Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save dasunsrule32/90a5d0f806b5e54cf4d1bceb97835957 to your computer and use it in GitHub Desktop.
Save dasunsrule32/90a5d0f806b5e54cf4d1bceb97835957 to your computer and use it in GitHub Desktop.
Make DKMS sign kernel modules on installation, with full script support and somewhat distro independent

On systems with UEFI Secure Boot enabled, recent Linux kernels will only load signed modules, so it's about time DKMS grew the capability to sign modules it's building.

These scripts are extended and scriptified variants of https://computerlinguist.org/make-dkms-sign-kernel-modules-for-secure-boot-on-ubuntu-1604.html and https://askubuntu.com/questions/760671/could-not-load-vboxdrv-after-upgrade-to-ubuntu-16-04-and-i-want-to-keep-secur/768310#768310 and add some error checking, a passphrase around your signing key, and support for compressed modules.

dkms-sign-module is a wrapper for the more generic sign-modules which can also be used outside of DKMS.

Installation

  1. Create a directory under /root, say /root/module-signing, put the three scripts below in there and make them executable: chmod u+x one-time-setup sign-modules dkms-sign-module
  2. Run one-time-setup
  3. Reboot your computer to deploy the MOK
  4. For each module you will want to sign via DKMS, create a file /etc/dkms/<module_name>.conf with the following content:
    POST_BUILD=../../../../../../root/module-signing/dkms-sign-module
    
    The awkward relative pathname is important since DKMS prepends its own path to it, so an absolute path will not work.
#!/bin/bash
export PROMPT="Enter Machine Owner Key (MOK) passphrase to sign $module $module_version: "
export KERNELVER=$kernelver
$(dirname $0)/sign-modules ../$kernelver/$arch/module/*.ko*
#!/bin/bash
mydir=$(dirname $0)
echo "I am about to generate the Machine Owner Key (MOK)."
echo "The passphrase you enter for this key will be required every time you want to sign a module."
read -p "Please press Return to go on..."
openssl req -new -x509 -newkey rsa:2048 -keyout $mydir/MOK.priv -outform DER -out $mydir/MOK.der -days 36500 -subj "/CN=$(hostname) module signing key/" || exit 1
echo
echo "Now I will import the generated key into the secure keystore."
echo "The passphrase you will enter is only required once, during the following reboot."
read -p "Please press Return to go on..."
mokutil --import $mydir/MOK.der || exit 1
echo
echo "Please reboot your computer now to complete the enrollment of your new MOK."
echo "This is going to look somewhat similar to https://sourceware.org/systemtap/wiki/SecureBoot"
#!/bin/bash
if [[ -z "$1" ]]; then
echo "Usage: $0 module [module...]"
exit 1
fi
mydir=$(dirname $0)
PROMPT="${PROMPT:-Enter Machine Owner Key (MOK) passphrase: }"
KERNELVER=${KERNELVER:-$(uname -r)}
read_passphrase() {
# We write to /dev/tty to get around DKMS' redirection to /dev/null if it's being run with -q (e.g. during rpm installs)
echo -n "$PROMPT" > /dev/tty
read -s KBUILD_SIGN_PIN < /dev/tty
export KBUILD_SIGN_PIN
echo > /dev/tty
openssl rsa -check -noout -passin env:KBUILD_SIGN_PIN -in $mydir/MOK.priv > /dev/null 2>&1
}
do_sign() {
/lib/modules/$KERNELVER/build/scripts/sign-file sha256 $mydir/MOK.priv $mydir/MOK.der "$1"
}
while ! read_passphrase; do echo "Wrong passphrase, please try again."; done
for module in $@; do
echo "Signing module: $module"
module_basename=${module:0:-3}
module_suffix=${module: -3}
if [[ "$module_suffix" == ".xz" ]]; then
unxz $module
do_sign $module_basename
xz -f $module_basename
elif [[ "$module_suffix" == ".gz" ]]; then
gunzip $module
do_sign $module_basename
gzip -9f $module_basename
else
do_sign $module
fi
done
@dasunsrule32
Copy link
Author

Fedora has issues building this. To get around the issue, create a conf file for the name of your source module package, eg. openrazer-driver. Creating /etc/dkms/openrazer-driver.conf with the following POST_BUILD var set, it built and signed the modules successfully.

POST_BUILD=../../../../../../root/module-signing/dkms-sign-module

Build:

sudo dkms build -m openrazer-driver/3.0.1 

Creating symlink /var/lib/dkms/openrazer-driver/3.0.1/source ->
                 /usr/src/openrazer-driver-3.0.1

DKMS: add completed.

Kernel preparation unnecessary for this kernel.  Skipping...

Building module:
cleaning build area...
KERNELDIR=/lib/modules/5.13.4-200.fc34.x86_64/build make driver....

Running the post_build script:
Enter Machine Owner Key (MOK) passphrase to sign openrazer-driver 3.0.1: 
Signing module: ../5.13.4-200.fc34.x86_64/x86_64/module/razeraccessory.ko.xz
Signing module: ../5.13.4-200.fc34.x86_64/x86_64/module/razerkbd.ko.xz
Signing module: ../5.13.4-200.fc34.x86_64/x86_64/module/razerkraken.ko.xz
Signing module: ../5.13.4-200.fc34.x86_64/x86_64/module/razermouse.ko.xz
cleaning build area...

DKMS: build completed.

Install:

sudo dkms install -m openrazer-driver/3.0.1 

razerkbd.ko.xz:
Running module version sanity check.
 - Original module
   - No original module exists within this kernel
 - Installation
   - Installing to /lib/modules/5.13.4-200.fc34.x86_64/extra/

razermouse.ko.xz:
Running module version sanity check.
 - Original module
   - No original module exists within this kernel
 - Installation
   - Installing to /lib/modules/5.13.4-200.fc34.x86_64/extra/

razerkraken.ko.xz:
Running module version sanity check.
 - Original module
   - No original module exists within this kernel
 - Installation
   - Installing to /lib/modules/5.13.4-200.fc34.x86_64/extra/

razeraccessory.ko.xz:
Running module version sanity check.
 - Original module
   - No original module exists within this kernel
 - Installation
   - Installing to /lib/modules/5.13.4-200.fc34.x86_64/extra/

depmod....

DKMS: install completed.

DKMS installed:

dkms status 
openrazer-driver, 3.0.1, 5.13.4-200.fc34.x86_64, x86_64: installed

Modules loaded:

lsmod|grep razer
razermouse            110592  0
razerkbd               77824  0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment