diff mbox series

kernel.bbclass: add strip process for signed kernel modules

Message ID 20260812130655.15109-1-anis.bougrine10@gmail.com
State Changes Requested
Headers show
Series kernel.bbclass: add strip process for signed kernel modules | expand

Commit Message

Bougrine Anis Aug. 12, 2026, 1:06 p.m. UTC 
Currently, signed kernel modules skip the stripping process in order
to preserve the file contents after signing. See commit:
4c47e5f171fa2603355e2f9183065ce8137a18c7

However, the kernel install Makefile supports stripping modules before
signing them. This allows signed modules to be stripped while preserving
a valid signature.

Make non-signed kernel modules follow the standard Yocto stripping flow,
while signed kernel modules use the kernel Makefile stripping flow.

Fixes [YOCTO #12927]

Reported-by: ross.burton@arm.com
Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com>
---
 meta/classes-recipe/kernel.bbclass | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

Comments

Bruce Ashfield Aug. 12, 2026, 1:26 p.m. UTC | #1 
On Wed, Aug 12, 2026 at 9:07 AM Anis Bougrine via
lists.openembedded.org
<anis.bougrine10=gmail.com@lists.openembedded.org> wrote:
>
> Currently, signed kernel modules skip the stripping process in order
> to preserve the file contents after signing. See commit:
> 4c47e5f171fa2603355e2f9183065ce8137a18c7
>
> However, the kernel install Makefile supports stripping modules before
> signing them. This allows signed modules to be stripped while preserving
> a valid signature.
>
> Make non-signed kernel modules follow the standard Yocto stripping flow,
> while signed kernel modules use the kernel Makefile stripping flow.
>
> Fixes [YOCTO #12927]
>
> Reported-by: ross.burton@arm.com
> Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com>
> ---
>  meta/classes-recipe/kernel.bbclass | 16 +++++++++++++++-
>  1 file changed, 15 insertions(+), 1 deletion(-)
>
> diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
> index a82bdf7ecb..0d8d370e9d 100644
> --- a/meta/classes-recipe/kernel.bbclass
> +++ b/meta/classes-recipe/kernel.bbclass
> @@ -453,7 +453,21 @@ kernel_do_install() {
>         #
>         unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE
>         if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
> -               oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install
> +               # If the module will be auto-signed, perform stripping before signing.
> +               if grep -q '^CONFIG_MODULE_SIG=y$' .config && grep -q '^CONFIG_MODULE_SIG_ALL=y$' .config; then
> +                       oe_runmake \
> +                               INSTALL_MOD_STRIP="--strip-debug --remove-section=.comment --remove-section=.note --preserve-dates" \
> +                               DEPMOD=echo \
> +                               MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \
> +                               INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware \
> +                               modules_install
> +               else
> +                       oe_runmake \
> +                               DEPMOD=echo \
> +                               MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \
> +                               INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware \
> +                               modules_install

Am I misreading the patch (it has been known to happen :)) ? is the
only differnece
between the two conditions the INSTALL_MOD_STRIP ? if so, why not just use a
variable and put $INSTALL_MOD_STRIP (or whatever) in the oe_runmake line ?

Better to have the variable be conditional, than duplicating the
actual call to strip
the modules.

Bruce

> +               fi
>                 rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build"
>                 rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source"
>                 # Remove empty module directories to prevent QA issues
> --
> 2.50.1 (Apple Git-155)
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#243287): https://lists.openembedded.org/g/openembedded-core/message/243287
> Mute This Topic: https://lists.openembedded.org/mt/120717114/1050810
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [bruce.ashfield@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
Antonin Godard Aug. 12, 2026, 1:50 p.m. UTC | #2 
Hi,

On Wed Aug 12, 2026 at 3:06 PM CEST, Anis Bougrine via lists.openembedded.org wrote:
> Currently, signed kernel modules skip the stripping process in order
> to preserve the file contents after signing. See commit:
> 4c47e5f171fa2603355e2f9183065ce8137a18c7
>
> However, the kernel install Makefile supports stripping modules before
> signing them. This allows signed modules to be stripped while preserving
> a valid signature.
>
> Make non-signed kernel modules follow the standard Yocto stripping flow,
> while signed kernel modules use the kernel Makefile stripping flow.
>
> Fixes [YOCTO #12927]
>
> Reported-by: ross.burton@arm.com
> Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com>
> ---
>  meta/classes-recipe/kernel.bbclass | 16 +++++++++++++++-
>  1 file changed, 15 insertions(+), 1 deletion(-)
>
> diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
> index a82bdf7ecb..0d8d370e9d 100644
> --- a/meta/classes-recipe/kernel.bbclass
> +++ b/meta/classes-recipe/kernel.bbclass
> @@ -453,7 +453,21 @@ kernel_do_install() {
>  	#
>  	unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE
>  	if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
> -		oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install
> +		# If the module will be auto-signed, perform stripping before signing.
> +		if grep -q '^CONFIG_MODULE_SIG=y$' .config && grep -q '^CONFIG_MODULE_SIG_ALL=y$' .config; then

Suggestion: you can use the kernel's scripts/config utility to get the option
values:

$ ./scripts/config --file ./.config --state MODULE_SIG
y

So that you really see the option value as the kernel sees it.

