* [OE-core] [PATCH] kernel.bbclass: add strip process for signed kernel modules @ 2026-08-12 13:06 Anis Bougrine 2026-08-12 13:26 ` Bruce Ashfield 2026-08-12 13:50 ` Antonin Godard 0 siblings, 2 replies; 5+ messages in thread From: Anis Bougrine @ 2026-08-12 13:06 UTC (permalink / raw) To: openembedded-core; +Cc: Anis Bougrine, ross.burton Currently, signed kernel modules skip the stripping process in order to preserve the file contents after signing. See commit: 4c47e5f171fa2603355e2f9183065ce8137a18c7 However, the kernel install Makefile supports stripping modules before signing them. This allows signed modules to be stripped while preserving a valid signature. Make non-signed kernel modules follow the standard Yocto stripping flow, while signed kernel modules use the kernel Makefile stripping flow. Fixes [YOCTO #12927] Reported-by: ross.burton@arm.com Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com> --- meta/classes-recipe/kernel.bbclass | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass index a82bdf7ecb..0d8d370e9d 100644 --- a/meta/classes-recipe/kernel.bbclass +++ b/meta/classes-recipe/kernel.bbclass @@ -453,7 +453,21 @@ kernel_do_install() { # unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then - oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install + # If the module will be auto-signed, perform stripping before signing. + if grep -q '^CONFIG_MODULE_SIG=y$' .config && grep -q '^CONFIG_MODULE_SIG_ALL=y$' .config; then + oe_runmake \ + INSTALL_MOD_STRIP="--strip-debug --remove-section=.comment --remove-section=.note --preserve-dates" \ + DEPMOD=echo \ + MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \ + INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware \ + modules_install + else + oe_runmake \ + DEPMOD=echo \ + MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \ + INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware \ + modules_install + fi rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build" rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source" # Remove empty module directories to prevent QA issues -- 2.50.1 (Apple Git-155) ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [OE-core] [PATCH] kernel.bbclass: add strip process for signed kernel modules 2026-08-12 13:06 [OE-core] [PATCH] kernel.bbclass: add strip process for signed kernel modules Anis Bougrine @ 2026-08-12 13:26 ` Bruce Ashfield 2026-08-12 15:40 ` Bougrine Anis 2026-08-12 13:50 ` Antonin Godard 1 sibling, 1 reply; 5+ messages in thread From: Bruce Ashfield @ 2026-08-12 13:26 UTC (permalink / raw) To: anis.bougrine10; +Cc: openembedded-core, ross.burton On Wed, Aug 12, 2026 at 9:07 AM Anis Bougrine via lists.openembedded.org <anis.bougrine10=gmail.com@lists.openembedded.org> wrote: > > Currently, signed kernel modules skip the stripping process in order > to preserve the file contents after signing. See commit: > 4c47e5f171fa2603355e2f9183065ce8137a18c7 > > However, the kernel install Makefile supports stripping modules before > signing them. This allows signed modules to be stripped while preserving > a valid signature. > > Make non-signed kernel modules follow the standard Yocto stripping flow, > while signed kernel modules use the kernel Makefile stripping flow. > > Fixes [YOCTO #12927] > > Reported-by: ross.burton@arm.com > Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com> > --- > meta/classes-recipe/kernel.bbclass | 16 +++++++++++++++- > 1 file changed, 15 insertions(+), 1 deletion(-) > > diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass > index a82bdf7ecb..0d8d370e9d 100644 > --- a/meta/classes-recipe/kernel.bbclass > +++ b/meta/classes-recipe/kernel.bbclass > @@ -453,7 +453,21 @@ kernel_do_install() { > # > unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE > if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then > - oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install > + # If the module will be auto-signed, perform stripping before signing. > + if grep -q '^CONFIG_MODULE_SIG=y$' .config && grep -q '^CONFIG_MODULE_SIG_ALL=y$' .config; then > + oe_runmake \ > + INSTALL_MOD_STRIP="--strip-debug --remove-section=.comment --remove-section=.note --preserve-dates" \ > + DEPMOD=echo \ > + MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \ > + INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware \ > + modules_install > + else > + oe_runmake \ > + DEPMOD=echo \ > + MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \ > + INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware \ > + modules_install Am I misreading the patch (it has been known to happen :)) ? is the only differnece between the two conditions the INSTALL_MOD_STRIP ? if so, why not just use a variable and put $INSTALL_MOD_STRIP (or whatever) in the oe_runmake line ? Better to have the variable be conditional, than duplicating the actual call to strip the modules. Bruce > + fi > rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build" > rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source" > # Remove empty module directories to prevent QA issues > -- > 2.50.1 (Apple Git-155) > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#243287): https://lists.openembedded.org/g/openembedded-core/message/243287 > Mute This Topic: https://lists.openembedded.org/mt/120717114/1050810 