initial commit
This commit is contained in:
commit
25dddb2c8b
24
.gitignore
vendored
Normal file
24
.gitignore
vendored
Normal file
@ -0,0 +1,24 @@
|
|||||||
|
# Build artifacts
|
||||||
|
build/
|
||||||
|
dist/
|
||||||
|
*.rpm
|
||||||
|
*.src.rpm
|
||||||
|
*.tar.gz
|
||||||
|
ksigner.spec
|
||||||
|
src/ksigner
|
||||||
|
docs/ksigner.8
|
||||||
|
|
||||||
|
# Temporary files
|
||||||
|
*~
|
||||||
|
*.swp
|
||||||
|
*.tmp
|
||||||
|
|
||||||
|
# RPM build artifacts
|
||||||
|
noarch/
|
||||||
|
x86_64/
|
||||||
|
SOURCES/
|
||||||
|
SPECS/
|
||||||
|
BUILD/
|
||||||
|
BUILDROOT/
|
||||||
|
RPMS/
|
||||||
|
SRPMS/
|
||||||
21
LICENSE
Normal file
21
LICENSE
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
MIT License
|
||||||
|
|
||||||
|
Copyright (c) 2025 KSigner Contributors
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice shall be included in all
|
||||||
|
copies or substantial portions of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
|
SOFTWARE.
|
||||||
59
Makefile
Normal file
59
Makefile
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
NAME = ksigner
|
||||||
|
VERSION = $(shell cat VERSION)
|
||||||
|
RELEASE = $(shell cat RELEASE)
|
||||||
|
SOURCEDIR = .
|
||||||
|
BUILDDIR = build
|
||||||
|
SOURCES = src/ksigner src/ksigner.conf src/ksigner-update-hook docs/ksigner.8 README.md LICENSE
|
||||||
|
CLEANFILES = $(BUILDDIR) $(NAME).spec src/$(NAME) docs/$(NAME).8 noarch *.tar.gz *.rpm *.src.rpm
|
||||||
|
|
||||||
|
.PHONY: all clean dist rpm srpm install
|
||||||
|
|
||||||
|
all: dist
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -rf $(CLEANFILES)
|
||||||
|
|
||||||
|
$(BUILDDIR):
|
||||||
|
mkdir -p $(BUILDDIR)
|
||||||
|
|
||||||
|
%.spec: %.spec.in VERSION RELEASE
|
||||||
|
sed -e 's/@VERSION@/$(VERSION)/g' \
|
||||||
|
-e 's/@RELEASE@/$(RELEASE)/g' \
|
||||||
|
$< > $@
|
||||||
|
|
||||||
|
src/%: src/%.in VERSION RELEASE
|
||||||
|
sed -e 's/@VERSION@/$(VERSION)/g' \
|
||||||
|
$< > $@
|
||||||
|
|
||||||
|
docs/%: docs/%.in VERSION RELEASE
|
||||||
|
sed -e 's/@VERSION@/$(VERSION)/g' \
|
||||||
|
$< > $@
|
||||||
|
|
||||||
|
dist: $(BUILDDIR) $(NAME).spec src/$(NAME) docs/$(NAME).8
|
||||||
|
mkdir -p $(BUILDDIR)/$(NAME)-$(VERSION)
|
||||||
|
cp -r $(SOURCES) $(NAME).spec $(BUILDDIR)/$(NAME)-$(VERSION)/
|
||||||
|
cd $(BUILDDIR) && tar -czf $(NAME)-$(VERSION).tar.gz $(NAME)-$(VERSION)/
|
||||||
|
cp $(BUILDDIR)/$(NAME)-$(VERSION).tar.gz $(SOURCEDIR)
|
||||||
|
|
||||||
|
srpm: dist
|
||||||
|
rpmbuild --define "_topdir $(PWD)/$(BUILDDIR)" \
|
||||||
|
--define "_sourcedir $(PWD)" \
|
||||||
|
--define "_srcrpmdir $(PWD)" \
|
||||||
|
-bs $(NAME).spec
|
||||||
|
|
||||||
|
rpm: dist
|
||||||
|
rpmbuild --define "_topdir $(PWD)/$(BUILDDIR)" \
|
||||||
|
--define "_sourcedir $(PWD)" \
|
||||||
|
--define "_rpmdir $(PWD)" \
|
||||||
|
--define "_buildrootdir $(PWD)/$(BUILDDIR)" \
|
||||||
|
-ba $(NAME).spec
|
||||||
|
|
||||||
|
install:
|
||||||
|
install -d $(DESTDIR)/usr/bin
|
||||||
|
install -d $(DESTDIR)/etc/ksigner
|
||||||
|
install -d $(DESTDIR)/etc/kernel/postinst.d
|
||||||
|
install -d $(DESTDIR)/usr/share/man/man8
|
||||||
|
install -m 755 src/ksigner $(DESTDIR)/usr/bin/
|
||||||
|
install -m 644 src/ksigner.conf $(DESTDIR)/etc/ksigner/
|
||||||
|
install -m 755 src/ksigner-update-hook $(DESTDIR)/etc/kernel/postinst.d/zz-ksigner
|
||||||
|
install -m 644 docs/ksigner.8 $(DESTDIR)/usr/share/man/man8/
|
||||||
171
README.md
Normal file
171
README.md
Normal file
@ -0,0 +1,171 @@
|
|||||||
|
```bash
|
||||||
|
# Enable/disable automatic signing on kernel updates# Kernel Signer
|
||||||
|
|
||||||
|
A secure boot kernel signing utility for Red Hat based systems (RHEL, CentOS, Fedora, Rocky Linux, AlmaLinux, etc.).
