[OE-core][PATCH v3] kernel.bbclass: add strip process for signed kernel modules

[OE-core][PATCH v3] kernel.bbclass: add strip process for signed kernel modules

[Anis Bougrine]

Currently, signed kernel modules skip the stripping process in order
to preserve the file contents after signing. See commit:
4c47e5f171fa2603355e2f9183065ce8137a18c7

However, the kernel install Makefile supports stripping modules before
signing them. This allows signed modules to be stripped while preserving
a valid signature.

Make non-signed kernel modules follow the standard Yocto stripping flow,
while signed kernel modules use the kernel Makefile stripping flow.

Fixes [YOCTO #12927]

Reported-by: ross.burton@arm.com
Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com>
Cc: Antonin Godard <antonin.godard@bootlin.com>
Cc: Bruce Ashfield <bruce.ashfield@gmail.com>
Cc: Jose Quaresma <jose.quaresma@oss.qualcomm.com>
---
changes in v3:

- Fixing rebase issue.

changes in v2:

- Use the conditional INSTALL_MOD_STRIP environment variable to avoid
  duplicating the oe_runmake call.
- Use `scripts/config` script instead of grepping .config file.
---
 meta/classes-recipe/kernel.bbclass | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
index a82bdf7ecb..0998de1548 100644
--- a/meta/classes-recipe/kernel.bbclass
+++ b/meta/classes-recipe/kernel.bbclass
@@ -451,8 +451,12 @@ kernel_do_install() {
 	#
 	# First install the modules
 	#
-	unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE
+	unset CFLAGS CPPFLAGS CXXFLAGS INSTALL_MOD_STRIP LDFLAGS MACHINE
 	if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
+		# If the module will be auto-signed, perform stripping before signing.
+		if [ "$(${S}/scripts/config --state MODULE_SIG)" = "y" ] && [ "$(${S}/scripts/config --state MODULE_SIG_ALL)" = "y" ]; then
+			export INSTALL_MOD_STRIP="--strip-debug --remove-section=.comment --remove-section=.note --preserve-dates"
+		fi
 		oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install
 		rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build"
 		rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source"
-- 
2.50.1 (Apple Git-155)

Re: [OE-core][PATCH v3] kernel.bbclass: add strip process for signed kernel modules

[Richard Purdie]

On Thu, 2026-08-13 at 21:17 +0200, Anis Bougrine via lists.openembedded.org wrote:
> Currently, signed kernel modules skip the stripping process in order
> to preserve the file contents after signing. See commit:
> 4c47e5f171fa2603355e2f9183065ce8137a18c7
> 
> However, the kernel install Makefile supports stripping modules before
> signing them. This allows signed modules to be stripped while preserving
> a valid signature.
> 
> Make non-signed kernel modules follow the standard Yocto stripping flow,
> while signed kernel modules use the kernel Makefile stripping flow.
> 
> Fixes [YOCTO #12927]
> 
> Reported-by: ross.burton@arm.com
> Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com>
> Cc: Antonin Godard <antonin.godard@bootlin.com>
> Cc: Bruce Ashfield <bruce.ashfield@gmail.com>
> Cc: Jose Quaresma <jose.quaresma@oss.qualcomm.com>
> ---
> changes in v3:
> 
> - Fixing rebase issue.
> 
> changes in v2:
> 
> - Use the conditional INSTALL_MOD_STRIP environment variable to avoid
>   duplicating the oe_runmake call.
> - Use `scripts/config` script instead of grepping .config file.
> ---
>  meta/classes-recipe/kernel.bbclass | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
> index a82bdf7ecb..0998de1548 100644
> --- a/meta/classes-recipe/kernel.bbclass
> +++ b/meta/classes-recipe/kernel.bbclass
> @@ -451,8 +451,12 @@ kernel_do_install() {
>  	#
>  	# First install the modules
>  	#
> -	unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE
> +	unset CFLAGS CPPFLAGS CXXFLAGS INSTALL_MOD_STRIP LDFLAGS MACHINE
>  	if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
> +		# If the module will be auto-signed, perform stripping before signing.
> +		if [ "$(${S}/scripts/config --state MODULE_SIG)" = "y" ] && [ "$(${S}/scripts/config --state MODULE_SIG_ALL)" = "y" ]; then
> +			export INSTALL_MOD_STRIP="--strip-debug --remove-section=.comment --remove-section=.note --preserve-dates"
> +		fi
>  		oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install
>  		rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build"
>  		rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source"

There is another issue. If you strip the modules here, we lose all the
debug symbol information later in the build. That doesn't sound so
important until you realise we use the debug information to feed into
the SPDX and it is then used for checking for CVE issues. I'm not sure
we can afford to do that...

