Kernel Module Signing

Overview

The kernel module signing facility is an important mechanism for protecting Linux kernel security. Signature information is added to the end of the kernel module file in a certain format, and the system checks whether the signature matches the public key preset in the kernel when the kernel module is loaded. In this way, the authenticity and integrity of the kernel module file are ensured.

Prerequisites

1. The openEuler kernel compilation environment has been prepared. For details, see https://gitee.com/openeuler/kernel/wikis/kernel.
2. In openEuler kernel 6.4, the ShangMi (SM) series cryptographic algorithms are supported for kernel module signing. You are advised to select the latest kernel 6.4 source code for compilation.
3. The SM2 private key and certificate used for kernel module signing have been generated. The reference commands using OpenSSL are as follows:

# Generate a certificate configuration file. (Other fields in the configuration file can be defined as required.)
echo 'subjectKeyIdentifier=hash' > mod.cfg
# Generate a private key for SM2 signing.
openssl ecparam -genkey -name SM2 -out mod.key
# Generate a signing request.
openssl req -new -sm3 -key mod.key -out mod.csr
# Generate an SM2 certificate.
openssl x509 -req -days 3650 -extfile mod.cfg -signkey mod.key -in mod.csr -out mod.crt

How to Use

Scenario 1: Manual Signing

Call sign_file in the kernel source code directory to sign the specified kernel module.

./scripts/sign-file sm3 /path/to/mod.key /path/to/mod.crt <module_file>

Scenario 2: Module Loading Verification

Add module.sig_enforce to the kernel startup parameters to enable forcible signature verification for the kernel module.

linux   /vmlinuz-6.4.0-10.1.0.20.oe2309.x86_64 root=/dev/mapper/openeuler-root ro resume=/dev/mapper/openeuler-swap rd.lvm.lv=openeuler/root rd.lvm.lv=openeuler/swap crashkernel=512M module.sig_enforce

After the system is restarted, only the kernel modules that pass the certificate verification can be loaded.

insmod /usr/lib/modules/6.4.0/kernel/crypto/sm4.ko