38

In ubuntu 20.04 LTS; I was compiling the latest kernel 5.11.11 after adding a new system call, during the execution of make command I got this error:

make[1]: *** No rule to make target 'debian/canonical-certs.pem', needed by 'certs/x509_certificate_list'.  Stop.
make: *** [Makefile:1809: certs] Error 2

If someone can help I would really appreciate it, Thank you.

1
  • 1
    Did you modify the value of CONFIG_SYSTEM_TRUSTED_KEYS in configuration?
    – Kulfy
    Apr 6, 2021 at 12:33

3 Answers 3

60

In your kernel configuration file you will find this line:

CONFIG_SYSTEM_TRUSTED_KEYS="debian/canonical-certs.pem"

Change it to this:

CONFIG_SYSTEM_TRUSTED_KEYS=""

Depending on your source structure you might be able to do it via command line. Examples:

scripts/config --disable SYSTEM_TRUSTED_KEYS

or

scripts/config --set-str SYSTEM_TRUSTED_KEYS ""

EDIT: Another key has been added to the default Canonical kernel configuration since this answer was posted:

CONFIG_SYSTEM_REVOCATION_KEYS="debian/canonical-revoked-certs.pem"

So, it also needs to be dealt with for user kernel compiles to complete:

scripts/config --disable SYSTEM_REVOCATION_KEYS

See also git based mainline kernel compile notes.

10
  • Thankyou so much Apr 6, 2021 at 16:13
  • you can edit it through the menuconfig by running "make menuconfig"
    – yehudahs
    Jun 8, 2021 at 13:42
  • 1
    Do you mind explaining a bit why you need to do this, like why do you think the canonical cert was in there to begin with and why it's ok to just remove it?
    – Shanteva
    Aug 5, 2021 at 12:46
  • 1
    I mean why as in, .config explicitly says not to edit it, so why is that value set to begin with, and what would be the "proper" way of giving the build system what it wants with that value
    – Shanteva
    Aug 5, 2021 at 20:36
  • 1
    @DougSmythies maybe it is worth to add that the same steps are needed for CONFIG_SYSTEM_REVOCATION_KEYS. At least while compiling Kernel version 5.13. So scripts/config --disable CONFIG_SYSTEM_REVOCATION_KEYS
    – garlix
    Jan 14 at 16:07
8

Well, I just generated a self-signed x509 certificate with a common name as my name, put the key and certificate in the same file and pointed both lines to the file. Compiles perfectly and security should be intact. I assume it's used to sign kernel binary and you can whitelist your certificate in a secure boot to allow your kernel to boot.

openssl req -x509 -newkey rsa:4096 -keyout certs/mycert.pem -out certs/mycert.pem -nodes -days 3650
CONFIG_MODULE_SIG_KEY="certs/mycert.pem"
CONFIG_SYSTEM_TRUSTED_KEYRING=y
CONFIG_SYSTEM_TRUSTED_KEYS="certs/mycert.pem"
CONFIG_SYSTEM_EXTRA_CERTIFICATE=y
CONFIG_SYSTEM_EXTRA_CERTIFICATE_SIZE=4096
CONFIG_SECONDARY_TRUSTED_KEYRING=y
CONFIG_SYSTEM_BLACKLIST_KEYRING=y
CONFIG_SYSTEM_BLACKLIST_HASH_LIST=""
2
1

Just executed following two commands in after running "make menuconfig"

scripts/config --disable SYSTEM_TRUSTED_KEYS
scripts/config --disable SYSTEM_REVOCATION_KEYS

while "make" command is running, if any certificate related question arises, then simply hit Enter. That's it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.