I'm currently attempting to follow Hardening Debian for the Desktop Using Grsecurity guide in order to install the 4.5.7 kernel with Grsecurity on my Kali Linux desktop.

I am following that list of instructions verbatim, except for the fact that I'm trying to use Grsecurity's test patch for the 4.5.7 kernel and I'm running Kali Linux instead of straight Debian.

Every time I attempt to compile the kernel, however, I get this error following the line "CC certs/system_keyring.o":

  CC      certs/system_keyring.o
make[2]: *** No rule to make target 'debian/certs/benh@debian.org.cert.pem', needed by 'certs/x509_certificate_list'.  Stop.
Makefile:951: recipe for target 'certs' failed
make[1]: *** [certs] Error 2
make[1]: Leaving directory '/home/jc/Downloads/linux-4.5.7'
debian/ruleset/targets/common.mk:295: recipe for target 'debian/stamp/build/kernel' failed
make: *** [debian/stamp/build/kernel] Error 2

I get this error, as I found out, for any kernel even if I apply no patches or modifications, so it has something to do with the tools I'm using to compile the kernel (apparently a system keychain of some sort). Can someone out there tell me how to fix my OS and compile my kernel?

P.S. Here is the output of cat /proc/version:

Linux version 4.6.0-kali1-amd64 (devel@kali.org) (gcc version 5.4.0 20160609 (Debian 5.4.0-4) ) #1 SMP Debian 4.6.2-2kali2 (2016-06-28)
  • 4
    Try commenting out the CONFIG_SYSTEM_TRUSTED_KEYS line from your .config ? – steve Jul 3 '16 at 20:41
  • I am confused you say “except for the fact that I'm trying to use Grsecurity's test patch“, and you say “even if I apply no patches". I can not work you what problem you are describing. Do you get the problem when following the instructions 100%, of is it only when applying the patch? – ctrl-alt-delor Jul 3 '16 at 20:56
  • Sorry for the confusion - I get the problem when compiling any kernel in any fashion. I am attempting to compile the kernel the same way as micah lee except for a few differences; but the problem exists whether or I not I try to include grsecurity. – John Doe Jul 3 '16 at 20:59
  • @Steve, will that affect my final build? I'd rather fix the real problem with my current setup than attempt to remove any essential keys from my new kernel. – John Doe Jul 3 '16 at 21:04

I ran into this several years ago on a Debian build. In the .config file you copied from /boot find and comment out the lines CONFIG_SYSTEM_TRUSTED_KEY and CONFIG_MODULE_SIG_KEY.

During the build you can use your own cert or just use a random one time cert.

Found the above in this thread.

  • 7
    For me (4.8) it was CONFIG_SYSTEM_TRUSTED_KEYS – Pierre Jan 15 '17 at 11:31
  • 3
    Oneliner for a 4.19 config - sed -ri '/CONFIG_SYSTEM_TRUSTED_KEYS/s/=.+/=""/g' .config – Adam Baxter Mar 4 '19 at 6:50
  • In the folder where the kernel source is, create a debian folder. Create a certs folder in it.
  • Create a file named debian-uefi-certs.pem in this folder and put in this file info from this page: enter link description here
  • By "create" do you mean "touch debian-uefi-certs.pem", or do you need to make a file with content? Any specific content? – llywrch May 20 '20 at 20:02
  • yep - touch debian-uefi-certs.pem – Stanislav Panayotov May 21 '20 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.