Bug 12927

Summary: Cannot strip and sign kernel modules
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Ross Burton <ross.burton>
Component: kernelAssignee: Bougrine Anis <anis.bougrine10>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Medium CC: anis.bougrine10, anuj.mittal, ccasciato, jonathan.yong, mathieu.dubois-briand, randy.macleod, tim.orling, tom.zanussi
Version: 2.6   
Target Milestone: 6.99   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)

Description Ross Burton 2018-09-21 16:13:58 UTC 
Kernel documentation: https://www.kernel.org/doc/html/v4.15/admin-guide/module-signing.html

Currently in our build if CONFIG_MODULE_SIG is enabled the modules get signed as part of the build but are then stripped.  As kernel module signatures are based on the file contents, the signature is now invalid.

My initial reaction is that we need to add a new task after do_strip that will optionally sign the modules again.  Something like:

do_sign_modules() {
  if signing enabled
  for every module
    scripts/sign_file foo bar
}

I'm assuming that you can re-sign a module and the tool does the right thing by replacing the existing signature.

Bruce: as kernel overlord, do you have any comments?
Comment 1 Bruce Ashfield 2018-09-24 14:44:58 UTC 
That approach should work, and is very similar to what I was thinking. Manual signing is the way to go, since we don't want to mess with how things are stripped (or if they are stripped, etc).

We'd want a distro feature (or an existing security flag) to control this optional step (since poking at the .config for kernel options is prone to breakage).

I'm not sure how much flexibility is required in any initial attempts, letting the kernel generate the key itself is probably the best thing to do, and allow overrides later.

The question of course is then, what to do with the private key. Since SDK and other extensions to the kernel would also need it if signed loading is enforced. With an external key, that is easier, with the autogenerated one, it could be more of an issue.

Were you planning to work on this ? or was it headed in my direction ?
Comment 2 Ross Burton 2018-09-27 14:35:57 UTC 
There's some prior work in oe-core 4c47e5f171fa2603355e2f9183065ce8137a18c7 but that simply disables stripping for signed modules.  Very much a work around and not a solution.
Comment 3 jonathan.yong 2020-11-17 07:33:50 UTC 
Please also take into account compressed module support in stripping/signing.
Comment 4 Randy MacLeod 2023-10-24 14:24:43 UTC 
Bulk move from 4.99 or 0.00 to 5.99
Comment 5 Bougrine Anis 2026-08-12 13:11:04 UTC 
A patch has been submitted to fix this issue.
Thank you Ross Burton for reporting this issue.