Support for kernel module signing about linux-tkg HOT 4 CLOSED

Module signing is enabled in all current revisions of -tkg kernels.

See https://github.com/Frogging-Family/linux-tkg/blob/master/linux58-tkg/linux58-tkg-config/config.x86_64#L883 for example.

Key is generated early on at build time:

from linux-tkg.

To be specific I'm talking about modules built through dkms, if kernel signing is on (which it is) all modules would be signed outside of those dkms modules. for mod in $(lsmod | tail -n +2 | cut -d' ' -f1); do modinfo ${mod} | grep -q "signature" || echo "Unsigned: ${mod}" ; done will show which modules are unsigned, in my case

Unsigned: nvidia_uvm 
Unsigned: nvidia_drm
Unsigned: nvidia_modeset
Unsigned: krx62
Unsigned: nvidia

I see with _NUKR off in the customization config it leaves the signing keys behind, so I might play with signing those modules manually when I get time. That way I can enforce module signing on boot, while still having a working system, and then nuke the /src so I don't have the key floating around. Still not my wheelhouse but it is interesting to read about.

from linux-tkg.

I did not know that. Is there a way to use that to sign out of tree modules (nvidia, virtualbox, etc) so that you can set module.sig_enforce=1?

from linux-tkg.

The Ubuntu&Derivatives install script also signs the modules :D

from linux-tkg.