Difference between revisions of "Signed kernel module support"

From Funtoo
Jump to navigation Jump to search
(@drobbins can we have a multi line console template to perfectly mirror cat commands such as seen @ https://www.linuxfromscratch.org/lfs/view/stable/chapter10/fstab.html)
(interweave secure boot shim to the signed kernel document.)
Line 67: Line 67:
###i## /usr/src/linux/scripts/sign-file sha512 /etc/kernel/certs/linux/signing_key.pem /etc/kernel/certs/linux/signing_key.x509 ${MODULE_KO}
###i## /usr/src/linux/scripts/sign-file sha512 /etc/kernel/certs/linux/signing_key.pem /etc/kernel/certs/linux/signing_key.x509 ${MODULE_KO}
}}
}}
==ready to shim==
Now that our system has a signed kernel and modules, we can load them up for secure boot using the fedora shim.
*[[Package:Shim]]

Revision as of 18:50, January 7, 2023

Since the Linux kernel version 3.7.x, support for the signed kernel modules has been useful. When enabled, the Linux kernel will be fixed. This allows the system to be "hardened", not using the unsigned kernel, or kernel modules to be loaded with a wrong key, to be loaded. Malicious kernel modules are a common system for rootkits to enter a Linux system.

When the Linux kernel is building with module signature verification support enabled, then you can use your own keys. We recommend the debian-sources kernel, just enabling the useflag "sign-modules".

root # echo "sys-kernel/debian-sources sign-modules" >> /etc/portage/package.use
root # mkdir -p /etc/kernel/certs/linux


If we want to use our own keys, you can use openssl to create a key pair (private key and public key). First, create a new file x509.genkey on directory /etc/kernel/certs/linux :

  • in a root terminal run this multi line command:
   cat > /etc/kernel/certs/linux/x509.genkey << EOF
[ req ]
default_bits = 4096
distinguished_name = req_distinguished_name
prompt = no
string_mask = utf8only
x509_extensions = myexts

[ req_distinguished_name ]
CN = Funtoo Linux

[ myexts ]
basicConstraints=critical,CA:FALSE
keyUsage=digitalSignature
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid
EOF


We will manually generate the private/public key files using the x509.genkey key generation configuration file and the openssl command. Here is an example to generate the public/private key files:

root # openssl req -new -nodes -utf8 -sha512 -days 36500 -batch -x509 -config /etc/kernel/certs/linux/x509.genkey -outform PEM -out /etc/kernel/certs/linux/signing_key.pem -keyout /etc/kernel/certs/linux/signing_key.pem
root # openssl x509 -outform der -in /etc/kernel/certs/linux/signing_key.pem -out /etc/kernel/certs/linux/signing_key.x509


Fix permissions:

root # chmod -R 644 /etc/kernel/certs/linux/signing_key.pem


Now, build debian-sources with your own keys:

root # emerge sys-kernel/debian-sources


Optional: Enable module.sig_enforce=1

   Note

If module.sig_enforce is enabled supplied on the kernel command line, the kernel will only load validly signed modules for which it has a public key. Otherwise, it will also load modules that are unsigned. Any module for which the kernel has a key, but which proves to have a signature mismatch will not be permitted to load.


Manually signing modules

If you ever need to manually sign a kernel module, you can use the scripts/sign-file script available in the Linux kernel source tree. It requires four arguments:

  1. The hash algorithm to use, such as sha512.
  2. The private key location.
  3. The certificate (which includes the public key) location.
  4. The kernel module to sign.


root # /usr/src/linux/scripts/sign-file sha512 /etc/kernel/certs/linux/signing_key.pem /etc/kernel/certs/linux/signing_key.x509 ${MODULE_KO}

ready to shim

Now that our system has a signed kernel and modules, we can load them up for secure boot using the fedora shim.