Sign kernel modules

kernel-mod-sign

#!/usr/bin/env bash

[[ "$#" -eq 2 ]] && mokKey="$1" 
[[ "$#" -eq 2 ]] && mokCrt="$2" 

fail(){ echo "$*"; exit 1; }

kernelver="$(uname -r)"

[[ -f "/usr/src/kernels/$kernelver/scripts/sign-file" ]] || fail "sign-file not found in /usr/src/kernels/$kernelver/scripts/sign-file"
[[ -f "$mokKey" ]] || fail "mokKey $mokKey not found"
[[ -f "$mokCrt" ]] || fail "mokCrt $mokCrt not found"

signMod() {
  echo "signing $1"
  /usr/src/kernels/$kernelver/scripts/sign-file sha256 "$mokKey" "$mokCrt" "$1"
  RELOAD_DEPS=1
}

signXzMod() {
  local t="/tmp/$$.ko"
  xz -dc "$1" | install -m 0600 /dev/stdin "$t"
  signMod "$t"
  xz -9zc "$t" > "$1"
  rm "$t"
}

find /lib/modules/$(uname -r)/extra -type f -name '*.ko*' | while read kmodWithPath; do
  signature="$(modinfo -F signature "$kmodWithPath")"
  [[ -z "$signature" ]] || continue
  [[ ! "${kmodWithPath##*.ko.}" = "$kmodWithPath" ]] || signMod "$kmodWithPath" "$mok"
  [[ ! "${kmodWithPath##*.ko.}" = "xz" ]] || signXzMod "$kmodWithPath"
done

[[ -z "$RELOAD_DEPS" ]] || ( echo "running depmod"; depmod -a )