4

I'm having a little trouble signing my zfs module in Fedora 27 using UEFI/Secure Boot and I hoped someone here might be able to help.

As a quick explanation for how I would normally do this, I sign the VirtualBox module using keys I have already generated and registered with efibootmgr, with the following command:

# /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 ./key.priv ./key.der $(modinfo -n vboxdrv)

It works fine because vboxdrv exists as an ordinary kernel module, and I do the same thing successfully for every kernel update, and the process is generic enough that I should be able to do the same thing with zfs. But attempting to do so fails. Checking # modinfo -n zfs, I see that the zfs kernel module appears to exist as a compressed file - /lib/modules/4.15.17-300.fc27.x86_64/extra/zfs.ko.xz (and that is the correct current kernel version).

To see if maybe there's another module that exists elswhere, I run # find / -name zfs.ko which returns nothing, so this .xz file is the only zfs module available. Fine, so I run # xz --decompress zfs.ko.xz. This tells me that the data is corrupt (the xz utility is what returns this error, suggesting that it isn't an xz-compressed file, or at least is modified in some way or otherwise can't be handled by the builtin xz).

# modinfo zfs just returns the path to zfs.ko.xz and a modinfo error.

So I'm at a loss at this point. Disabling secure boot is not really an option I want to consider. How am I supposed to sign a compressed module if I can't decompress the file first? Or is it already signed with a key available for me somewhere to download that I'm supposed to register?

2
  • Did you accidentally corrupt the file yourself? I can't reproduce this; I get a valid zfs.ko kernel module when I decompress zfs.ko.xz Apr 20, 2018 at 18:32
  • Maybe I did something accidentally. After seeing your comment I just removed zfs altogether and reinstalled it just in case, and now I can decompress it. However signing the resulting file did nothing. I couldn't even get modprobe to recognize the resulting file.
    – Kefka
    Apr 20, 2018 at 19:32

1 Answer 1

3

You can unpack the compressed module, sign it, and re-compress it

unxz zfs.ko.xz
sign-file sha1 "${key}" "${x509}" "zfs.ko"
xz -f zfs.ko

or a bit more general (I use this for evdi, inspired by https://gist.github.com/dop3j0e/2a9e2dddca982c4f679552fc1ebb18df )

for module in $(dirname $(modinfo -n evdi))/*.ko*; do
  module_basename=${module:0:-3}
  module_suffix=${module: -3}
  if [[ "$module_suffix" == ".xz" ]]; then
          unxz $module
          echo sign-file sha1 "${key}" "${x509}" "${module_basename}"
          sign-file sha1 "${key}" "${x509}" "${module_basename}"
          xz -f ${module_basename}
   elif [[ "$module_suffix" == ".gz" ]]; then
        gunzip $module
        sign-file sha1 "${key}" "${x509}" "${module_basename}"
        gzip -9f $module_basename
   else
        sign-file sha1 "${key}" "${x509}" "${module_basename}"
  fi
done

after running sudo depmod -a modprobe evdi just works :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .