3

I'm having a little trouble signing my zfs module in Fedora 27 using UEFI/Secure Boot and I hoped someone here might be able to help.

As a quick explanation for how I would normally do this, I sign the VirtualBox module using keys I have already generated and registered with efibootmgr, with the following command:

# /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 ./key.priv ./key.der $(modinfo -n vboxdrv)

It works fine because vboxdrv exists as an ordinary kernel module, and I do the same thing successfully for every kernel update, and the process is generic enough that I should be able to do the same thing with zfs. But attempting to do so fails. Checking # modinfo -n zfs, I see that the zfs kernel module appears to exist as a compressed file - /lib/modules/4.15.17-300.fc27.x86_64/extra/zfs.ko.xz (and that is the correct current kernel version).

To see if maybe there's another module that exists elswhere, I run # find / -name zfs.ko which returns nothing, so this .xz file is the only zfs module available. Fine, so I run # xz --decompress zfs.ko.xz. This tells me that the data is corrupt (the xz utility is what returns this error, suggesting that it isn't an xz-compressed file, or at least is modified in some way or otherwise can't be handled by the builtin xz).

# modinfo zfs just returns the path to zfs.ko.xz and a modinfo error.

So I'm at a loss at this point. Disabling secure boot is not really an option I want to consider. How am I supposed to sign a compressed module if I can't decompress the file first? Or is it already signed with a key available for me somewhere to download that I'm supposed to register?

  • Did you accidentally corrupt the file yourself? I can't reproduce this; I get a valid zfs.ko kernel module when I decompress zfs.ko.xz – Michael Hampton Apr 20 '18 at 18:32
  • Maybe I did something accidentally. After seeing your comment I just removed zfs altogether and reinstalled it just in case, and now I can decompress it. However signing the resulting file did nothing. I couldn't even get modprobe to recognize the resulting file. – Kefka Apr 20 '18 at 19:32
0

You can unpack the compressed module, sign it, and re-compress it

unxz zfs.ko.xz
sign-file sha1 "${key}" "${x509}" "zfs.ko"
xz -f zfs.ko

or a bit more general (I use this for evdi, inspired by https://gist.github.com/dop3j0e/2a9e2dddca982c4f679552fc1ebb18df )

for module in $(dirname $(modinfo -n evdi))/*.ko*; do
  module_basename=${module:0:-3}
  module_suffix=${module: -3}
  if [[ "$module_suffix" == ".xz" ]]; then
          unxz $module
          echo sign-file sha1 "${key}" "${x509}" "${module_basename}"
          sign-file sha1 "${key}" "${x509}" "${module_basename}"
          xz -f ${module_basename}
   elif [[ "$module_suffix" == ".gz" ]]; then
        gunzip $module
        sign-file sha1 "${key}" "${x509}" "${module_basename}"
        gzip -9f $module_basename
   else
        sign-file sha1 "${key}" "${x509}" "${module_basename}"
  fi
done

after running sudo depmod -a modprobe evdi just works :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.