From eebe0ff18a87354f422c693262d43cf42c195316 Mon Sep 17 00:00:00 2001 From: Dmitry Eremin-Solenikov Date: Sun, 28 Jul 2019 18:31:50 +0300 Subject: linux: add support for kernel modules signing Signed-off-by: Dmitry Eremin-Solenikov --- meta-integrity/recipes-kernel/linux/linux-%.bbappend | 3 +++ meta-integrity/recipes-kernel/linux/linux/modsign.cfg | 5 +++++ meta-integrity/recipes-kernel/linux/linux/modsign.scc | 4 ++++ 3 files changed, 12 insertions(+) create mode 100644 meta-integrity/recipes-kernel/linux/linux/modsign.cfg create mode 100644 meta-integrity/recipes-kernel/linux/linux/modsign.scc diff --git a/meta-integrity/recipes-kernel/linux/linux-%.bbappend b/meta-integrity/recipes-kernel/linux/linux-%.bbappend index 931854e..ca96c8d 100644 --- a/meta-integrity/recipes-kernel/linux/linux-%.bbappend +++ b/meta-integrity/recipes-kernel/linux/linux-%.bbappend @@ -1,3 +1,6 @@ FILESEXTRAPATHS_prepend := "${THISDIR}/linux:" SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'ima', ' file://ima.cfg', '', d)}" +SRC_URI += "${@bb.utils.contains('DISTRO_FEATURES', 'modsign', ' file://modsign.scc file://modsign.cfg', '', d)}" + +inherit ${@bb.utils.contains('DISTRO_FEATURES', 'modsign', 'kernel-modsign', '', d)} diff --git a/meta-integrity/recipes-kernel/linux/linux/modsign.cfg b/meta-integrity/recipes-kernel/linux/linux/modsign.cfg new file mode 100644 index 0000000..c0c4ebc --- /dev/null +++ b/meta-integrity/recipes-kernel/linux/linux/modsign.cfg @@ -0,0 +1,5 @@ +CONFIG_MODULE_SIG=y +CONFIG_MODULE_SIG_FORCE=y +CONFIG_MODULE_SIG_SHA256=y +CONFIG_MODULE_SIG_HASH="sha256" +CONFIG_MODULE_SIG_KEY="modsign_key.pem" diff --git a/meta-integrity/recipes-kernel/linux/linux/modsign.scc b/meta-integrity/recipes-kernel/linux/linux/modsign.scc new file mode 100644 index 0000000..bce78ae --- /dev/null +++ b/meta-integrity/recipes-kernel/linux/linux/modsign.scc @@ -0,0 +1,4 @@ +define KFEATURE_DESCRIPTION "Kernel Module Signing (modsign) enablement" +define KFEATURE_COMPATIBILITY all + +kconf non-hardware modsign.cfg -- cgit v1.2.3-54-g00ecf