Antonin
Bougrine Anis Aug. 12, 2026, 3:40 p.m. UTC | #3 
Hi Bruce,

You are correct, INSTALL_MOD_STRIP is the only difference between the two
branches.

I initially tried using a variable as you suggested, but had issues with
the variable expansion when passing the strip options to the kernel
Makefile.

Using an environment variable keeps a single oe_runmake call:

    if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
        # If the module will be auto-signed, perform stripping before
signing.
        if [ "$(./source/scripts/config --file ./.config --state
MODULE_SIG)" = y ] &&
           [ "$(./source/scripts/config --file ./.config --state
MODULE_SIG_ALL)" = y ]; then
            export INSTALL_MOD_STRIP="--strip-debug
--remove-section=.comment --remove-section=.note --preserve-dates"
        fi
        oe_runmake DEPMOD=echo
MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}
INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware modules_install
    fi

If you are okay with this approach, I can send v2.

BR,
Anis

On Wed, Aug 12, 2026 at 3:26 PM Bruce Ashfield <bruce.ashfield@gmail.com>
wrote:

> On Wed, Aug 12, 2026 at 9:07 AM Anis Bougrine via
> lists.openembedded.org
> <anis.bougrine10=gmail.com@lists.openembedded.org> wrote:
> >
> > Currently, signed kernel modules skip the stripping process in order
> > to preserve the file contents after signing. See commit:
> > 4c47e5f171fa2603355e2f9183065ce8137a18c7
> >
> > However, the kernel install Makefile supports stripping modules before
> > signing them. This allows signed modules to be stripped while preserving
> > a valid signature.
> >
> > Make non-signed kernel modules follow the standard Yocto stripping flow,
> > while signed kernel modules use the kernel Makefile stripping flow.
> >
> > Fixes [YOCTO #12927]
> >
> > Reported-by: ross.burton@arm.com
> > Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com>
> > ---
> >  meta/classes-recipe/kernel.bbclass | 16 +++++++++++++++-
> >  1 file changed, 15 insertions(+), 1 deletion(-)
> >
> > diff --git a/meta/classes-recipe/kernel.bbclass
> b/meta/classes-recipe/kernel.bbclass
> > index a82bdf7ecb..0d8d370e9d 100644
> > --- a/meta/classes-recipe/kernel.bbclass
> > +++ b/meta/classes-recipe/kernel.bbclass
> > @@ -453,7 +453,21 @@ kernel_do_install() {
> >         #
> >         unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE
> >         if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
> > -               oe_runmake DEPMOD=echo
> MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}
> INSTALL_FW_PATH=${D}${firmwaredir} modules_install
> > +               # If the module will be auto-signed, perform stripping
> before signing.
> > +               if grep -q '^CONFIG_MODULE_SIG=y$' .config && grep -q
> '^CONFIG_MODULE_SIG_ALL=y$' .config; then
> > +                       oe_runmake \
> > +                               INSTALL_MOD_STRIP="--strip-debug
> --remove-section=.comment --remove-section=.note --preserve-dates" \
> > +                               DEPMOD=echo \
> > +
>  MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \
> > +
>  INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware \
> > +                               modules_install
> > +               else
> > +                       oe_runmake \
> > +                               DEPMOD=echo \
> > +
>  MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \
> > +
>  INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware \
> > +                               modules_install
>
> Am I misreading the patch (it has been known to happen :)) ? is the
> only differnece
> between the two conditions the INSTALL_MOD_STRIP ? if so, why not just use
> a
> variable and put $INSTALL_MOD_STRIP (or whatever) in the oe_runmake line ?
>
> Better to have the variable be conditional, than duplicating the
> actual call to strip
> the modules.
>
> Bruce
>
> > +               fi
> >                 rm -f
> "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build"
> >                 rm -f
> "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source"
> >                 # Remove empty module directories to prevent QA issues
> > --
> > 2.50.1 (Apple Git-155)
> >
> >
> > -=-=-=-=-=-=-=-=-=-=-=-
> > Links: You receive all messages sent to this group.
> > View/Reply Online (#243287):
> https://lists.openembedded.org/g/openembedded-core/message/243287
> > Mute This Topic: https://lists.openembedded.org/mt/120717114/1050810
> > Group Owner: openembedded-core+owner@lists.openembedded.org
> > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> bruce.ashfield@gmail.com]
> > -=-=-=-=-=-=-=-=-=-=-=-
> >
>
>
> --
> - Thou shalt not follow the NULL pointer, for chaos and madness await
> thee at its end
> - "Use the force Harry" - Gandalf, Star Trek II
>
Bougrine Anis Aug. 12, 2026, 3:46 p.m. UTC | #4 
Hi Antonin,

