From fcc963561c12276df9cff1d7668e16626bfbdbaf Mon Sep 17 00:00:00 2001 From: mrogers Date: Nov 08 2019 07:57:24 +0000 Subject: Removed references to perl from module signing section https://bugzilla.redhat.com/show_bug.cgi?id=1380923 confirms that the perl script was replaced with a C binary years ago. Signed-off-by: mrogers --- diff --git a/modules/system-administrators-guide/pages/kernel-module-driver-configuration/Working_with_Kernel_Modules.adoc b/modules/system-administrators-guide/pages/kernel-module-driver-configuration/Working_with_Kernel_Modules.adoc index a36afe6..9a232b1 100644 --- a/modules/system-administrators-guide/pages/kernel-module-driver-configuration/Working_with_Kernel_Modules.adoc +++ b/modules/system-administrators-guide/pages/kernel-module-driver-configuration/Working_with_Kernel_Modules.adoc @@ -399,8 +399,7 @@ In order to enable signing of externally built modules, the tools listed in the |=== |Tool|Provided by Package|Used on|Purpose |[command]#openssl#|[package]*openssl*|Build system|Generates public and private X.509 key pair -|[command]#sign-file#|[package]*kernel-devel*|Build system|Perl script used to sign kernel modules -|[command]#perl#|[package]*perl*|Build system|Perl interpreter used to run the signing script +|[command]#sign-file#|[package]*kernel-devel*|Build system|C application used to sign kernel modules |[command]#mokutil#|[package]*mokutil*|Target system|Optional tool used to manually enroll the public key |[command]#keyctl#|[package]*keyutils*|Target system|Optional tool used to display public keys in the system key ring |=== @@ -617,18 +616,18 @@ There are no extra steps required to prepare your kernel module for signing. You ~]#{nbsp}make -C /usr/src/kernels/$(uname -r) M=$PWD modules ---- -. Sign your kernel module with your private key. This is done with a Perl script. Note that the script requires that you provide both the files that contain your private and the public key as well as the kernel module file that you want to sign. +. Sign your kernel module with your private key. This is done with a C application. Note that the application requires that you provide both the files that contain your private and the public key as well as the kernel module file that you want to sign. + [subs="attributes"] ---- -~]#{nbsp}perl /usr/src/kernels/$(uname -r)/scripts/sign-file \ +~]#{nbsp}/usr/src/kernels/$(uname -r)/scripts/sign-file \ sha256 \ my_signing_key.priv \ my_signing_key_pub.der \ my_module.ko ---- -Your kernel module is in ELF image format and this script computes and appends the signature directly to the ELF image in your `my_module.ko` file. The [command]#modinfo# utility can be used to display information about the kernel module's signature, if it is present. For information on using the utility, see xref:Working_with_Kernel_Modules.adoc#sec-Displaying_Information_About_a_Module[Displaying Information About a Module]. +Your kernel module is in ELF image format and this application computes and appends the signature directly to the ELF image in your `my_module.ko` file. The [command]#modinfo# utility can be used to display information about the kernel module's signature, if it is present. For information on using the utility, see xref:Working_with_Kernel_Modules.adoc#sec-Displaying_Information_About_a_Module[Displaying Information About a Module]. Note that this appended signature is not contained in an ELF image section and is not a formal part of the ELF image. Therefore, tools such as [command]#readelf# will not be able to display the signature on your kernel module.