|
||||||
|
|
||||||
|
## Overview
|
||||||
|
|
||||||
|
This package provides a comprehensive solution for signing Linux kernels with custom keys for Secure Boot environments. It includes:
|
||||||
|
|
||||||
|
- Automatic key generation and MOK enrollment
|
||||||
|
- Support for signing individual or all kernels
|
||||||
|
- Configurable through `/etc/ksigner/ksigner.conf`
|
||||||
|
- Comprehensive logging and status reporting
|
||||||
|
|
||||||
|
## Installation
|
||||||
|
|
||||||
|
### Building the RPM
|
||||||
|
|
||||||
|
1. Install build dependencies:
|
||||||
|
```bash
|
||||||
|
# RHEL/CentOS/Rocky/Alma
|
||||||
|
sudo dnf install rpm-build rpmdevtools
|
||||||
|
|
||||||
|
# Create build environment
|
||||||
|
rpmdev-setuptree
|
||||||
|
```
|
||||||
|
|
||||||
|
2. Build the package:
|
||||||
|
```bash
|
||||||
|
# Create source tarball
|
||||||
|
make dist
|
||||||
|
|
||||||
|
# Build RPM
|
||||||
|
make rpm
|
||||||
|
|
||||||
|
# Or build source RPM
|
||||||
|
make srpm
|
||||||
|
```
|
||||||
|
|
||||||
|
3. Install the package:
|
||||||
|
```bash
|
||||||
|
sudo rpm -ivh ksigner*.rpm
|
||||||
|
```
|
||||||
|
|
||||||
|
### Dependencies
|
||||||
|
|
||||||
|
The following packages will be automatically installed as dependencies:
|
||||||
|
- `openssl` - Key generation and certificate operations
|
||||||
|
- `mokutil` - Machine Owner Key management
|
||||||
|
- `sbsigntools` - Kernel signing utilities
|
||||||
|
- `hmaccalc` - HMAC generation for signed kernels
|
||||||
|
- `sudo` - Privilege escalation
|
||||||
|
- `bash` (>= 4.0) - Shell scripting features
|
||||||
|
|
||||||
|
## Quick Start
|
||||||
|
|
||||||
|
1. **Install the package** (as shown above)
|
||||||
|
|
||||||
|
2. **Set up signing keys**:
|
||||||
|
```bash
|
||||||
|
sudo ksigner setup
|
||||||
|
```
|
||||||
|
|
||||||
|
3. **Reboot and enroll MOK keys**:
|
||||||
|
- Reboot your system
|
||||||
|
- In the MOK management interface: Enroll MOK → Continue → Yes → Enter password → OK
|
||||||
|
|
||||||
|
4. **Sign kernels**:
|
||||||
|
```bash
|
||||||
|
# Sign latest kernel
|
||||||
|
sudo ksigner sign
|
||||||
|
|
||||||
|
# Sign all kernels
|
||||||
|
sudo ksigner sign-all
|
||||||
|
|
||||||
|
# Check status
|
||||||
|
sudo ksigner status
|
||||||
|
```
|
||||||
|
|
||||||
|
## Configuration
|
||||||
|
|
||||||
|
Edit `/etc/ksigner/ksigner.conf` to customize behavior:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Enable/disable automatic signing on kernel updates
|
||||||
|
SIGN_ON_UPDATE=true
|
||||||
|
|
||||||
|
# Type of automatic signing (sign, sign-lts, sign-all, sign-all-lts)
|
||||||
|
AUTO_SIGN_TYPE="sign-lts"
|
||||||
|
|
||||||
|
# Define which kernel versions are considered LTS
|
||||||
|
LTS_VERSIONS=(
|
||||||
|
"6.12"
|
||||||
|
"6.6"
|
||||||
|
"6.1"
|
||||||
|
"5.15"
|
||||||
|
"5.10"
|
||||||
|
)
|
||||||
|
```
|
||||||
|
|
||||||
|
## Commands
|
||||||
|
|
||||||
|
- `ksigner setup` - Create and install signing keys
|
||||||
|
- `ksigner sign [kernel_file]` - Sign a kernel (latest if no file specified)
|
||||||
|
