Skip to content

Instantly share code, notes, and snippets.

@xabbu

xabbu/72-dkms-signing.hook

Last active July 4, 2019 12:16
Download ZIP

Revisions

  1. xabbu revised this gist Jul 4, 2019. 1 changed file with 12 additions and 7 deletions.
    19 changes: 12 additions & 7 deletions DKMS-signing.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -3,17 +3,20 @@
    # signing DKMS Modules
    #

    signkey="/mnt/SundP/kernel-signing/dkms-kernel-up-key.pem"
    kernlocalver="-up"

    kernelr=$( dkms status -k "*-up" | head -n1 | grep -Eo '[3-9].([0-9]|\.){3,}-[0-9]-up' )
    signkey="/mnt/SundP/kernel-signing/dkms-kernel-up-key.pem"

    kernelr=$( dkms status -k "*$kernlocalver" | head -n1 | grep -Eo '[3-9].([0-9]|\.){3,}-[0-9]-up' )
    kernelp="/usr/lib/modules/$kernelr"

    for i in $( dkms status -k "*-up" | grep installed | grep -Eo '^[[:alnum:]]([[:alnum:]]|_|-|\.)*' ) ; do
    for i in $( dkms status -k "*$kernlocalver" | grep installed | grep -Eo '^[[:alnum:]]([[:alnum:]]|_|-|\.)*' ); do

    for ii in $( grep -Eo '^BUILT_MODULE_NAME.*$' /usr/src/"$i"-*/dkms.conf | grep -Eo '\"[[:alnum:]]([[:alnum:]]|_|-|\.)*\"' | sed 's/"//g' ) ; do
    modver=$( dkms status -k "*$kernlocalver" | grep "$i" | awk '{ print $2 }' | sed 's/,$//' )

    pathm=$( grep -Eo '^DEST_MODULE_LOCATION.*$' /usr/src/"$i"-*/dkms.conf | head -n1 | grep -Eo '\"/([[:alnum:]]|/).*\"' | sed 's/"//g' | sed 's/\/$//' )
    for ii in $( grep -Eo '^BUILT_MODULE_NAME.*$' /usr/src/"$i"-"$modver"/dkms.conf | grep -Eo '\"[[:alnum:]]([[:alnum:]]|_|-|\.)*\"' | sed 's/"//g' ); do

    pathm=$( grep -Eo '^DEST_MODULE_LOCATION.*$' /usr/src/"$i"-"$modver"/dkms.conf | head -n1 | grep -Eo '\"/([[:alnum:]]|/).*\"' | sed 's/"//g' | sed 's/\/$//' )
    modxz="$kernelp$pathm/$ii.ko.xz"
    mod="$kernelp$pathm/$ii.ko"
    #ls "$modxz"
    @@ -23,14 +26,16 @@ for i in $( dkms status -k "*-up" | grep installed | grep -Eo '^[[:alnum:]]([[:a
    fi
    # extract
    unxz "$modxz"
    if ! grep "~Module signature appended~" "$mod" > /dev/null 2>&1; then
    if ! grep "~Module signature appended~" "$mod" >/dev/null 2>&1; then
    echo "Sign $mod"
    # sign
    "/usr/lib/modules/$kernelr/build/scripts/sign-file" sha512 "$signkey" "$signkey" "$mod"
    fi
    #compress
    xz "$mod"
    # Fix DKMS status check
    cp "$modxz" /var/lib/dkms/"$i"/*/"$kernelr"/x86_64/module/
    if ! diff -q /var/lib/dkms/"$i"/"$modver"/"$kernelr"/x86_64/module/"$ii".ko.xz "$modxz" >/dev/null 2>&1; then
    cp "$modxz" /var/lib/dkms/"$i"/"$modver"/"$kernelr"/x86_64/module/
    fi
    done
    done
  2. xabbu revised this gist Jun 29, 2019. 1 changed file with 9 additions and 7 deletions.
    16 changes: 9 additions & 7 deletions DKMS-signing.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -3,15 +3,17 @@
    # signing DKMS Modules
    #

    kernelr=$( dkms status -k "*-up" | head -n1 | grep -Eo '([1-9]).([0-9]|\.){3,}-([0-9])-up' )
    signkey="/mnt/SundP/kernel-signing/dkms-kernel-up-key.pem"

    kernelr=$( dkms status -k "*-up" | head -n1 | grep -Eo '[3-9].([0-9]|\.){3,}-[0-9]-up' )

    kernelp="/usr/lib/modules/$kernelr"

    for i in $( dkms status -k "*-up" | grep -Eo '^[[:alnum:]]*' ) ; do
    for i in $( dkms status -k "*-up" | grep installed | grep -Eo '^[[:alnum:]]([[:alnum:]]|_|-|\.)*' ) ; do

    for ii in $( grep -Eo '^BUILT_MODULE_NAME.*$' /usr/src/"$i"*/dkms.conf | grep -Eo '\"[[:alnum:]].*\"' | sed 's/"//g' ) ; do
    for ii in $( grep -Eo '^BUILT_MODULE_NAME.*$' /usr/src/"$i"-*/dkms.conf | grep -Eo '\"[[:alnum:]]([[:alnum:]]|_|-|\.)*\"' | sed 's/"//g' ) ; do

    pathm=$( grep -Eo '^DEST_MODULE_LOCATION.*$' /usr/src/"$i"*/dkms.conf | head -n1 | grep -Eo '\"/([[:alnum:]]|/).*\"' | sed 's/"//g' | sed 's/\/$//' )
    pathm=$( grep -Eo '^DEST_MODULE_LOCATION.*$' /usr/src/"$i"-*/dkms.conf | head -n1 | grep -Eo '\"/([[:alnum:]]|/).*\"' | sed 's/"//g' | sed 's/\/$//' )
    modxz="$kernelp$pathm/$ii.ko.xz"
    mod="$kernelp$pathm/$ii.ko"
    #ls "$modxz"
    @@ -24,11 +26,11 @@ for i in $( dkms status -k "*-up" | grep -Eo '^[[:alnum:]]*' ) ; do
    if ! grep "~Module signature appended~" "$mod" > /dev/null 2>&1; then
    echo "Sign $mod"
    # sign
    "/usr/lib/modules/$kernelr/build/scripts/sign-file" sha512 /mnt/SundP/kernel-signing/dkms-kernel-up-key.pem /mnt/SundP/kernel-signing/dkms-kernel-up-key.pem "$mod"
    "/usr/lib/modules/$kernelr/build/scripts/sign-file" sha512 "$signkey" "$signkey" "$mod"
    fi
    #compress
    xz "$mod"
    # Fix DKMS status check
    cp "$modxz" /var/lib/dkms/"$i"*/*/"$kernelr"/x86_64/module/
    cp "$modxz" /var/lib/dkms/"$i"/*/"$kernelr"/x86_64/module/
    done
    done
    done
  3. xabbu created this gist Jun 28, 2019.
    14 changes: 14 additions & 0 deletions 72-dkms-signing.hook
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,14 @@
    [Trigger]
    Operation = Install
    Operation = Upgrade
    Type = File
    Target = usr/src/*/dkms.conf
    Target = usr/lib/modules/*-up/build/include/
    Target = usr/lib/modules/*-up/modules.alias

    [Action]
    Description = Signing DKMS modules
    Depends = dkms
    When = PostTransaction
    Exec = /usr/local/bin/DKMS-signing.sh
    NeedsTargets
    34 changes: 34 additions & 0 deletions DKMS-signing.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,34 @@
    #!/usr/bin/bash
    #
    # signing DKMS Modules
    #

    kernelr=$( dkms status -k "*-up" | head -n1 | grep -Eo '([1-9]).([0-9]|\.){3,}-([0-9])-up' )

    kernelp="/usr/lib/modules/$kernelr"

    for i in $( dkms status -k "*-up" | grep -Eo '^[[:alnum:]]*' ) ; do

    for ii in $( grep -Eo '^BUILT_MODULE_NAME.*$' /usr/src/"$i"*/dkms.conf | grep -Eo '\"[[:alnum:]].*\"' | sed 's/"//g' ) ; do

    pathm=$( grep -Eo '^DEST_MODULE_LOCATION.*$' /usr/src/"$i"*/dkms.conf | head -n1 | grep -Eo '\"/([[:alnum:]]|/).*\"' | sed 's/"//g' | sed 's/\/$//' )
    modxz="$kernelp$pathm/$ii.ko.xz"
    mod="$kernelp$pathm/$ii.ko"
    #ls "$modxz"
    if [ ! -f "$modxz" ]; then
    echo "$modxz not available"
    continue
    fi
    # extract
    unxz "$modxz"
    if ! grep "~Module signature appended~" "$mod" > /dev/null 2>&1; then
    echo "Sign $mod"
    # sign
    "/usr/lib/modules/$kernelr/build/scripts/sign-file" sha512 /mnt/SundP/kernel-signing/dkms-kernel-up-key.pem /mnt/SundP/kernel-signing/dkms-kernel-up-key.pem "$mod"
    fi
    #compress
    xz "$mod"
    # Fix DKMS status check
    cp "$modxz" /var/lib/dkms/"$i"*/*/"$kernelr"/x86_64/module/
    done
    done