Fixes [YOCTO #12927]
Currently, signed kernel modules are not stripped in order to preserve
their valid signatures. See commit 4c47e5f.
Therefore, this commit makes kernel modules stripped and correctly
signed. Two options are possible:
- Strip the kernel modules after installation and before signing.
- Re-sign the kernel modules after stripping and before package splitting.
The first option was rejected because debug symbols would be dropped early
in the build workflow, which may impact the SPDX process.
The second option is adopted because it does not impact the build flow.
Reported-by: Ross Burton <[email protected]>
Signed-off-by: Anis Bougrine <[email protected]>
---
.../kernel-module-split.bbclass | 25 +++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/meta/classes-recipe/kernel-module-split.bbclass
b/meta/classes-recipe/kernel-module-split.bbclass
index bde7cd02dd..da7b30e99f 100644
--- a/meta/classes-recipe/kernel-module-split.bbclass
+++ b/meta/classes-recipe/kernel-module-split.bbclass
@@ -35,6 +35,11 @@ modprobedir ??= "${@bb.utils.contains('DISTRO_FEATURES',
'systemd', '${nonarch_b
KERNEL_SPLIT_MODULES ?= "1"
PACKAGESPLITFUNCS =+ "split_kernel_module_packages"
+# Order matters:
+# 1. Strip the modules
+# 2. Re-sign the modules (if enabled)
+# 3. Split the packages
+PACKAGESPLITFUNCS =+ "post_strip_kernel_modules_signing"
KERNEL_MODULES_META_PACKAGE ?= "${@ d.getVar("KERNEL_PACKAGE_NAME") or
"kernel" }-modules"
@@ -63,6 +68,26 @@ def get_ext_mod(d):
return d.getVar("S")
+# This function supports both in-tree and out-of-tree modules.
+post_strip_kernel_modules_signing(){
+ # Read .config values to determine if module auto-signing is enabled
+ is_modules="$(${STAGING_KERNEL_DIR}/scripts/config --file
${KBUILD_OUTPUT}/.config --state MODULES)"
+ is_module_sig="$(${STAGING_KERNEL_DIR}/scripts/config --file
${KBUILD_OUTPUT}/.config --state MODULE_SIG)"
+ is_module_sig_all="$(${STAGING_KERNEL_DIR}/scripts/config --file
${KBUILD_OUTPUT}/.config --state MODULE_SIG_ALL)"
+
+ if [ "$is_modules" = "y" ] && [ "$is_module_sig" = "y" ] && [
"$is_module_sig_all" = "y" ]; then
+ # Sign modules under ${PKGD}, with M= if out-of-tree module.
+ # Out-of-tree module Makefiles invoke the kernel Makefile by appending
M= (the module directory) to MAKEFLAGS.
+ # However, they usually do not provide a modules_sign target.
Therefore, the kernel modules_sign target has to
+ # be invoked manually after retrieving M= variable from package source
code Makefile.
+ oe_runmake \
+ -C ${KBUILD_OUTPUT} \
+ MODLIB=${PKGD}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \
+ ${@'M=${@get_ext_mod(d)}' if not "virtual/kernel" in
d.getVar('PROVIDES') else ''} \
+ modules_sign
+ fi
+}
+
python split_kernel_module_packages () {
import re
--
2.50.1 (Apple Git-155)
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#244361):
https://lists.openembedded.org/g/openembedded-core/message/244361
Mute This Topic: https://lists.openembedded.org/mt/120933946/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