- `ksigner sign-lts [kernel_file]` - Sign an LTS kernel
|
||||||
|
- `ksigner sign-all` - Sign all available kernels
|
||||||
|
- `ksigner sign-all-lts` - Sign all LTS kernels
|
||||||
|
- `ksigner status` - Show signing key status
|
||||||
|
- `ksigner version` - Show version information
|
||||||
|
|
||||||
|
## Automatic Kernel Signing
|
||||||
|
|
||||||
|
When `SIGN_ON_UPDATE=true` in the configuration, kernels are automatically signed when installed via package manager. The hook script `/etc/kernel/postinst.d/zz-ksigner` handles this process.
|
||||||
|
|
||||||
|
Logs are written to `/var/log/ksigner.log`.
|
||||||
|
|
||||||
|
## File Locations
|
||||||
|
|
||||||
|
- **Configuration**: `/etc/ksigner/ksigner.conf`
|
||||||
|
- **Public Key**: `/etc/pki/sbsign/certs/MOK.pem`
|
||||||
|
- **Private Key**: `/etc/pki/sbsign/private/MOK.priv`
|
||||||
|
- **DER Key**: `/etc/pki/sbsign/certs/MOK.der`
|
||||||
|
- **Log File**: `/var/log/ksigner.log`
|
||||||
|
- **Update Hook**: `/etc/kernel/postinst.d/zz-ksigner`
|
||||||
|
|
||||||
|
## Security Notes
|
||||||
|
|
||||||
|
- Private keys are stored with restrictive permissions (600)
|
||||||
|
- MOK enrollment requires manual confirmation to prevent unauthorized access
|
||||||
|
- All operations require root privileges
|
||||||
|
- HMAC files are generated for integrity verification
|
||||||
|
|
||||||
|
## Troubleshooting
|
||||||
|
|
||||||
|
### Check Status
|
||||||
|
```bash
|
||||||
|
sudo ksigner status
|
||||||
|
```
|
||||||
|
|
||||||
|
### View Logs
|
||||||
|
```bash
|
||||||
|
sudo tail -f /var/log/ksigner.log
|
||||||
|
```
|
||||||
|
|
||||||
|
### Verify MOK Enrollment
|
||||||
|
```bash
|
||||||
|
sudo mokutil --list-enrolled
|
||||||
|
```
|
||||||
|
|
||||||
|
### Re-enroll Keys
|
||||||
|
If keys become corrupted or lost:
|
||||||
|
```bash
|
||||||
|
sudo ksigner setup
|
||||||
|
# Then reboot and re-enroll MOK
|
||||||
|
```
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
This software is released under the MIT License. See LICENSE file for details.
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
Contributions are welcome! Please submit pull requests or issues through the project repository.
|
||||||
|
|
||||||
|
## Support
|
||||||
|
|
||||||
|
For support, please:
|
||||||
|
1. Check the man page: `man ksigner`
|
||||||
|
2. Review logs in `/var/log/ksigner.log`
|
||||||
|
3. Use the status command: `sudo ksigner status`
|
||||||
|
4. File issues in the project repository
|
||||||
147
docs/ksigner.8.in
Normal file
147
docs/ksigner.8.in
Normal file
@ -0,0 +1,147 @@
|
|||||||
|
.TH KSIGNER 8 "September 2025" "ksigner @VERSION@" "System Administration"
|
||||||
|
|
||||||
|
.SH NAME
|
||||||
|
ksigner \- Secure Boot kernel signing utility
|
||||||
|
|
||||||
|
.SH SYNOPSIS
|
||||||
|
.B ksigner
|
||||||
|
.RI { setup | sign | sign-all | version | status }
|
||||||
|
.RI [ vmlinuz_kernel_filepath ]
|
||||||
|
|
||||||
|
.SH DESCRIPTION
|
||||||
|
.B ksigner
|
||||||
|
is a utility for signing Linux kernels with custom keys for Secure Boot environments.
