mirror of
https://github.com/vyos/vyos-build.git
synced 2025-10-01 20:28:40 +02:00
d235b31a09
The shim review board (which is the secure boot base loader) recommends using ephemeral keys when signing the Linux Kernel. This commit enables the Kernel build system to generate a one-time ephemeral key that is used to: * sign all build-in Kernel modules * sign all other out-of-tree Kernel modules The key lives in /tmp and is destroyed after the build container exits and is named: "VyOS build time autogenerated kernel key". In addition the Kernel now uses CONFIG_MODULE_SIG_FORCE. This now makes it unable to load any Kernel Module to the image that is NOT signed by the ephemeral key.
16 lines
370 B
Bash
Executable File
16 lines
370 B
Bash
Executable File
#!/bin/sh
|
|
|
|
BASE_DIR=$(dirname $0)
|
|
MODULE_DIR=$1
|
|
. ${BASE_DIR}/kernel-vars
|
|
|
|
SIGN_FILE="${KERNEL_DIR}/scripts/sign-file"
|
|
|
|
if [ -f ${EPHEMERAL_KEY} ] && [ -f ${EPHEMERAL_CERT} ]; then
|
|
find ${MODULE_DIR} -type f -name \*.ko | while read MODULE; do
|
|
echo "I: Signing ${MODULE} ..."
|
|
${SIGN_FILE} sha512 ${EPHEMERAL_KEY} ${EPHEMERAL_CERT} ${MODULE}
|
|
done
|
|
fi
|
|
|