1. Computers
  2. Display Drivers
  3. Graphics Cards
  4. Memory
  5. Motherboards
  6. Processors
  7. Software
  8. Storage
  9. Operating Systems


Facebook RSS Twitter Twitter Google Plus


Phoronix Test Suite

OpenBenchmarking.org

Signed Kernel Modules Support For Linux 3.7

Linux Kernel

Published on 16 October 2012 05:22 AM EDT
Written by Michael Larabel in Linux Kernel
8 Comments

One of the last merge requests that Linus Torvalds honored this past weekend prior to releasing Linux 3.7-rc1 as the modules pull, which added in module signing support for the Linux kernel.

The work coming out of Red Hat introduces a CONFIG_MODULE_SIG option that enables module signing support. This kernel configuration option causes the build process to sign the kernel modules as they are built and for the resulting kernel to check the modules when they are loaded. The module signing allows for SHA1, SHA224, SHA256, SHA384, and SHA512 cryptographic hashes.

A CONFIG_MODULE_SIG_FORCE option was also added as part of this kernel modules work, which will require any kernel module that is loaded to be signed by a key compiled into the kernel. If the module isn't signed by a key in that kernel, the module will not be loaded.

The accepted patches come via Red Hat's David Howells. The module signing support in its earliest form date back to 2004, but it wasn't agreed upon until just recently about the Linux kernel module signing support and it being acceptable for mainline integration.

The most pressing need for the module signing support is for UEFI SecureBoot so that the Linux kernel can reject loading any unsigned modules, which could pose a threat if it's malicious code or unsigned binary blobs.

The "modules-next" pull that went in on Sunday prior to the closing of the Linux 3.7 kernel that has this "MODSIGN" support can be seen from the web-based Git viewer.
David Howells (30):
Make most arch asm/module.h files use asm-generic/module.h
KEYS: Add payload preparsing opportunity prior to key instantiate or update
MPILIB: Provide count_leading/trailing_zeros() based on arch functions
KEYS: Document asymmetric key type
KEYS: Implement asymmetric key type
KEYS: Asymmetric key pluggable data parsers
KEYS: Asymmetric public-key algorithm crypto key subtype
KEYS: Provide signature verification with an asymmetric key
MPILIB: Reinstate mpi_cmp[_ui]() and export for RSA signature verification
RSA: Implement signature verification algorithm [PKCS#1 / RFC3447]
RSA: Fix signature verification for shorter signatures
X.509: Implement simple static OID registry
X.509: Add utility functions to render OIDs as strings
X.509: Add simple ASN.1 grammar compiler
X.509: Add an ASN.1 decoder
MPILIB: Provide a function to read raw data into an MPI
X.509: Add a crypto key parser for binary (DER) X.509 certificates
MODSIGN: Add FIPS policy
MODSIGN: Provide gitignore and make clean rules for extra files
MODSIGN: Provide Kconfig options
MODSIGN: Automatically generate module signing keys if missing
MODSIGN: Provide module signing public keys to the kernel
MODSIGN: Implement module signature checking
MODSIGN: Provide a script for generating a key ID from an X.509 cert
MODSIGN: Sign modules during the build process
MODSIGN: Use the same digest for the autogen key sig as for the module sig
MODSIGN: Use utf8 strings in signer's name in autogenerated X.509 certs
MODSIGN: Fix 32-bit overflow in X.509 certificate validity date checking
X.509: Convert some printk calls to pr_devel
X.509: Fix indefinite length element skip error handling

About The Author
Michael Larabel is the principal author of Phoronix.com and founded the web-site in 2004 with a focus on enriching the Linux hardware experience and being the largest web-site devoted to Linux hardware reviews, particularly for products relevant to Linux gamers and enthusiasts but also commonly reviewing servers/workstations and embedded Linux devices. Michael has written more than 10,000 articles covering the state of Linux hardware support, Linux performance, graphics hardware drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated testing software. He can be followed via and or contacted via .
Latest Linux Hardware Reviews
  1. Acer B286HK: A 28-inch UHD LED 4K Monitor For As Low As $350
  2. Intel Xeon E5-1680 v3 & E5-2687W v3 Compared To The Core i7 5960X On Linux
  3. Intel 120GB 530 Series SSD Linux Performance
  4. Btrfs/EXT4/XFS/F2FS RAID 0/1/5/6/10 Linux Benchmarks On Four SSDs
Latest Linux Articles
  1. Mesa Git Yields Performance Improvements For Newer AMD GPUs
  2. Apple OS X 10.10 vs. Ubuntu 14.10 Performance
  3. Mesa 10.5-devel Brings Some Intel Haswell HD Graphics Changes Over Mesa 10.3
  4. NVIDIA vs. Nouveau Drivers With Linux 3.18 + Mesa 10.4-devel
Latest Linux News
  1. NVIDIA Posts Tegra Gallium3D Patch For K1+ Support
  2. Ubuntu 14.10 MacBook Air Tests With Linux 3.18, Mesa 10.5
  3. AMD Richland APU Support Added To Coreboot
  4. 2014 Holiday Shopping Reminder, Happy Thanksgiving
  5. Python 3 Support Added To The GNOME Shell
  6. ReactOS Lands Its New Explorer Shell
  7. Weston's IVI Shell Sees New Version
  8. IMP Launches As Another Open-Source Computer Attempt
  9. Git 2.2.0 Released With 550+ Changes
  10. GNOME 3.15.2 Released
Latest Forum Discussions
  1. Updated and Optimized Ubuntu Free Graphics Drivers
  2. Hurrican SDL Port
  3. Roadmap to Catalyst 14.10 ?
  4. how to configure module phoromatic ?
  5. PulseAudio 6.0 Is Coming & Other Linux Audio Plans For The Future
  6. Debian Developer Resigns From The Systemd Maintainership Team
  7. Cant get working Kaveri APU - A10-7850k
  8. Script for Fan Speed Control