|
||||||
|
It supports signing individual kernels or all available kernels.
|
||||||
|
|
||||||
|
.SH COMMANDS
|
||||||
|
.TP
|
||||||
|
.B setup
|
||||||
|
Create and install signing keys. This must be run before any signing operations.
|
||||||
|
The command generates RSA-4096 keys, converts them to appropriate formats,
|
||||||
|
installs them in the system directories, and imports them to the Machine Owner Key (MOK) database.
|
||||||
|
After running this command, you must reboot and enroll the keys through the MOK management interface.
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.B sign
|
||||||
|
Sign a single kernel file. If no kernel filepath is provided, signs the latest available kernel.
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.B sign-all
|
||||||
|
Sign all available kernels in /boot that match the pattern vmlinuz-*.
|
||||||
|
Excludes rescue kernels.
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.B version
|
||||||
|
Display version information.
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.B status
|
||||||
|
Show the current status of signing keys and MOK enrollment.
|
||||||
|
|
||||||
|
.SH FILES
|
||||||
|
.TP
|
||||||
|
.I /etc/ksigner/ksigner.conf
|
||||||
|
Main configuration file. Contains key paths, automatic signing settings, and LTS version definitions.
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.I /etc/pki/sbsign/certs/MOK.pem
|
||||||
|
Public signing key in PEM format.
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.I /etc/pki/sbsign/private/MOK.priv
|
||||||
|
Private signing key.
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.I /etc/pki/sbsign/certs/MOK.der
|
||||||
|
Public signing key in DER format for MOK import.
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.I /etc/kernel/postinst.d/zz-ksigner
|
||||||
|
Kernel update hook script for automatic signing.
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.I /var/log/ksigner.log
|
||||||
|
Log file for automatic signing operations.
|
||||||
|
|
||||||
|
.SH CONFIGURATION
|
||||||
|
The behavior of ksigner can be customized through the configuration file
|
||||||
|
.IR /etc/ksigner/ksigner.conf .
|
||||||
|
Key configuration options include:
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.B KEY_LIFETIME_DAYS
|
||||||
|
Number of days the signing keys should remain valid (default: 36500, approximately 100 years).
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.B SIGN_ON_UPDATE
|
||||||
|
Enable or disable automatic signing when kernels are updated (default: true).
|
||||||
|
|
||||||
|
.TP
|
||||||
|
.B AUTO_SIGN_TYPE
|
||||||
|
Type of automatic signing to perform on kernel updates.
|
||||||
|
Valid options are: sign, sign-all (default: sign).
|
||||||
|
|
||||||
|
.SH AUTOMATIC KERNEL SIGNING
|
||||||
|
When SIGN_ON_UPDATE is enabled in the configuration, new kernels are automatically signed
|
||||||
|
when they are installed through the package manager. The kernel update hook script
|
||||||
|
.I /etc/kernel/postinst.d/zz-ksigner
|
||||||
|
is executed during kernel package installation and performs the configured signing operation.
