Re: signing support for (in-tree and external) kernel modules

["Mustafa Yücel" <yuecelm@gmail.com>]

[-- Attachment #1.1: Type: text/plain, Size: 2199 bytes --]

I checked again, sign-file is included in linux-headers package:

~myproject/out/build/tmp/deploy/isar-apt/apt/debian-buster/pool/main/l/linux-cip$ 
dpkg -c linux-headers-cip_4.19.113-cip23+r0_amd64.deb | grep sign-file
-rw-r--r-- root/root      7047 2020-04-29 16:56 
./usr/src/linux-headers-4.19.113-cip23/scripts/.sign-file.cmd
-rwxr-xr-x root/root     14624 2020-04-29 16:56 
./usr/src/linux-headers-4.19.113-cip23/scripts/sign-file
-rw-r--r-- root/root      9994 2020-03-28 01:06 
./usr/src/linux-headers-4.19.113-cip23/scripts/sign-file.c

from where you got CONFIG_MODULE_SIG_FORMAT? CONFIG_MODULE_SIG is the 
trigger to create this binary:

scripts/Makefile:hostprogs-$(CONFIG_MODULE_SIG) += sign-file

Musti

On Wednesday, April 29, 2020 at 5:35:15 PM UTC+2, Jan Kiszka wrote:
>
> On 29.04.20 15:00, yue...@gmail.com <javascript:> wrote: 
> > In tree kernel modules gets signed with the CONFIG_MODULE_SIG_ALL kernel 
> > option, but extra (resp. external) modules not. If you (resp. isar) not 
> > provide an (external) signing key, the kernel build autogenerates a 
> > private/public key pair. It would be nice if the isar build system 
> > provide some support for signing kernel modules. 
> > 
> > I see currently 2 use cases: 
> > 1) let the kernel build to autogenerate private/public key for kernel 
> > module signing and kernel-module reuse the key for signing (evt. isar 
> > deletes the private key after image generation) 
> > 2) provide an (external) private and public key for kernel module 
> > signing and will be used in kernel and kernel-module recipes 
> > 
>
> We likely want to go for path 2 because the first option prevents 
> reproducibility. And that means we need to define a channel how to 
> provide those keys both to the kernel build as well as the external 
> module builds. 
>
> Did you happen to observe if kernel-headers will include at least the 
> script/sign-file host tool when CONFIG_MODULE_SIG_FORMAT is enabled? 
> That - together with the keys - would be needed in order to sign 
> external modules already during their build. 
>
> Jan 
>
> -- 
> Siemens AG, Corporate Technology, CT RDA IOT SES-DE 
> Corporate Competence Center Embedded Linux 
>

[-- Attachment #1.2: Type: text/html, Size: 2846 bytes --]