由於目前bios支援efi,如果支援UEFI Secure Boot啟動,那麼核心所有模組都必須使用UEFI Secure key 簽名.

檢視當前系統key:

#keyctl list %:.system_keyring

如果系統沒有開啟UEFI Secure Boot,會類似如下輸出:

3 keys in keyring:
...asymmetric: Red Hat Enterprise Linux Driver Update Program (key 3): bf57f3e87...
...asymmetric: Red Hat Enterprise Linux kernel signing key: 4249689eefc77e95880b...
...asymmetric: Red Hat Enterprise Linux kpatch signing key: 4d38fd864ebe18c5f0b7...

6 keys in keyring:
...asymmetric: Red Hat Enterprise Linux Driver Update Program (key 3): bf57f3e87...
...asymmetric: Red Hat Secure Boot (CA key 1): 4016841644ce3a810408050766e8f8a29...
...asymmetric: Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed...
...asymmetric: Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e...
...asymmetric: Red Hat Enterprise Linux kernel signing key: 4249689eefc77e95880b...
...asymmetric: Red Hat Enterprise Linux kpatch signing key: 4d38fd864ebe18c5f0b7...

# dmesg | grep 'EFI: Loaded cert'
[5.160660] EFI: Loaded cert 'Microsoft Windows Production PCA 2011: a9290239...
[5.160674] EFI: Loaded cert 'Microsoft Corporation UEFI CA 2011: 13adbf4309b...
[5.165794] EFI: Loaded cert 'Red Hat Secure Boot (CA key 1): 4016841644ce3a8...

否則只能為自己製作一個.

相關工具情況:

1. 生成配置檔案:

# cat << EOF > configuration_file.config
[ req ]
default_bits = 4096
distinguished_name = req_distinguished_name
prompt = no
string_mask = utf8only
x509_extensions = myexts

[ req_distinguished_name ]
O = Organization
CN = Organization signing key
emailAddress = E-mail address

[ myexts ]
basicConstraints=critical,CA:FALSE
keyUsage=digitalSignature
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid
EOF

]# openssl req -x509 -new -nodes -utf8 -sha256 -days 36500 -batch -config configuration_file.config -outform DER -out public_key.der -keyout private_key.priv

1. 把生成的UEFI Secure Boot key資料植入到出廠映象檔案即bios中(基本不可能)

2. 把生成的UEFI Secure Boot key資料植入到efi映象檔案(不知道弄,如果哪位大俠知道,求告知)

3. 把公鑰新增到 MOK lis,執行以下步驟:

# mokutil --import public_key.der

使用私鑰註冊模組:

直接編譯

# make -C /usr/src/kernels/$(uname -r) M=$PWD modules

cd /usr/src/kernels/`uname -r` && perl ./scripts/sign-file sha256 private_key.priv public_key.der $(mod_dir)/mod.ko