|
||||||
|
|
||||||
|
.SH EXAMPLES
|
||||||
|
.TP
|
||||||
|
Set up signing keys for the first time:
|
||||||
|
.B ksigner setup
|
||||||
|
|
||||||
|
.TP
|
||||||
|
Sign the latest kernel:
|
||||||
|
.B ksigner sign
|
||||||
|
|
||||||
|
.TP
|
||||||
|
Sign a specific kernel:
|
||||||
|
.B ksigner sign /boot/vmlinuz-6.1.0-13-amd64
|
||||||
|
|
||||||
|
.TP
|
||||||
|
Sign all kernels:
|
||||||
|
.B ksigner sign-all
|
||||||
|
|
||||||
|
.TP
|
||||||
|
Check the status of signing keys:
|
||||||
|
.B ksigner status
|
||||||
|
|
||||||
|
.SH REQUIREMENTS
|
||||||
|
The following packages must be installed for ksigner to function:
|
||||||
|
.IP \(bu 4
|
||||||
|
openssl - for key generation and certificate operations
|
||||||
|
.IP \(bu 4
|
||||||
|
mokutil - for Machine Owner Key management
|
||||||
|
.IP \(bu 4
|
||||||
|
sbsigntools - for signing kernels (provides sbsign command)
|
||||||
|
.IP \(bu 4
|
||||||
|
hmaccalc - for generating kernel HMAC files
|
||||||
|
.IP \(bu 4
|
||||||
|
sudo - for privilege escalation
|
||||||
|
.IP \(bu 4
|
||||||
|
bash (version 4.0 or later) - for shell scripting features
|
||||||
|
|
||||||
|
.SH SECURITY CONSIDERATIONS
|
||||||
|
.IP \(bu 4
|
||||||
|
Private keys are stored with restrictive permissions (600) in /etc/pki/sbsign/private/
|
||||||
|
.IP \(bu 4
|
||||||
|
The setup process requires manual MOK enrollment to prevent unauthorized key installation
|
||||||
|
.IP \(bu 4
|
||||||
|
All operations require root privileges
|
||||||
|
.IP \(bu 4
|
||||||
|
HMAC files are generated for signed kernels to maintain integrity
|
||||||
|
|
||||||
|
.SH EXIT STATUS
|
||||||
|
.B ksigner
|
||||||
|
exits with status 0 on success, and non-zero on error.
|
||||||
|
|
||||||
|
.SH BUGS
|
||||||
|
Report bugs to your distribution's bug tracking system or the project repository.
|
||||||
|
|
||||||
|
.SH SEE ALSO
|
||||||
|
.BR mokutil (8),
|
||||||
|
.BR sbsign (1),
|
||||||
|
.BR openssl (1),
|
||||||
|
.BR systemctl (1)
|
||||||
70
ksigner.spec.in
Normal file
70
ksigner.spec.in
Normal file
@ -0,0 +1,70 @@
|
|||||||
|
Name: ksigner
|
||||||
|
Version: @VERSION@
|
||||||
|
Release: @RELEASE@%{?dist}
|
||||||
|
Summary: Secure Boot kernel signing utility
|
||||||
|
|
||||||
|
License: MIT
|
||||||
|
URL: https://git.radon.win/radon/ksigner
|
||||||
|
Source0: %{name}-%{version}.tar.gz
|
||||||
|
|
||||||
|
BuildArch: noarch
|
||||||
|
|
||||||
|
Requires: openssl
|
||||||
|
Requires: mokutil
|
||||||
|
Requires: sbsigntools
|
||||||
|
Requires: hmaccalc
|
||||||
|
Requires: sudo
|
||||||
|
Requires: bash >= 4.0
|
||||||
|
|
||||||
|
%description
|
||||||
|
A utility for signing Linux kernels with custom keys for Secure Boot.
|
||||||
|
Supports signing individual kernels or all kernels.
|
||||||
|
|
||||||
|
%prep
|
||||||
|
%setup -q
|
||||||
|
|
||||||
|
%build
|
||||||
|
# Nothing to build - shell script
|
||||||
|
|
||||||
|
%install
|
||||||
|
# Create directories
|
||||||
|
install -d %{buildroot}%{_bindir}
|
||||||
|
install -d %{buildroot}%{_sysconfdir}/ksigner
|
||||||
|
install -d %{buildroot}%{_unitdir}
|
||||||
|
install -d %{buildroot}%{_sysconfdir}/kernel/postinst.d
|
||||||
|
install -d %{buildroot}%{_mandir}/man8
|
||||||
|
|
||||||
|
# Install main script
|
||||||
|
install -m 755 ksigner %{buildroot}%{_bindir}/ksigner
|
||||||
|
|
||||||
|
# Install configuration file
|
||||||
|
install -m 644 ksigner.conf %{buildroot}%{_sysconfdir}/ksigner/ksigner.conf
|
||||||
|
|
||||||
|
# Install kernel update hook
|
||||||
|
install -m 755 ksigner-update-hook %{buildroot}%{_sysconfdir}/kernel/postinst.d/zz-ksigner
|
||||||
|
|
||||||
|
# Install man page
|
||||||
|
install -m 644 ksigner.8 %{buildroot}%{_mandir}/man8/ksigner.8
|
||||||
|
|
||||||
|
%post
|
||||||
|
echo "==========================================="
|
||||||
|
echo "Kernel Signer has been installed."
