9805 2016-06-21 09:49:45 +0000 Signing keys not available when signing out-of-tree kernel modules 2016-09-05 10:05:40 +0000 1 1 7 Build System, Metadata & Runtime OE-Core kernel 2.1 x86 x86_64 RESOLVED FIXED Medium normal 2.2 1 mattias.waldo jianxun.zhang sgw tom.zanussi --- --- Don't know oldest_to_newest 63173 0 mattias.waldo 2016-06-21 09:49:45 +0000 When a kernel module built out-of-tree is installed, the module signing fails silently because the signing keys are not available in $kerneldir at install time. The key files need to be explicitly copied in a linux-yocto_4.4.bbappend file for the signing to work (see below). To reproduce: * Add meta-skeleton layer to bblayers.conf. * Add 'IMAGE_INSTALL += " hello-mod"' to local.conf. * In any layer (e.g. meta-skeleton): - Add a hello-mod_0.1.bbappend file containing 'INHIBIT_PACKAGE_STRIP = "1"'. - Add a linux-yocto_4.4.bbappend file that includes a .cfg file with the following kernel configuration modifications: 'CONFIG_MODULE_SIG = "y"' 'CONFIG_MODULE_SIG_ALL = "y"' * Run "bitbake hello-mod". * Run "hexdump -C " on the newly created hello.ko file - there is no signing information at the end. * Check the log.do_install log file for hello-mod: it states "certs/signing_key.pem: No such file or directory". * Add the following lines to the linux-yocto_4.4.bbappend file: - do_shared_workdir_append() { cd ${B} mkdir $kerneldir/certs cp certs/signing_key.* $kerneldir/certs/ } * Rebuild hello-mod * Running hexdump again reveals the text "Module signature appended" at the end. 64934 1 jianxun.zhang 2016-08-05 18:21:41 +0000 Hi Mattias, I have't started troubleshooting this issue, just feel you are actually close to a final solution based on the workaround you provided. Do you think you can have a patch to OE mailing list? openembedded-core@lists.openembedded.org Let me know if it is not the case and we will work on it from here. Thanks lot! 65180 2 mattias.waldo 2016-08-15 06:24:43 +0000 (In reply to comment #1) > Hi Mattias, > I have't started troubleshooting this issue, just feel you are actually > close to a final solution based on the workaround you provided. > > Do you think you can have a patch to OE mailing list? > openembedded-core@lists.openembedded.org > > Let me know if it is not the case and we will work on it from here. > > Thanks lot! Hi! I've submitted a patch to the mailing list: https://patchwork.openembedded.org/patch/129137/ Regards, Mattias 65469 3 jianxun.zhang 2016-08-24 00:42:36 +0000 I haven't seen feedbacks in OE mailing list, so I pinged Bruce in mail for the status of your patch. 65797 4 mattias.waldo 2016-09-05 10:05:40 +0000 The patch was accepted and is now in the openembedded-core master branch.