Re: signing support for (in-tree and external) kernel modules

[Jan Kiszka <jan.kiszka@siemens.com>]

On 29.04.20 15:00, yuecelm@gmail.com wrote:
> In tree kernel modules gets signed with the CONFIG_MODULE_SIG_ALL kernel 
> option, but extra (resp. external) modules not. If you (resp. isar) not 
> provide an (external) signing key, the kernel build autogenerates a 
> private/public key pair. It would be nice if the isar build system 
> provide some support for signing kernel modules.
> 
> I see currently 2 use cases:
> 1) let the kernel build to autogenerate private/public key for kernel 
> module signing and kernel-module reuse the key for signing (evt. isar 
> deletes the private key after image generation)
> 2) provide an (external) private and public key for kernel module 
> signing and will be used in kernel and kernel-module recipes
> 

We likely want to go for path 2 because the first option prevents 
reproducibility. And that means we need to define a channel how to 
provide those keys both to the kernel build as well as the external 
module builds.

Did you happen to observe if kernel-headers will include at least the 
script/sign-file host tool when CONFIG_MODULE_SIG_FORMAT is enabled? 
That - together with the keys - would be needed in order to sign 
external modules already during their build.

Jan

-- 
Siemens AG, Corporate Technology, CT RDA IOT SES-DE
Corporate Competence Center Embedded Linux