View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0001594 | channel: kernel/el10 | General | public | 2026-06-05 08:50 | 2026-06-10 08:49 |
| Reporter | CdeMills | Assigned To | toracat | ||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | acknowledged | Resolution | open | ||
| Platform | x86_64 | OS | AlmaLinux | OS Version | 10.2 |
| Summary | 0001594: modules are not signed duing modules_install | ||||
| Description | I was trying to investigate the following bootup message: " kernel: nfnetlink: module verification failed: signature and/or required key missing - tainting kernel". It appeared no modules are signed at all. While looking at kernel-ml-7.0.spec, I noticed a zone which is commented: ### BCAT # Further investigation is required before these features # are enabled for the ELRepo Project kernels. %global signkernel 0 %global signmodules 0 ### BCAT as well as "%define __modsign_install_post" not using the kernel sb-sign script, and sources 21 (mod-sign.sh) and 23 (x509.genkey) missing. Meaning modules are unsigned and kernel is tainted. If would gladly give a hand to test any solution | ||||
| Steps To Reproduce | rpmbuild -ba SPECS/kernel-ml-7.0.spec In my case I generate kernel-ml with clang, so it's env LC_ALL=en_US.UTF-8 TMPDIR=/var/tmp MAKEFLAGS="LLVM=1 LLVM_IAS=1 V=1 -j2" CC="ccache clang" KBUILD_BUILD_TIMESTAMP="20260601 17:54:55 +0200" nice -n 20 rpmbuild --noclean --nocheck --without bpftool --without perf --without tools -ba SPECS/kernel-ml-7.0.spec 2>&1 But basically the module signing portion of the spec file is disabled. | ||||
| Additional Information | It's not a security issue. But the .config has option "CONFIG_MODULE_SIG_ALL" enabled while the signing chain is commented out. So there is a discrepancy between the expectations and the final result. | ||||
| Tags | kernel-ml | ||||
|
|
I tried a few distro. Fedora: signed with Fedora Official signing key. AlmaLinux: does not seem signed. Arch linux: uses an auto-generated kernel key during the build stage. By enabling "CONFIG_MODULE_SIG_ALL"" in the config, the latter behavior is expected. Would it be possible to make use of it ? The purpose is for a kernel to ensure the modules it's trying to load did not change since compilation time. |
|
|
Thanks for your notes and thoughts. When we started providing the kernel-ml package, it was not our intention to offer this kernel for any production use, as indicated on our web site and release announcement mails. So, what you spotted is some leftover code from the initial development phase related to signing. However, now that our kernels seem to be widely used, even in production systems, it may be time to change our stance. We will discuss this subject ,first among the team members, then with users and supporters. |
|
|
I made a small change to kernel-ml-7.0.spec. The %install section now starts as: %install %define SIGNFILE_MAC %{_builddir}/%{buildsubdir}/linux-%{KVERREL}/scripts/sign-file %define __modsign_install_post %{expand: find %{buildroot}/lib/modules/ -name '*.ko' -type f | while read mod; do %{SIGNFILE_MAC} sha512 /etc/kernel-signing/SB.key /etc/kernel-signing/SB.crt "$mod"; done; if [ "%{zipmodules}" -eq "1" ]; then find %{buildroot}/lib/modules/ -name '*.ko' -type f | xargs --no-run-if-empty -P%{zcpu} xz fi; } This implementation is unconditionnal, the name of the certificates are hardcoded. With this approach, the resulting rpm contains signed modules. The SB sign keys are derived from a MOKmod key which has been enrolled into the UEFI bios. Theoretically, once this approach is validated, "(CONFIG_MODULE_SIG_FORCE)" could be set. So far, for the end users, it boilds down to generate locally a MOK key and a signing key. I got help from IA tools to rewrite the macro with "%{expand:" instead of having many lines terminated by "\" Regards Pasca |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2026-06-05 08:50 | CdeMills | New Issue | |
| 2026-06-05 08:50 | CdeMills | Status | new => assigned |
| 2026-06-05 08:50 | CdeMills | Assigned To | => toracat |
| 2026-06-05 08:50 | CdeMills | Tag Attached: kernel-ml | |
| 2026-06-05 14:49 | toracat | Status | assigned => acknowledged |
| 2026-06-05 14:51 | toracat | Project | channel: elrepo/el10 => channel: kernel/el10 |
| 2026-06-05 14:51 | toracat | Category | --elrepo--request-for-enhancement-- => General |
| 2026-06-06 10:15 | CdeMills | Note Added: 0010877 | |
| 2026-06-06 13:33 | toracat | Note Added: 0010878 | |
| 2026-06-10 08:49 | CdeMills | Note Added: 0010880 |
