| Message ID | 20260813181719.44168-1-anis.bougrine10@gmail.com |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | [v2] kernel.bbclass: add strip process for signed kernel modules | expand |
On Thu, Aug 13, 2026 at 7:18 PM Anis Bougrine via lists.openembedded.org <anis.bougrine10=gmail.com@lists.openembedded.org> wrote: > Currently, signed kernel modules skip the stripping process in order > to preserve the file contents after signing. See commit: > 4c47e5f171fa2603355e2f9183065ce8137a18c7 > > However, the kernel install Makefile supports stripping modules before > signing them. This allows signed modules to be stripped while preserving > a valid signature. > > Make non-signed kernel modules follow the standard Yocto stripping flow, > while signed kernel modules use the kernel Makefile stripping flow. > > Fixes [YOCTO #12927] > > Reported-by: ross.burton@arm.com > Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com> > Cc: Antonin Godard <antonin.godard@bootlin.com> > Cc: Bruce Ashfield <bruce.ashfield@gmail.com> > --- > changes in v2: > > - Use the conditional INSTALL_MOD_STRIP environment variable to avoid > duplicating the oe_runmake call. > - Use `scripts/config` script instead of grepping .config file. > --- > meta/classes-recipe/kernel.bbclass | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/meta/classes-recipe/kernel.bbclass > b/meta/classes-recipe/kernel.bbclass > index a82bdf7ecb..dd6e203701 100644 > --- a/meta/classes-recipe/kernel.bbclass > +++ b/meta/classes-recipe/kernel.bbclass > @@ -451,9 +451,13 @@ kernel_do_install() { > # > # First install the modules > # > - unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE > + unset CFLAGS CPPFLAGS CXXFLAGS INSTALL_MOD_STRIP LDFLAGS MACHINE > if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then > - oe_runmake DEPMOD=echo > MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} > INSTALL_FW_PATH=${D}${firmwaredir} modules_install > You didn't test it on the master? What is the reason to drop firmwaredir? Jose > + # If the module will be auto-signed, perform stripping > before signing. > + if [ "$(${S}/scripts/config --state MODULE_SIG)" = "y" ] > && [ "$(${S}/scripts/config --state MODULE_SIG_ALL)" = "y" ]; then > + export INSTALL_MOD_STRIP="--strip-debug > --remove-section=.comment --remove-section=.note --preserve-dates" > + fi > + oe_runmake DEPMOD=echo > MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} > INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware modules_install > rm -f > "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build" > rm -f > "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source" > # Remove empty module directories to prevent QA issues > -- > 2.50.1 (Apple Git-155) > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#243378): > https://lists.openembedded.org/g/openembedded-core/message/243378 > Mute This Topic: https://lists.openembedded.org/mt/120738257/10043485 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [ > jose.quaresma@oss.qualcomm.com] > -=-=-=-=-=-=-=-=-=-=-=- > >
Hi Jose, Sorry, that was due to a rebase issue. I'll submit v3 shortly. BR, Anis On Thu, Aug 13, 2026 at 8:46 PM Jose Quaresma < jose.quaresma@oss.qualcomm.com> wrote: > > > On Thu, Aug 13, 2026 at 7:18 PM Anis Bougrine via lists.openembedded.org > <anis.bougrine10=gmail.com@lists.openembedded.org> wrote: > >> Currently, signed kernel modules skip the stripping process in order >> to preserve the file contents after signing. See commit: >> 4c47e5f171fa2603355e2f9183065ce8137a18c7 >> >> However, the kernel install Makefile supports stripping modules before >> signing them. This allows signed modules to be stripped while preserving >> a valid signature. >> >> Make non-signed kernel modules follow the standard Yocto stripping flow, >> while signed kernel modules use the kernel Makefile stripping flow. >> >> Fixes [YOCTO #12927] >> >> Reported-by: ross.burton@arm.com >> Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com> >> Cc: Antonin Godard <antonin.godard@bootlin.com> >> Cc: Bruce Ashfield <bruce.ashfield@gmail.com> >> --- >> changes in v2: >> >> - Use the conditional INSTALL_MOD_STRIP environment variable to avoid >> duplicating the oe_runmake call. >> - Use `scripts/config` script instead of grepping .config file. >> --- >> meta/classes-recipe/kernel.bbclass | 8 ++++++-- >> 1 file changed, 6 insertions(+), 2 deletions(-) >> >> diff --git a/meta/classes-recipe/kernel.bbclass >> b/meta/classes-recipe/kernel.bbclass >> index a82bdf7ecb..dd6e203701 100644 >> --- a/meta/classes-recipe/kernel.bbclass >> +++ b/meta/classes-recipe/kernel.bbclass >> @@ -451,9 +451,13 @@ kernel_do_install() { >> # >> # First install the modules >> # >> - unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE >> + unset CFLAGS CPPFLAGS CXXFLAGS INSTALL_MOD_STRIP LDFLAGS MACHINE >> if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then >> - oe_runmake DEPMOD=echo >> MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} >> INSTALL_FW_PATH=${D}${firmwaredir} modules_install >> > > You didn't test it on the master? What is the reason to drop firmwaredir? > > Jose > > >> + # If the module will be auto-signed, perform stripping >> before signing. >> + if [ "$(${S}/scripts/config --state MODULE_SIG)" = "y" ] >> && [ "$(${S}/scripts/config --state MODULE_SIG_ALL)" = "y" ]; then >> + export INSTALL_MOD_STRIP="--strip-debug >> --remove-section=.comment --remove-section=.note --preserve-dates" >> + fi >> + oe_runmake DEPMOD=echo >> MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} >> INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware modules_install >> rm -f >> "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build" >> rm -f >> "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source" >> # Remove empty module directories to prevent QA issues >> -- >> 2.50.1 (Apple Git-155) >> >> >> -=-=-=-=-=-=-=-=-=-=-=- >> Links: You receive all messages sent to this group. >> View/Reply Online (#243378): >> https://lists.openembedded.org/g/openembedded-core/message/243378 >> Mute This Topic: https://lists.openembedded.org/mt/120738257/10043485 >> Group Owner: openembedded-core+owner@lists.openembedded.org >> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [ >> jose.quaresma@oss.qualcomm.com] >> -=-=-=-=-=-=-=-=-=-=-=- >> >>
diff --git a/meta/classes-recipe/kernel.bbclass b/meta/classes-recipe/kernel.bbclass index a82bdf7ecb..dd6e203701 100644 --- a/meta/classes-recipe/kernel.bbclass +++ b/meta/classes-recipe/kernel.bbclass @@ -451,9 +451,13 @@ kernel_do_install() { # # First install the modules # - unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE + unset CFLAGS CPPFLAGS CXXFLAGS INSTALL_MOD_STRIP LDFLAGS MACHINE if (grep -q -i -e '^CONFIG_MODULES=y$' .config); then - oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${firmwaredir} modules_install + # If the module will be auto-signed, perform stripping before signing. + if [ "$(${S}/scripts/config --state MODULE_SIG)" = "y" ] && [ "$(${S}/scripts/config --state MODULE_SIG_ALL)" = "y" ]; then + export INSTALL_MOD_STRIP="--strip-debug --remove-section=.comment --remove-section=.note --preserve-dates" + fi + oe_runmake DEPMOD=echo MODLIB=${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION} INSTALL_FW_PATH=${D}${nonarch_base_libdir}/firmware modules_install rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/build" rm -f "${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source" # Remove empty module directories to prevent QA issues
Currently, signed kernel modules skip the stripping process in order to preserve the file contents after signing. See commit: 4c47e5f171fa2603355e2f9183065ce8137a18c7 However, the kernel install Makefile supports stripping modules before signing them. This allows signed modules to be stripped while preserving a valid signature. Make non-signed kernel modules follow the standard Yocto stripping flow, while signed kernel modules use the kernel Makefile stripping flow. Fixes [YOCTO #12927] Reported-by: ross.burton@arm.com Signed-off-by: Anis Bougrine <anis.bougrine10@gmail.com> Cc: Antonin Godard <antonin.godard@bootlin.com> Cc: Bruce Ashfield <bruce.ashfield@gmail.com> --- changes in v2: - Use the conditional INSTALL_MOD_STRIP environment variable to avoid duplicating the oe_runmake call. - Use `scripts/config` script instead of grepping .config file. --- meta/classes-recipe/kernel.bbclass | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)