* [OE-core][PATCH v3] kernel.bbclass: add strip process for signed kernel modules @ 2026-08-13 19:17 Anis Bougrine 2026-08-20 8:50 ` Richard Purdie 0 siblings, 1 reply; 3+ messages in thread From: Anis Bougrine @ 2026-08-13 19:17 UTC (permalink / raw) To: openembedded-core Cc: Anis Bougrine, ross.burton, Antonin Godard, Bruce Ashfield, Jose Quaresma Currently, signed kernel modules skip the stripping process in order to preserve the file contents after signing. See commit: 4c47e5f171fa2603355e2f9183065ce8137a18c7 However, the kernel install Makefile supports stripping modules before signing them. This allows signed modules to be stripped while preserving a valid signature. Make non-signed kernel modules follow the standard Yocto stripping flow, while signed kernel modules use the kernel Makefile stripping flow. Fixes [YOCTO #12927] Reported-by: ross.burton@arm.com Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com> Cc: Antonin Godard <antonin.godard@bootlin.com> Cc: Bruce Ashfield <bruce.ashfield@gmail.com> Cc: Jose Quaresma <jose.quaresma@oss.qualcomm.com> --- changes in v3: - Fixing rebase issue. changes in v2: - Use the conditional INSTALL_MOD_STRIP environment variable to avoid duplicating the oe_runmake call. - Use `scripts/config` script instead of grepping .config file. --- meta/classes-recipe/kernel.bbclass | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass index a82bdf7ecb..0998de1548 100644 --- a/meta/classes-recipe/kernel.bbclass +++ b/meta/classes-recipe/kernel.bbclass @@ -451,8 +451,12 @@ kernel_do_install() { # # First install the modules # - unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE + unset CFLAGS CPPFLAGS CXXFLAGS INSTALL_MOD_STRIP LDFLAGS MACHINE if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then + # If the module will be auto-signed, perform stripping before signing. + if [ "$(${S}/scripts/config --state MODULE_SIG)" = "y" ] && [ "$(${S}/scripts/config --state MODULE_SIG_ALL)" = "y" ]; then + export INSTALL_MOD_STRIP="--strip-debug --remove-section=.comment --remove-section=.note --preserve-dates" + fi oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build" rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source" -- 2.50.1 (Apple Git-155) ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [OE-core][PATCH v3] kernel.bbclass: add strip process for signed kernel modules 2026-08-13 19:17 [OE-core][PATCH v3] kernel.bbclass: add strip process for signed kernel modules Anis Bougrine @ 2026-08-20 8:50 ` Richard Purdie 2026-08-21 11:20 ` Bougrine Anis 0 siblings, 1 reply; 3+ messages in thread From: Richard Purdie @ 2026-08-20 8:50 UTC (permalink / raw) To: anis.bougrine10, openembedded-core Cc: ross.burton, Antonin Godard, Bruce Ashfield, Jose Quaresma On Thu, 2026-08-13 at 21:17 +0200, Anis Bougrine via lists.openembedded.org wrote: > Currently, signed kernel modules skip the stripping process in order > to preserve the file contents after signing. See commit: > 4c47e5f171fa2603355e2f9183065ce8137a18c7 > > However, the kernel install Makefile supports stripping modules before > signing them. This allows signed modules to be stripped while preserving > a valid signature. > > Make non-signed kernel modules follow the standard Yocto stripping flow, > while signed kernel modules use the kernel Makefile stripping flow. > > Fixes [YOCTO #12927] > > Reported-by: ross.burton@arm.com > Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com> > Cc: Antonin Godard <antonin.godard@bootlin.com> > Cc: Bruce Ashfield <bruce.ashfield@gmail.com> > Cc: Jose Quaresma <jose.quaresma@oss.qualcomm.com> > --- > changes in v3: > > - Fixing rebase issue. > > changes in v2: > > - Use the conditional INSTALL_MOD_STRIP environment variable to avoid > duplicating the oe_runmake call. > - Use `scripts/config` script instead of grepping .config file. > --- > meta/classes-recipe/kernel.bbclass | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass > index a82bdf7ecb..0998de1548 100644 > --- a/meta/classes-recipe/kernel.bbclass > +++ b/meta/classes-recipe/kernel.bbclass > @@ -451,8 +451,12 @@ kernel_do_install() { > # > # First install the modules > # > - unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE > + unset CFLAGS CPPFLAGS CXXFLAGS INSTALL_MOD_STRIP LDFLAGS MACHINE > if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then > + # If the module will be auto-signed, perform stripping before signing. > + if [ "$(${S}/scripts/config --state MODULE_SIG)" = "y" ] && [ "$(${S}/scripts/config --state MODULE_SIG_ALL)" = "y" ]; then > + export INSTALL_MOD_STRIP="--strip-debug --remove-section=.comment --remove-section=.note --preserve-dates" > + fi > oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install > rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build" > rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source" There is another issue. If you strip the modules here, we lose all the debug symbol information later in the build. That doesn't sound so important until you realise we use the debug information to feed into the SPDX and it is then used for checking for CVE issues. I'm not sure we can afford to do that... Cheers, Richard ^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [OE-core][PATCH v3] kernel.bbclass: add strip process for signed kernel modules 2026-08-20 8:50 ` Richard Purdie @ 2026-08-21 11:20 ` Bougrine Anis 0 siblings, 0 replies; 3+ messages in thread From: Bougrine Anis @ 2026-08-21 11:20 UTC (permalink / raw) To: Richard Purdie Cc: openembedded-core, ross.burton, Antonin Godard, Bruce Ashfield, Jose Quaresma [-- Attachment #1: Type: text/plain, Size: 4613 bytes --] Hello Richard, Thank you, I appreciate your feedback. However, I still cannot see the connection between the .debug files and SPDX generation. Perhaps there is something I am missing. In any case, you are right. I believe the best approach is to sign the modules without impacting the existing build workflow, although the module packaging workflow is already affected because signed modules skip process_split_and_strip_files in the do_package task (see 4c47e5f). I have looked for a better way to do this and found a window in the packaging workflow where we can re-sign the modules after the stripping process and before the package split. The window I am referring to is between process_split_and_strip_files and split_kernel_module_packages. This can be achieved by prepending a re-signing function to PACKAGESPLITFUNCS. At this point, the modules are located under ${PKGD}, with the same directory structure they had under ${D}, where they were initially signed. Therefore, re-signing them is straightforward. I tested something like the following after removing the skip of the splitting and stripping steps for signed modules in package.py: In kernel-module-split.bbclass: ... PACKAGESPLITFUNCS =+ "do_resign_modules" do_resign_modules(){ oe_runmake -C ${B} \ MODVERDIR=${B}/.tmp_versions \ MODLIB=${PKGD}/lib/modules/${KERNEL_VERSION} \ modules_sign } ... This successfully strips and then signs the kernel modules. If you are OK with this approach, I can submit a v4 patch. BR, Anis On Thu, Aug 20, 2026 at 10:51 AM Richard Purdie < richard.purdie@linuxfoundation.org> wrote: > On Thu, 2026-08-13 at 21:17 +0200, Anis Bougrine via > lists.openembedded.org wrote: > > Currently, signed kernel modules skip the stripping process in order > > to preserve the file contents after signing. See commit: > > 4c47e5f171fa2603355e2f9183065ce8137a18c7 > > > > However, the kernel install Makefile supports stripping modules before > > signing them. This allows signed modules to be stripped while preserving > > a valid signature. > > > > Make non-signed kernel modules follow the standard Yocto stripping flow, > > while signed kernel modules use the kernel Makefile stripping flow. > > > > Fixes [YOCTO #12927] > > > > Reported-by: ross.burton@arm.com > > Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com> > > Cc: Antonin Godard <antonin.godard@bootlin.com> > > Cc: Bruce Ashfield <bruce.ashfield@gmail.com> > > Cc: Jose Quaresma <jose.quaresma@oss.qualcomm.com> > > --- > > changes in v3: > > > > - Fixing rebase issue. > > > > changes in v2: > > > > - Use the conditional INSTALL_MOD_STRIP environment variable to avoid > > duplicating the oe_runmake call. > > - Use `scripts/config` script instead of grepping .config file. > > --- > > meta/classes-recipe/kernel.bbclass | 6 +++++- > > 1 file changed, 5 insertions(+), 1 deletion(-) > > > > diff --git a/meta/classes-recipe/kernel.bbclass > b/meta/classes-recipe/kernel.bbclass > > index a82bdf7ecb..0998de1548 100644 > > --- a/meta/classes-recipe/kernel.bbclass > > +++ b/meta/classes-recipe/kernel.bbclass > > @@ -451,8 +451,12 @@ kernel_do_install() { > > # > > # First install the modules > > # > > - unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE > > + unset CFLAGS CPPFLAGS CXXFLAGS INSTALL_MOD_STRIP LDFLAGS MACHINE > > if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then > > + # If the module will be auto-signed, perform stripping > before signing. > > + if [ "$(${S}/scripts/config --state MODULE_SIG)" = "y" ] > && [ "$(${S}/scripts/config --state MODULE_SIG_ALL)" = "y" ]; then > > + export INSTALL_MOD_STRIP="--strip-debug > --remove-section=.comment --remove-section=.note --preserve-dates" > > + fi > > oe_runmake DEPMOD=echo > MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} > INSTALL_FW_PATH=${D}${firmwaredir} modules_install > > rm -f > "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build" > > rm -f > "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source" > > There is another issue. If you strip the modules here, we lose all the > debug symbol information later in the build. That doesn't sound so > important until you realise we use the debug information to feed into > the SPDX and it is then used for checking for CVE issues. I'm not sure > we can afford to do that... > > Cheers, > > Richard > > > > [-- Attachment #2: Type: text/html, Size: 5947 bytes --] ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-21 11:21 UTC | newest] Thread overview: 3+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-08-13 19:17 [OE-core][PATCH v3] kernel.bbclass: add strip process for signed kernel modules Anis Bougrine 2026-08-20 8:50 ` Richard Purdie 2026-08-21 11:20 ` Bougrine Anis
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.