I took your suggestion into account. A v2 patch may look like this:

    if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
        # If the module will be auto-signed, perform stripping before
signing.
        if [ "$(./source/scripts/config --file ./.config --state
MODULE_SIG)" = y ] &&
           [ "$(./source/scripts/config --file ./.config --state
MODULE_SIG_ALL)" = y ]; then
            export INSTALL_MOD_STRIP="--strip-debug
--remove-section=.comment --remove-section=.note --preserve-dates"
        fi
        oe_runmake DEPMOD=echo
MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}
INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware modules_install
    fi

However, I think grepping the .config file is more reliable, since its
location inside ${WORKDIR} is more stable than the location of the config
script.


I stay open to any further suggestions.


BR,

Anis

On Wed, Aug 12, 2026 at 3:50 PM Antonin Godard <antonin.godard@bootlin.com>
wrote:

> Hi,
>
> On Wed Aug 12, 2026 at 3:06 PM CEST, Anis Bougrine via
> lists.openembedded.org wrote:
> > Currently, signed kernel modules skip the stripping process in order
> > to preserve the file contents after signing. See commit:
> > 4c47e5f171fa2603355e2f9183065ce8137a18c7
> >
> > However, the kernel install Makefile supports stripping modules before
> > signing them. This allows signed modules to be stripped while preserving
> > a valid signature.
> >
> > Make non-signed kernel modules follow the standard Yocto stripping flow,
> > while signed kernel modules use the kernel Makefile stripping flow.
> >
> > Fixes [YOCTO #12927]
> >
> > Reported-by: ross.burton@arm.com
> > Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com>
> > ---
> >  meta/classes-recipe/kernel.bbclass | 16 +++++++++++++++-
> >  1 file changed, 15 insertions(+), 1 deletion(-)
> >
> > diff --git a/meta/classes-recipe/kernel.bbclass
> b/meta/classes-recipe/kernel.bbclass
> > index a82bdf7ecb..0d8d370e9d 100644
> > --- a/meta/classes-recipe/kernel.bbclass
> > +++ b/meta/classes-recipe/kernel.bbclass
> > @@ -453,7 +453,21 @@ kernel_do_install() {
> >       #
> >       unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE
> >       if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
> > -             oe_runmake DEPMOD=echo
> MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}
> INSTALL_FW_PATH=${D}${firmwaredir} modules_install
> > +             # If the module will be auto-signed, perform stripping
> before signing.
> > +             if grep -q '^CONFIG_MODULE_SIG=y$' .config && grep -q
> '^CONFIG_MODULE_SIG_ALL=y$' .config; then
>
> Suggestion: you can use the kernel's scripts/config utility to get the
> option
> values:
>
> $ ./scripts/config --file ./.config --state MODULE_SIG
> y
>
> So that you really see the option value as the kernel sees it.
>
> Antonin
>
diff mbox series

Patch

diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass
index a82bdf7ecb..0d8d370e9d 100644
--- a/meta/classes-recipe/kernel.bbclass
+++ b/meta/classes-recipe/kernel.bbclass
@@ -453,7 +453,21 @@  kernel_do_install() {
 	#
 	unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE
 	if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then
-		oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install
+		# If the module will be auto-signed, perform stripping before signing.
+		if grep -q '^CONFIG_MODULE_SIG=y$' .config && grep -q '^CONFIG_MODULE_SIG_ALL=y$' .config; then
+			oe_runmake \
+				INSTALL_MOD_STRIP="--strip-debug --remove-section=.comment --remove-section=.note --preserve-dates" \
+				DEPMOD=echo \
+				MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \
+				INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware \
+				modules_install
+		else
+			oe_runmake \
+				DEPMOD=echo \
+				MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} \
+				INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware \
+				modules_install
+		fi
 		rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build"
 		rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source"
 		# Remove empty module directories to prevent QA issues