Secure boot - signing modules

[mskarbek]

Currently, modules have to be sign after installation. I would like to be able to sign them with custom key during kmod package build process. Is this something that would be accepted as an extension to the build process?

[dletai]

That's actually a DKMS issue, not a ZFS issue, and it's already solved.

1. https://github.com/dell/dkms#module-signing
2. https://wiki.debian.org/SecureBoot#Making_DKMS_modules_signing_by_DKMS_signing_key_usable_with_the_secure_boot
3. https://gist.github.com/lijikun/22be09ec9b178e745758a29c7a147cc9

The process is the same -
Make sure to disable pluton and enable self-signed keys and 3rd party keys (use discrete tpm instead of pluton) - in BIOS
Create the key, use mokutil to insert it o the secure boot, and add a sign-tool.

[mskarbek]

I wasn't talking about DKMS, but kmod build process. Currently, I need to sign modules with custom MOK after package installation. Since I'm building my own packages, I would like to be able to add an extra configure parameter with signing key and sign modules once during build, not on each machine separately.

[dletai]

Do you mean something like the following inside the spec file:

%bcond_with mok
...
%if %{with mok}
   %{_sign_tool} %{_hash_algo} %{_private_key} %{_cert} %{buildroot}/lib/modules/%{kverrel}/extra/*/*
%endif

and you rpmbuild --wtih mok --define "_sign_tool /usr/src/kernels/$(uname -r)/scripts/sign-file" --define '_hash_algo sha256' --define "_private_key $HOME/my-mok/mok.priv" --define "_cert $HOME/my-mok/mok.der"

Each time you build the kmod?
Seems a little convoluted, might as well use dkms in my opinion.
And you still have to disable pluton and enable 3rd-party in tpm in bios, but that's true for dkms as well.

The other option would be to pay MS enough to have a ZFS key as part of 3rd-party keys. I don't think his is realistic.