Skip to content

Commit

Permalink
UBUNTU: [Packaging] Fix module signing with older modinfo
Browse files Browse the repository at this point in the history
BugLink: https://bugs.launchpad.net/bugs/1852581

Not all versions of modinfo support the signer field;
specifically, the version in boinic does not. This leaves all
modules unsigned in hwe kernels based on eoan and later. Change
the check to look for the magic string at the end of the module,
which does not rely on any external tools being aware of module
signatures.

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Acked-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  • Loading branch information
Seth Forshee committed Dec 5, 2019
1 parent ea803bd commit bd72bd1
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions debian/rules.d/2-binary-arch.mk
Original file line number Diff line number Diff line change
Expand Up @@ -413,12 +413,12 @@ ifneq ($(skipdbg),true)
-name '*.ko' | while read path_module ; do \
module="/lib/modules/$${path_module#*/lib/modules/}"; \
if [[ -f "$(dbgpkgdir)/usr/lib/debug/$$module" ]] ; then \
signer=$$(/sbin/modinfo -F signer "$$path_module"); \
signature=$$(tail -c 28 "$$path_module"); \
$(CROSS_COMPILE)objcopy \
--add-gnu-debuglink=$(dbgpkgdir)/usr/lib/debug/$$module \
$$path_module; \
if grep -q CONFIG_MODULE_SIG=y $(builddir)/build-$*/.config && \
[ -n "$$signer" ]; then \
[ "$$signature" = "~Module signature appended~" ]; then \
$(builddir)/build-$*/scripts/sign-file $(MODHASHALGO) \
$(MODSECKEY) \
$(MODPUBKEY) \
Expand Down

0 comments on commit bd72bd1

Please sign in to comment.