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [bruce.ashfield@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- > -- - Thou shalt not follow the NULL pointer, for chaos and madness await thee at its end - "Use the force Harry" - Gandalf, Star Trek II ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [OE-core] [PATCH] kernel.bbclass: add strip process for signed kernel modules 2026-08-12 13:26 ` Bruce Ashfield @ 2026-08-12 15:40 ` Bougrine Anis 0 siblings, 0 replies; 5+ messages in thread From: Bougrine Anis @ 2026-08-12 15:40 UTC (permalink / raw) To: Bruce Ashfield; +Cc: openembedded-core, ross.burton [-- Attachment #1: Type: text/plain, Size: 4904 bytes --] Hi Bruce, You are correct, INSTALL_MOD_STRIP is the only difference between the two branches. I initially tried using a variable as you suggested, but had issues with the variable expansion when passing the strip options to the kernel Makefile. Using an environment variable keeps a single oe_runmake call: if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then # If the module will be auto-signed, perform stripping before signing. if [ "$(./source/scripts/config --file ./.config --state MODULE_SIG)" = y ] && [ "$(./source/scripts/config --file ./.config --state MODULE_SIG_ALL)" = y ]; then export INSTALL_MOD_STRIP="--strip-debug --remove-section=.comment --remove-section=.note --preserve-dates" fi oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware modules_install fi If you are okay with this approach, I can send v2. BR, Anis On Wed, Aug 12, 2026 at 3:26 PM Bruce Ashfield <bruce.ashfield@gmail.com> wrote: > On Wed, Aug 12, 2026 at 9:07 AM Anis Bougrine via > lists.openembedded.org > <anis.bougrine10=gmail.com@lists.openembedded.org> wrote: > > > > Currently, signed kernel modules skip the stripping process in order > > to preserve the file contents after signing. See commit: > > 4c47e5f171fa2603355e2f9183065ce8137a18c7 > > > > However, the kernel install Makefile supports stripping modules before > > signing them. This allows signed modules to be stripped while preserving > > a valid signature. > > > > Make non-signed kernel modules follow the standard Yocto stripping flow, > > while signed kernel modules use the kernel Makefile stripping flow. > > > > Fixes [YOCTO #12927] > > > > Reported-by: ross.burton@arm.com > > Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com> > > --- > > meta/classes-recipe/kernel.bbclass | 16 +++++++++++++++- > > 1 file changed, 15 insertions(+), 1 deletion(-) > > > > diff --git a/meta/classes-recipe/kernel.bbclass > b/meta/classes-recipe/kernel.bbclass > > index a82bdf7ecb..0d8d370e9d 100644 > > --- a/meta/classes-recipe/kernel.bbclass > > +++ b/meta/classes-recipe/kernel.bbclass > > @@ -453,7 +453,21 @@ kernel_do_install() { > > # > > unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE > > if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then > > - oe_runmake DEPMOD=echo > MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} > INSTALL_FW_PATH=${D}${firmwaredir} modules_install > > + # If the module will be auto-signed, perform stripping > before signing. > > + if grep -q '^CONFIG_MODULE_SIG=y$' .config && grep -q > '^CONFIG_MODULE_SIG_ALL=y$' .config; then > > + oe_runmake \ > > + INSTALL_MOD_STRIP="--strip-debug > --remove-section=.comment --remove-section=.note --preserve-dates" \ > > + DEPMOD=echo \ > > + > MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \ > > + > INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware \ > > + modules_install > > + else > > + oe_runmake \ > > + DEPMOD=echo \ > > + > MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \ > > + > INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware \ > > + modules_install > > Am I misreading the patch (it has been known to happen :)) ? is the > only differnece > between the two conditions the INSTALL_MOD_STRIP ? if so, why not just use > a > variable and put $INSTALL_MOD_STRIP (or whatever) in the oe_runmake line ? > > Better to have the variable be conditional, than duplicating the > actual call to strip > the modules. > > Bruce > > > + fi > > rm -f > "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build" > > rm -f > "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source" > > # Remove empty module directories to prevent QA issues > > -- > > 2.50.1 (Apple Git-155) > > > > > > -=-=-=-=-=-=-=-=-=-=-=- > > Links: You receive all messages sent to this group. > > View/Reply Online (#243287): > https://lists.openembedded.org/g/openembedded-core/message/243287 > > Mute This Topic: https://lists.openembedded.org/mt/120717114/1050810 > > Group Owner: openembedded-core+owner@lists.openembedded.org > > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [ > bruce.ashfield@gmail.com] > > -=-=-=-=-=-=-=-=-=-=-=- > > > > > -- > - Thou shalt not follow the NULL pointer, for chaos and madness await > thee at its end > - "Use the force Harry" - Gandalf, Star Trek II > [-- Attachment #2: Type: text/html, Size: 6833 bytes --] ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [OE-core] [PATCH] kernel.bbclass: add strip process for signed kernel modules 2026-08-12 13:06 [OE-core] [PATCH] kernel.bbclass: add strip process for signed kernel modules Anis Bougrine 2026-08-12 13:26 ` Bruce Ashfield @ 2026-08-12 13:50 ` Antonin Godard 2026-08-12 15:46 ` Bougrine