lkml.org 
[lkml]   [2013]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: MODSIGN: Modules fail signature verification with -ENOKEY
From
On Sat, Jan 12, 2013 at 1:28 AM, Chris Samuel <chris@csamuel.org> wrote:
> /* Please CC, not on LKML */
>
> Hi Josh,
>
>
> On 12/01/13 00:44, Josh Boyer wrote:
>
>> Check the installed modules. A simple:
>>
>> hexdump -C <path to module> | tail -n 20
>>
>> should be enough to tell you if the installed modules at least look like
>> they're signed. You should see the expected "~Module signature appended~"
>> string. You could also check the modules in the kernel build tree for
>> the same thing. [...]
>
>
> Good call - neither the modules in the build tree, nor the installed ones
> are signed. I did a "make mrproper", changed scripts/sign-file to be
> verbose by default and rebuilt. That confirmed that the modules are getting
> signed, which left the possibility of make-kpkg stripping the modules after
> compiling as an option.

Having worked through 3 different versions of the module signing code, I
forgot that they aren't signed until you do modules_install now. So the
modules in the build tree won't be signed. I misspoke on that. The
installed modules still should be.

> Google pointed me at the likely culprit, a patch from a certain Mr Ted Ts'o
> in 2009 to make-kpkg so that it would strip kernel modules by default.
>
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=517290
>
> I'll file a bug against it asking for the it to not strip if
> CONFIG_MODULE_SIG is set.
>
> Thanks for the pointer!

Great. Glad you figured it out.

josh


\
 
 \ /
  Last update: 2013-01-12 15:01    [W:0.047 / U:0.120 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site