docs-archive/sysadmin-guide
Archived
21
1
Fork 3
Code Issues 26 Pull requests 2 Activity

Merge #41 Removed references to perl from module signing section

Browse source
This commit is contained in:
Petr Bokoc 2021-01-26 10:08:13 +00:00
commit aa56e257eb
1 changed files with 4 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

9
modules/system-administrators-guide/pages/kernel-module-driver-configuration/Working_with_Kernel_Modules.adoc
View file

@ -399,8 +399,7 @@ In order to enable signing of externally built modules, the tools listed in the
|===
|Tool|Provided by Package|Used on|Purpose
|[command]#openssl#|[package]*openssl*|Build system|Generates public and private X.509 key pair
|[command]#sign-file#|[package]*kernel-devel*|Build system|Perl script used to sign kernel modules
|[command]#perl#|[package]*perl*|Build system|Perl interpreter used to run the signing script
|[command]#sign-file#|[package]*kernel-devel*|Build system|C application used to sign kernel modules
|[command]#mokutil#|[package]*mokutil*|Target system|Optional tool used to manually enroll the public key
|[command]#keyctl#|[package]*keyutils*|Target system|Optional tool used to display public keys in the system key ring
|===
@ -617,18 +616,18 @@ There are no extra steps required to prepare your kernel module for signing. You
~]#{nbsp}make -C /usr/src/kernels/$(uname -r) M=$PWD modules
----
. Sign your kernel module with your private key. This is done with a Perl script. Note that the script requires that you provide both the files that contain your private and the public key as well as the kernel module file that you want to sign.
. Sign your kernel module with your private key. This is done with a C application. Note that the application requires that you provide both the files that contain your private and the public key as well as the kernel module file that you want to sign.
+
[subs="attributes"]
----
~]#{nbsp}perl /usr/src/kernels/$(uname -r)/scripts/sign-file \
~]#{nbsp}/usr/src/kernels/$(uname -r)/scripts/sign-file \
sha256 \
my_signing_key.priv \
my_signing_key_pub.der \
my_module.ko
----
Your kernel module is in ELF image format and this script computes and appends the signature directly to the ELF image in your `my_module.ko` file. The [command]#modinfo# utility can be used to display information about the kernel module's signature, if it is present. For information on using the utility, see xref:Working_with_Kernel_Modules.adoc#sec-Displaying_Information_About_a_Module[Displaying Information About a Module].
Your kernel module is in ELF image format and this application computes and appends the signature directly to the ELF image in your `my_module.ko` file. The [command]#modinfo# utility can be used to display information about the kernel module's signature, if it is present. For information on using the utility, see xref:Working_with_Kernel_Modules.adoc#sec-Displaying_Information_About_a_Module[Displaying Information About a Module].
Note that this appended signature is not contained in an ELF image section and is not a formal part of the ELF image. Therefore, tools such as [command]#readelf# will not be able to display the signature on your kernel module.