| Summary: | Signing keys not available when signing out-of-tree kernel modules | ||
|---|---|---|---|
| Product: | [Build System, Metadata & Runtime] OE-Core | Reporter: | Mattias Waldo <mattias.waldo> |
| Component: | kernel | Assignee: | Jianxun Zhang <jianxun.zhang> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | normal | ||
| Priority: | Medium | CC: | sgw, tom.zanussi |
| Version: | 2.1 | ||
| Target Milestone: | 2.2 | ||
| Hardware: | x86 | ||
| OS: | x86_64 | ||
| Whiteboard: | |||
| OS type for building Yocto: | --- | Type of Regression: | --- |
| Verified: | Documentation change: | Don't know | |
Hi Mattias, I have't started troubleshooting this issue, just feel you are actually close to a final solution based on the workaround you provided. Do you think you can have a patch to OE mailing list? openembedded-core@lists.openembedded.org Let me know if it is not the case and we will work on it from here. Thanks lot! (In reply to comment #1) > Hi Mattias, > I have't started troubleshooting this issue, just feel you are actually > close to a final solution based on the workaround you provided. > > Do you think you can have a patch to OE mailing list? > openembedded-core@lists.openembedded.org > > Let me know if it is not the case and we will work on it from here. > > Thanks lot! Hi! I've submitted a patch to the mailing list: https://patchwork.openembedded.org/patch/129137/ Regards, Mattias I haven't seen feedbacks in OE mailing list, so I pinged Bruce in mail for the status of your patch. The patch was accepted and is now in the openembedded-core master branch. |
When a kernel module built out-of-tree is installed, the module signing fails silently because the signing keys are not available in $kerneldir at install time. The key files need to be explicitly copied in a linux-yocto_4.4.bbappend file for the signing to work (see below). To reproduce: * Add meta-skeleton layer to bblayers.conf. * Add 'IMAGE_INSTALL += " hello-mod"' to local.conf. * In any layer (e.g. meta-skeleton): - Add a hello-mod_0.1.bbappend file containing 'INHIBIT_PACKAGE_STRIP = "1"'. - Add a linux-yocto_4.4.bbappend file that includes a .cfg file with the following kernel configuration modifications: 'CONFIG_MODULE_SIG = "y"' 'CONFIG_MODULE_SIG_ALL = "y"' * Run "bitbake hello-mod". * Run "hexdump -C " on the newly created hello.ko file - there is no signing information at the end. * Check the log.do_install log file for hello-mod: it states "certs/signing_key.pem: No such file or directory". * Add the following lines to the linux-yocto_4.4.bbappend file: - do_shared_workdir_append() { cd ${B} mkdir $kerneldir/certs cp certs/signing_key.* $kerneldir/certs/ } * Rebuild hello-mod * Running hexdump again reveals the text "Module signature appended" at the end.