Skip to content

Instantly share code, notes, and snippets.

@steigr
Created December 26, 2018 07:40
Show Gist options
  • Save steigr/65de3612ee432e175990af85439cee83 to your computer and use it in GitHub Desktop.
Save steigr/65de3612ee432e175990af85439cee83 to your computer and use it in GitHub Desktop.
Sign kernel modules
#!/usr/bin/env bash
[[ "$#" -eq 2 ]] && mokKey="$1"
[[ "$#" -eq 2 ]] && mokCrt="$2"
fail(){ echo "$*"; exit 1; }
kernelver="$(uname -r)"
[[ -f "/usr/src/kernels/$kernelver/scripts/sign-file" ]] || fail "sign-file not found in /usr/src/kernels/$kernelver/scripts/sign-file"
[[ -f "$mokKey" ]] || fail "mokKey $mokKey not found"
[[ -f "$mokCrt" ]] || fail "mokCrt $mokCrt not found"
signMod() {
echo "signing $1"
/usr/src/kernels/$kernelver/scripts/sign-file sha256 "$mokKey" "$mokCrt" "$1"
RELOAD_DEPS=1
}
signXzMod() {
local t="/tmp/$$.ko"
xz -dc "$1" | install -m 0600 /dev/stdin "$t"
signMod "$t"
xz -9zc "$t" > "$1"
rm "$t"
}
find /lib/modules/$(uname -r)/extra -type f -name '*.ko*' | while read kmodWithPath; do
signature="$(modinfo -F signature "$kmodWithPath")"
[[ -z "$signature" ]] || continue
[[ ! "${kmodWithPath##*.ko.}" = "$kmodWithPath" ]] || signMod "$kmodWithPath" "$mok"
[[ ! "${kmodWithPath##*.ko.}" = "xz" ]] || signXzMod "$kmodWithPath"
done
[[ -z "$RELOAD_DEPS" ]] || ( echo "running depmod"; depmod -a )
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment