0

I build and test a linux kernel source (rolling-stable) for fun, these days, I would like to sign a kernel module with self-created key, then I got the engine PKCS#11 on OpenSSL is used to sign it.

However there is a problem that OpenSSL fails to request a key/certification. So I confirm with pkcs11-tool, but it results "No slots."

Does this mean I should have slot involved in Smart card? Else, how do I sign kernel modules?

Following is openssl.cnf digested

# referenced from the [provider_sect] below.
# Refer to the OpenSSL security policy for more information.
# .include fipsmodule.cnf

[openssl_init]
providers = provider_sect
ssl_conf = ssl_sect
engines = engine_section

[engine_section]
pkcs11 = pkcs11_section

[pkcs11_section]
engine_id = pkcs11
dynamic_path = /usr/lib/x86_64-linux-gnu/engines-3/pkcs11.so
MODULE_PATH = /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so
init = 0

# List of providers to load
[provider_sect]

And I tried googling for a day, but I found only about enterprise, cloud....; not useful.

1 Answer 1

1

In the scripts sub-directory of the Linux kernel source package, there is a sign-file tool (used to be a script, now a binary tool, built along with the kernel).

Example: linux-6.6.13/scripts/sign-file

You can use it to sign kernel modules:

/path/to/linux-6.6.13/scripts/sign-file sha256 private-key.pem certificate.der kernelmodule.ko

Or if you have both the private key and the certificate in a single file in PEM format, you can set the kernel configuration option CONFIG_MODULE_SIG_KEY (in config menu Cryptographic API -> Certificates for signature checking -> File name or PKCS#11 URI of module signing key) to point to the file, and set CONFIG_MODULE_SIG_ALL=y (in config menu Enable loadable module support -> Automatically sign all modules), then the kernel build process will automatically sign all modules within that kernel build with the key of your choice.

You can create a suitable key-and-certificate file with e.g.:

openssl req -new -nodes -utf8 -sha256 -days 36500 -batch -x509 \
   -config x509.genkey -outform PEM -out kernel_key.pem \
   -keyout kernel_key.pem

If you want to use the sign-file tool too, you can convert the certificate part to the DER format with:

openssl x509 -in kernel_key.pem -out certificate.der -outform DER

See Documentation/admin-guide/module-signing.rst in the kernel source package for more details.

Using PKCS#11 (and by extension, smart cards or other hardware security modules) is not necessary for kernel module signing.

However, if you create your own Linux distribution and start publishing it world-wide in any significant numbers, using a PKCS#11 security module to hold your release signing keys for added security would be a very good idea.

1
  • I didn't know that a key and certificate can be combined as one file, then I considered pkcs#11 module. Thanks.
    – PICOPress
    Jan 27 at 6:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .