sbueringer · October 16, 2019 04:22 · dtatulea · Mar 21, 2021 · dasunsrule32 · Jul 24, 2021
diff --git a/dkms-module-signing.md b/dkms-module-signing.md
diff --git a/dkms-sign-module b/dkms-sign-module
 #!/bin/bash
 export PROMPT="Enter Machine Owner Key (MOK) passphrase to sign $module $module_version: "
 export KERNELVER=$kernelver
 $(dirname $0)/sign-modules ../$kernelver/$arch/module/*.ko*
diff --git a/one-time-setup b/one-time-setup
 #!/bin/bash

 mydir=$(dirname $0)

 echo "I am about to generate the Machine Owner Key (MOK)."
 echo "The passphrase you enter for this key will be required every time you want to sign a module."
 read -p "Please press Return to go on..."
 openssl req -new -x509 -newkey rsa:2048 -keyout $mydir/MOK.priv -outform DER -out $mydir/MOK.der -days 36500 -subj "/CN=$(hostname) module signing key/" || exit 1

 echo
 echo "Now I will import the generated key into the secure keystore."
 echo "The passphrase you will enter is only required once, during the following reboot."
 read -p "Please press Return to go on..."
 mokutil --import $mydir/MOK.der || exit 1

 echo
 echo "Please reboot your computer now to complete the enrollment of your new MOK."
 echo "This is going to look somewhat similar to https://sourceware.org/systemtap/wiki/SecureBoot"
diff --git a/sign-modules b/sign-modules
 #!/bin/bash

 if [[ -z "$1" ]]; then
    echo "Usage: $0 module [module...]"
    exit 1
 fi

 mydir=$(dirname $0)

 PROMPT="${PROMPT:-Enter Machine Owner Key (MOK) passphrase: }"
 KERNELVER=${KERNELVER:-$(uname -r)}

 read_passphrase() {
    # We write to /dev/tty to get around DKMS' redirection to /dev/null if it's being run with -q (e.g. during rpm installs)
    echo -n "$PROMPT" > /dev/tty
    read -s KBUILD_SIGN_PIN < /dev/tty
    export KBUILD_SIGN_PIN
    echo > /dev/tty
    openssl rsa -check -noout -passin env:KBUILD_SIGN_PIN -in $mydir/MOK.priv > /dev/null 2>&1
 }

 do_sign() {
    /lib/modules/$KERNELVER/build/scripts/sign-file sha256 $mydir/MOK.priv $mydir/MOK.der "$1"
 }

 while ! read_passphrase; do echo "Wrong passphrase, please try again."; done

 for module in $@; do
    echo "Signing module: $module"
    module_basename=${module:0:-3}
    module_suffix=${module: -3}
    if [[ "$module_suffix" == ".xz" ]]; then
 	unxz $module
 	do_sign $module_basename
 	xz -f $module_basename
    elif [[ "$module_suffix" == ".gz" ]]; then
 	gunzip $module
 	do_sign $module_basename
 	gzip -9f $module_basename
    else
 	do_sign $module
    fi    
 done
	#!/bin/bash
	export PROMPT="Enter Machine Owner Key (MOK) passphrase to sign $module $module_version: "
	export KERNELVER=$kernelver
	$(dirname $0)/sign-modules ../$kernelver/$arch/module/.ko
	#!/bin/bash

	mydir=$(dirname $0)

	echo "I am about to generate the Machine Owner Key (MOK)."
	echo "The passphrase you enter for this key will be required every time you want to sign a module."
	read -p "Please press Return to go on..."
	openssl req -new -x509 -newkey rsa:2048 -keyout $mydir/MOK.priv -outform DER -out $mydir/MOK.der -days 36500 -subj "/CN=$(hostname) module signing key/" \|\| exit 1

	echo
	echo "Now I will import the generated key into the secure keystore."
	echo "The passphrase you will enter is only required once, during the following reboot."
	read -p "Please press Return to go on..."
	mokutil --import $mydir/MOK.der \|\| exit 1

	echo
	echo "Please reboot your computer now to complete the enrollment of your new MOK."
	echo "This is going to look somewhat similar to https://sourceware.org/systemtap/wiki/SecureBoot"
	#!/bin/bash

	if [[ -z "$1" ]]; then
	echo "Usage: $0 module [module...]"
	exit 1
	fi

	mydir=$(dirname $0)

	PROMPT="${PROMPT:-Enter Machine Owner Key (MOK) passphrase: }"
	KERNELVER=${KERNELVER:-$(uname -r)}

	read_passphrase() {
	# We write to /dev/tty to get around DKMS' redirection to /dev/null if it's being run with -q (e.g. during rpm installs)
	echo -n "$PROMPT" > /dev/tty
	read -s KBUILD_SIGN_PIN < /dev/tty
	export KBUILD_SIGN_PIN
	echo > /dev/tty
	openssl rsa -check -noout -passin env:KBUILD_SIGN_PIN -in $mydir/MOK.priv > /dev/null 2>&1
	}

	do_sign() {
	/lib/modules/$KERNELVER/build/scripts/sign-file sha256 $mydir/MOK.priv $mydir/MOK.der "$1"
	}

	while ! read_passphrase; do echo "Wrong passphrase, please try again."; done

	for module in $@; do
	echo "Signing module: $module"
	module_basename=${module:0:-3}
	module_suffix=${module: -3}
	if [[ "$module_suffix" == ".xz" ]]; then
	unxz $module
	do_sign $module_basename
	xz -f $module_basename
	elif [[ "$module_suffix" == ".gz" ]]; then
	gunzip $module
	do_sign $module_basename
	gzip -9f $module_basename
	else
	do_sign $module
	fi
	done