Centos kernel compilation and signature mechanism

Centos kernel compilation and signature mechanism

The signature mechanism introduced by Linux kernel 3.7 greatly facilitates the Security Authentication of kernel modules, and also provides IP Protection Technology for operating system manufacturers. However, everything has both advantages and disadvantages. Engineers who have just come into contact with the kernel with a signature mechanism need to understand and adapt to the new kernel process. To this end, I have summarized some key points of my work experience and shared them with you.

1. What is the kernel signature mechanism?

Kernel signature is the process in which the kernel uses the public key to verify the driver module. The module that passes the verification is allowed to be loaded, but the kernel driver module that does not have a signature or the module whose signature has not passed the verification, disable or allow loading Based on Different kernel options.

2. How to Use the kernel signature?

Kernel signatures can be used in the following scenarios:

1. driver modules closely bound to a kernel or operating system vendor, including kernel driver modules limited to a specific version of the kernel;

2. Restricted or controlled driver modules, including drivers that can be loaded only when the operating system or kernel cannot be changed.

3. What are the inconveniences caused by signature verification?

If you do not know the previous private key and public key generation algorithms, the newly compiled kernel binary or driver module cannot be directly loaded.

4. How can we avoid possible impacts?

Disable kernel signature check, generate corresponding initramfs again, modify boot memu, and reboot the system from the newly added boot entry.

5. Examples

The following uses centos 7 (based on linux kernel 3.10) as an example to describe the specific operation steps:

1. Download Centos. DVD or other file system images consistent with the current file system version from the official website;

2. Burn the image to the boot disk or use UltraISO and other boot disk creation software to open it. Find the corresponding kernel binary, confg configuration files (x86_64_config) and initramfs from its rpm repository;

3. According to the binary version of the kernel found above, go to the official website to download the corresponding kernel source code rpm or compressed file. After decompression, copy the configuration file found above as. config. Of course, the default. config file can also be from the built-in config file under/boot/of the system to be updated;

4. make menuconfig to view the default configuration and check the options related to the sign. if:

• The Kernel configuration file does not use the signature mechanism, and all sign checking options are disabled:

It indicates that no signature check is used. You can directly modify the kernel driver, kernel, and configuration file to generate a new kernel active driver, or make modules_install or make install, the generated kernel or driver can be used directly with the previous module.

• If the kernel has used kernel signature verification, follow these steps to create a kernel or driver that can be started:

1. Run make menuconfig to remove the force module sign checking option. Otherwise, the generated kernel will only load the driver that matches the current public key, however, it is difficult to ensure that the public key in the binary kernel, the Public Key in the initramfs module, and the Public Key in the driver module under/lib/modules in the file system are exactly the same.

2. Run make

3. Specify the kernel install path INSTALL_MOD_PATH

4. Make modules_install

5. Use dracut-k kernel. img $ (INSTALL_MOD_PATH)/lib/modules/$ (KERNELRELEASE) to generate kernel-matched initramfs

6. Copy bzImage and initramfs under the corresponding arch to/boot/

7. Add the boot item guiding bzImage and initramfs to/etc/grub. cfg, and then run the grub2-mkconfig

8. Restart, select the newly added kernel entry in grub, enter the operating system, and use and verify the new kernel and driver.