lkml.org 
[lkml]   [2013]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: MODSIGN: Modules fail signature verification with -ENOKEY
    From
    On Sat, Jan 12, 2013 at 1:28 AM, Chris Samuel <chris@csamuel.org> wrote:
    > /* Please CC, not on LKML */
    >
    > Hi Josh,
    >
    >
    > On 12/01/13 00:44, Josh Boyer wrote:
    >
    >> Check the installed modules. A simple:
    >>
    >> hexdump -C <path to module> | tail -n 20
    >>
    >> should be enough to tell you if the installed modules at least look like
    >> they're signed. You should see the expected "~Module signature appended~"
    >> string. You could also check the modules in the kernel build tree for
    >> the same thing. [...]
    >
    >
    > Good call - neither the modules in the build tree, nor the installed ones
    > are signed. I did a "make mrproper", changed scripts/sign-file to be
    > verbose by default and rebuilt. That confirmed that the modules are getting
    > signed, which left the possibility of make-kpkg stripping the modules after
    > compiling as an option.

    Having worked through 3 different versions of the module signing code, I
    forgot that they aren't signed until you do modules_install now. So the
    modules in the build tree won't be signed. I misspoke on that. The
    installed modules still should be.

    > Google pointed me at the likely culprit, a patch from a certain Mr Ted Ts'o
    > in 2009 to make-kpkg so that it would strip kernel modules by default.
    >
    > http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=517290
    >
    > I'll file a bug against it asking for the it to not strip if
    > CONFIG_MODULE_SIG is set.
    >
    > Thanks for the pointer!

    Great. Glad you figured it out.

    josh


    \
     
     \ /
      Last update: 2013-01-12 15:01    [W:2.409 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site