Anis 1 sibling, 1 reply; 5+ messages in thread From: Antonin Godard @ 2026-08-12 13:50 UTC (permalink / raw) To: anis.bougrine10, openembedded-core; +Cc: ross.burton Hi, On Wed Aug 12, 2026 at 3:06 PM CEST, Anis Bougrine via lists.openembedded.org wrote: > Currently, signed kernel modules skip the stripping process in order > to preserve the file contents after signing. See commit: > 4c47e5f171fa2603355e2f9183065ce8137a18c7 > > However, the kernel install Makefile supports stripping modules before > signing them. This allows signed modules to be stripped while preserving > a valid signature. > > Make non-signed kernel modules follow the standard Yocto stripping flow, > while signed kernel modules use the kernel Makefile stripping flow. > > Fixes [YOCTO #12927] > > Reported-by: ross.burton@arm.com > Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com> > --- > meta/classes-recipe/kernel.bbclass | 16 +++++++++++++++- > 1 file changed, 15 insertions(+), 1 deletion(-) > > diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass > index a82bdf7ecb..0d8d370e9d 100644 > --- a/meta/classes-recipe/kernel.bbclass > +++ b/meta/classes-recipe/kernel.bbclass > @@ -453,7 +453,21 @@ kernel_do_install() { > # > unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE > if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then > - oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install > + # If the module will be auto-signed, perform stripping before signing. > + if grep -q '^CONFIG_MODULE_SIG=y$' .config && grep -q '^CONFIG_MODULE_SIG_ALL=y$' .config; then Suggestion: you can use the kernel's scripts/config utility to get the option values: $ ./scripts/config --file ./.config --state MODULE_SIG y So that you really see the option value as the kernel sees it. Antonin ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [OE-core] [PATCH] kernel.bbclass: add strip process for signed kernel modules 2026-08-12 13:50 ` Antonin Godard @ 2026-08-12 15:46 ` Bougrine Anis 0 siblings, 0 replies; 5+ messages in thread From: Bougrine Anis @ 2026-08-12 15:46 UTC (permalink / raw) To: Antonin Godard; +Cc: openembedded-core, ross.burton [-- Attachment #1: Type: text/plain, Size: 2944 bytes --] Hi Antonin, I took your suggestion into account. A v2 patch may look like this: if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then # If the module will be auto-signed, perform stripping before signing. if [ "$(./source/scripts/config --file ./.config --state MODULE_SIG)" = y ] && [ "$(./source/scripts/config --file ./.config --state MODULE_SIG_ALL)" = y ]; then export INSTALL_MOD_STRIP="--strip-debug --remove-section=.comment --remove-section=.note --preserve-dates" fi oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware modules_install fi However, I think grepping the .config file is more reliable, since its location inside ${WORKDIR} is more stable than the location of the config script. I stay open to any further suggestions. BR, Anis On Wed, Aug 12, 2026 at 3:50 PM Antonin Godard <antonin.godard@bootlin.com> wrote: > Hi, > > On Wed Aug 12, 2026 at 3:06 PM CEST, Anis Bougrine via > lists.openembedded.org wrote: > > Currently, signed kernel modules skip the stripping process in order > > to preserve the file contents after signing. See commit: > > 4c47e5f171fa2603355e2f9183065ce8137a18c7 > > > > However, the kernel install Makefile supports stripping modules before > > signing them. This allows signed modules to be stripped while preserving > > a valid signature. > > > > Make non-signed kernel modules follow the standard Yocto stripping flow, > > while signed kernel modules use the kernel Makefile stripping flow. > > > > Fixes [YOCTO #12927] > > > > Reported-by: ross.burton@arm.com > > Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com> > > --- > > meta/classes-recipe/kernel.bbclass | 16 +++++++++++++++- > > 1 file changed, 15 insertions(+), 1 deletion(-) > > > > diff --git a/meta/classes-recipe/kernel.bbclass > b/meta/classes-recipe/kernel.bbclass > > index a82bdf7ecb..0d8d370e9d 100644 > > --- a/meta/classes-recipe/kernel.bbclass > > +++ b/meta/classes-recipe/kernel.bbclass > > @@ -453,7 +453,21 @@ kernel_do_install() { > > # > > unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE > > if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then > > - oe_runmake DEPMOD=echo > MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} > INSTALL_FW_PATH=${D}${firmwaredir} modules_install > > + # If the module will be auto-signed, perform stripping > before signing. > > + if grep -q '^CONFIG_MODULE_SIG=y$' .config && grep -q > '^CONFIG_MODULE_SIG_ALL=y$' .config; then > > Suggestion: you can use the kernel's scripts/config utility to get the > option > values: > > $ ./scripts/config --file ./.config --state MODULE_SIG > y > > So that you really see the option value as the kernel sees it. > > Antonin > [-- Attachment #2: Type: text/html, Size: 5215 bytes --] ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-08-12 15:47 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-08-12 13:06 [OE-core] [PATCH] kernel.bbclass: add strip process for signed kernel modules Anis Bougrine 2026-08-12 13:26 ` Bruce Ashfield 2026-08-12 15:40 ` Bougrine Anis 2026-08-12 13:50 ` Antonin Godard 2026-08-12 15:46 ` Bougrine Anis
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.