Cheers,

Richard

Re: [OE-core][PATCH v3] kernel.bbclass: add strip process for signed kernel modules

[Bougrine Anis]

[-- Attachment #1: Type: text/plain, Size: 4613 bytes --]

Hello Richard,

Thank you, I appreciate your feedback.

However, I still cannot see the connection between the .debug files and
SPDX generation. Perhaps there is something I am missing.
In any case, you are right. I believe the best approach is to sign the
modules without impacting the existing build workflow, although the module
packaging workflow is already affected because signed modules skip
process_split_and_strip_files in the do_package task (see 4c47e5f).

I have looked for a better way to do this and found a window in the
packaging workflow where we can re-sign the modules after the stripping
process and before the package split.
The window I am referring to is between process_split_and_strip_files and
split_kernel_module_packages. This can be achieved by prepending a
re-signing function to PACKAGESPLITFUNCS.

At this point, the modules are located under ${PKGD}, with the same
directory structure they had under ${D}, where they were initially signed.
Therefore, re-signing them is straightforward.
I tested something like the following after removing the skip of the
splitting and stripping steps for signed modules in package.py:

In kernel-module-split.bbclass:
...

PACKAGESPLITFUNCS =+ "do_resign_modules"
do_resign_modules(){
    oe_runmake -C ${B} \
        MODVERDIR=${B}/.tmp_versions \
        MODLIB=${PKGD}/lib/modules/${KERNEL_VERSION} \
        modules_sign
}

...

This successfully strips and then signs the kernel modules.
If you are OK with this approach, I can submit a v4 patch.

BR,
Anis

On Thu, Aug 20, 2026 at 10:51 AM Richard Purdie <
richard.purdie@linuxfoundation.org> wrote:

> On Thu, 2026-08-13 at 21:17 +0200, Anis Bougrine via
> lists.openembedded.org wrote:
> > Currently, signed kernel modules skip the stripping process in order
> > to preserve the file contents after signing. See commit:
> > 4c47e5f171fa2603355e2f9183065ce8137a18c7
> >
> > However, the kernel install Makefile supports stripping modules before
> > signing them. This allows signed modules to be stripped while preserving
> > a valid signature.
> >
> > Make non-signed kernel modules follow the standard Yocto stripping flow,
> > while signed kernel modules use the kernel Makefile stripping flow.
> >
> > Fixes [YOCTO #12927]
> >
> > Reported-by: ross.burton@arm.com
> > Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com>
> > Cc: Antonin Godard <antonin.godard@bootlin.com>
> > Cc: Bruce Ashfield <bruce.ashfield@gmail.com>
> > Cc: Jose Quaresma <jose.quaresma@oss.qualcomm.com>
> > ---
> > changes in v3:
> >
> > - Fixing rebase issue.
> >
> > changes in v2:
> >
> > - Use the conditional INSTALL_MOD_STRIP environment variable to avoid
> >   duplicating the oe_runmake call.
> > - Use `scripts/config` script instead of grepping .config file.
> > ---
> >  meta/classes-recipe/kernel.bbclass | 6 +++++-
> >  1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/meta/classes-recipe/kernel.bbclass
> b/meta/classes-recipe/kernel.bbclass
> > index a82bdf7ecb..0998de1548 100644
> > --- a/meta/classes-recipe/kernel.bbclass
> > +++ b/meta/classes-recipe/kernel.bbclass
> > @@ -451,8 +451,12 @@ kernel_do_install() {
> >       #
> >       # First install the modules
> >       #
> > -     unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE
> > +     unset CFLAGS CPPFLAGS CXXFLAGS INSTALL_MOD_STRIP LDFLAGS MACHINE
> >       if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
> > +             # If the module will be auto-signed, perform stripping
> before signing.
> > +             if [ "$(${S}/scripts/config --state MODULE_SIG)" = "y" ]
> && [ "$(${S}/scripts/config --state MODULE_SIG_ALL)" = "y" ]; then
> > +                     export INSTALL_MOD_STRIP="--strip-debug
> --remove-section=.comment --remove-section=.note --preserve-dates"
> > +             fi
> >               oe_runmake DEPMOD=echo
> MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}
> INSTALL_FW_PATH=${D}${firmwaredir} modules_install
> >               rm -f
> "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build"
> >               rm -f
> "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source"
>
> There is another issue. If you strip the modules here, we lose all the
> debug symbol information later in the build. That doesn't sound so
> important until you realise we use the debug information to feed into
> the SPDX and it is then used for checking for CVE issues. I'm not sure
> we can afford to do that...
>
> Cheers,
>
> Richard
>
>
>
>

[-- Attachment #2: Type: text/html, Size: 5947 bytes --]