uefi-certs.pem with this content.
Improve this answer
5
  • By "create" do you mean "touch debian-uefi-certs.pem", or do you need to make a file with content? Any specific content?
    – llywrch
    Commented May 20, 2020 at 20:02
  • yep - touch debian-uefi-certs.pem
    – Stanislav Panayotov
    Commented May 21, 2020 at 13:27
  • 4
    This sounds potentially dangerous.
    – Infiltrator
    Commented Mar 20, 2021 at 11:51
  • 4
    Why should they use that particular contents for the file? The link does not seem to end up on an officially endorsed Debian site.
    – Kusalananda ♦
    Commented Mar 21, 2021 at 17:47
  • @Kusalananda The updated site now does.
    – Trect
    Commented Aug 8, 2021 at 15:45
0

For me, Centos 8, compile 4.19 kernel source. I disable these:

# CONFIG_TRUSTED_KEY
# CONFIG_SYSTEM_TRUSTED_KEYRING
# CONFIG_SYSTEM_TRUSTED_KEYS=""

Then I make. It will show some create new cert notice. Then you can continue compile.

Improve this answer
0

This happened to me when I was building a kernel on Rocky using make oldconfig

You get rhel.pem from the kernel source. On Rocky Linux you can download and unpack the kernel source with the following:

Note: the installs include what is needed to compile the kernel on Rocky minimal.

# RUN AS ROOT

dnf download --source kernel
rpm2cpio kernel-5.14.0-362.18.1.el9_3.src.rpm | cpio -idmv
tar -xf linux-5.14.0-362.18.1.el9_3.tar.xz

# Sets up the RPM build environment directories under ~/rpmbuild
rpmdev-setuptree

# Installs the source RPM package, which comes with the exact kernel build used to build this version of Rocky
rpm -ivh kernel-5.14.0-362.18.1.el9_3.src.rpm

After the rpm command runs the cert will be in /root/rpmbuild/BUILD/kernel-5.14.0-362.18.1.el9_3/linux-5.14.0-362.18.1.el9.x86_64/certs/rhel.pem

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .