Re: [OE-core][PATCH v3] kernel.bbclass: add strip process for signed kernel modules

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Thu, 2026-08-13 at 21:17 +0200, Anis Bougrine via lists.openembedded.org wrote:
> Currently, signed kernel modules skip the stripping process in order
> to preserve the file contents after signing. See commit:
> 4c47e5f171fa2603355e2f9183065ce8137a18c7
> 
> However, the kernel install Makefile supports stripping modules before
> signing them. This allows signed modules to be stripped while preserving
> a valid signature.
> 
> Make non-signed kernel modules follow the standard Yocto stripping flow,
> while signed kernel modules use the kernel Makefile stripping flow.
> 
> Fixes [YOCTO #12927]
> 
> Reported-by: ross.burton@arm.com
> Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com>
> Cc: Antonin Godard <antonin.godard@bootlin.com>
> Cc: Bruce Ashfield <bruce.ashfield@gmail.com>
> Cc: Jose Quaresma <jose.quaresma@oss.qualcomm.com>
> ---
> changes in v3:
> 
> - Fixing rebase issue.
> 
> changes in v2:
> 
> - Use the conditional INSTALL_MOD_STRIP environment variable to avoid
>   duplicating the oe_runmake call.
> - Use `scripts/config` script instead of grepping .config file.
> ---
>  meta/classes-recipe/kernel.bbclass | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
> index a82bdf7ecb..0998de1548 100644
> --- a/meta/classes-recipe/kernel.bbclass
> +++ b/meta/classes-recipe/kernel.bbclass
> @@ -451,8 +451,12 @@ kernel_do_install() {
>  	#
>  	# First install the modules
>  	#
> -	unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE
> +	unset CFLAGS CPPFLAGS CXXFLAGS INSTALL_MOD_STRIP LDFLAGS MACHINE
>  	if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
> +		# If the module will be auto-signed, perform stripping before signing.
> +		if [ "$(${S}/scripts/config --state MODULE_SIG)" = "y" ] && [ "$(${S}/scripts/config --state MODULE_SIG_ALL)" = "y" ]; then
> +			export INSTALL_MOD_STRIP="--strip-debug --remove-section=.comment --remove-section=.note --preserve-dates"
> +		fi
>  		oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install
>  		rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build"
>  		rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source"

There is another issue. If you strip the modules here, we lose all the
debug symbol information later in the build. That doesn't sound so
important until you realise we use the debug information to feed into
the SPDX and it is then used for checking for CVE issues. I'm not sure
we can afford to do that...

Cheers,

Richard