Contents
How do I sign a Linux kernel for secure boot?
Sign Kernel Modules for use with UEFI Secure Boot
- Before You Begin.
- Install Required Packages.
- Create a sample custom kernel module.
- Create local certificates and sign the module.
- Adding the certificate to the kernel trusted keyring.
- Enroll the certificate into the UEFI Secure Boot key database.
- Known issues.
What is a module in mathematics?
In mathematics, a module is one of the fundamental algebraic structures used in abstract algebra. Like a vector space, a module is an additive abelian group, and scalar multiplication is distributive over the operation of addition between elements of the ring or module and is compatible with the ring multiplication.
What is a signed kernel?
When enabled, the Linux kernel will only load kernel modules that are digitally signed with the proper key. This allows further hardening of the system by disallowing unsigned kernel modules, or kernel modules signed with the wrong key, to be loaded.
Do I need Secure Boot for Linux?
If you’re running certain PC graphics cards, hardware, or operating systems such as Linux or previous version of Windows you may need to disable Secure Boot. Secure Boot helps to make sure that your PC boots using only firmware that is trusted by the manufacturer.
How does the kernel module signing facility work?
The kernel module signing facility cryptographically signs modules during installation and then checks the signature upon loading the module. This allows increased kernel security by disallowing the loading of unsigned modules or modules signed with an invalid key.
How does a kernel deal with an unsigned signature?
This specifies how the kernel should deal with a module that has a signature for which the key is not known or a module that is unsigned.
Why are signed modules brittle in the Linux kernel?
Signed modules are BRITTLE as the signature is outside of the defined ELF container. Thus they MAY NOT be stripped once the signature is computed and attached. Note the entire module is the signed payload, including any and all debug information present at the time of signing.
How can I check if a module is signed?
You can see the running modules on your system by using lsmod or checking /proc/modules. To verify that a compiled module is signed on your system, you can do the following: change to the modules directory for the running kernel and locate the module that you want to check.