|
||||||
|
echo "To set up kernel signing:"
|
||||||
|
echo " 1. Run: sudo ksigner setup"
|
||||||
|
echo " 2. Reboot your system"
|
||||||
|
echo " 3. In MOK Manager: Enroll MOK → Continue → Yes → Enter password"
|
||||||
|
echo "==========================================="
|
||||||
|
|
||||||
|
%files
|
||||||
|
%license LICENSE
|
||||||
|
%doc README.md
|
||||||
|
%{_bindir}/ksigner
|
||||||
|
%config(noreplace) %{_sysconfdir}/ksigner/ksigner.conf
|
||||||
|
%{_sysconfdir}/kernel/postinst.d/zz-ksigner
|
||||||
|
%{_mandir}/man8/ksigner.8*
|
||||||
|
|
||||||
|
%changelog
|
||||||
|
* Tue Sep 23 2025 RadioactivePb <radioactivepb@gmail.com> - @VERSION@-@RELEASE@
|
||||||
|
- Initial RPM release
|
||||||
|
- Added automatic kernel signing on updates
|
||||||
|
- Added configuration file support
|
||||||
67
src/ksigner-update-hook
Normal file
67
src/ksigner-update-hook
Normal file
@ -0,0 +1,67 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# Kernel update hook for automatic signing
|
||||||
|
# This script is called when new kernels are installed
|
||||||
|
|
||||||
|
CONFIG_FILE="/etc/ksigner/ksigner.conf"
|
||||||
|
KERNEL_SIGNER="/usr/bin/ksigner"
|
||||||
|
LOG_FILE="/var/log/ksigner.log"
|
||||||
|
|
||||||
|
# Source configuration
|
||||||
|
if [[ -f "$CONFIG_FILE" ]]; then
|
||||||
|
source "$CONFIG_FILE"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Default values
|
||||||
|
SIGN_ON_UPDATE=${SIGN_ON_UPDATE:-true}
|
||||||
|
AUTO_SIGN_TYPE=${AUTO_SIGN_TYPE:-sign}
|
||||||
|
LOG_FILE=${LOG_FILE:-/var/log/ksigner.log}
|
||||||
|
|
||||||
|
log_message() {
|
||||||
|
echo "$(date '+%Y-%m-%d %H:%M:%S') - ksigner-update-hook: $1" >>"$LOG_FILE"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Exit if automatic signing is disabled
|
||||||
|
if [[ "$SIGN_ON_UPDATE" != "true" ]]; then
|
||||||
|
log_message "Automatic signing disabled, skipping"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Check if ksigner exists and keys are set up
|
||||||
|
if [[ ! -x "$KERNEL_SIGNER" ]]; then
|
||||||
|
log_message "ksigner not found at $KERNEL_SIGNER"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ ! -f "/etc/pki/sbsign/certs/MOK.pem" ]]; then
|
||||||
|
log_message "Signing keys not found, run 'ksigner setup' first"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Get the kernel version from the environment or find the latest
|
||||||
|
if [[ -n "$KERNEL_VERSION" ]]; then
|
||||||
|
KERNEL_FILE="/boot/vmlinuz-$KERNEL_VERSION"
|
||||||
|
if [[ -f "$KERNEL_FILE" ]]; then
|
||||||
|
log_message "Signing newly installed kernel: $KERNEL_VERSION"
|
||||||
|
if "$KERNEL_SIGNER" sign "$KERNEL_FILE" >>"$LOG_FILE" 2>&1; then
|
||||||
|
log_message "Successfully signed kernel $KERNEL_VERSION"
|
||||||
|
else
|
||||||
|
log_message "Failed to sign kernel $KERNEL_VERSION"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
log_message "Kernel file not found: $KERNEL_FILE"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
# Fallback to configured auto-sign type
|
||||||
|
log_message "Running automatic signing: $AUTO_SIGN_TYPE"
|
||||||
|
if "$KERNEL_SIGNER" "$AUTO_SIGN_TYPE" >>"$LOG_FILE" 2>&1; then
|
||||||
|
log_message "Successfully completed $AUTO_SIGN_TYPE"
|
||||||
|
else
|
||||||
|
log_message "Failed to complete $AUTO_SIGN_TYPE"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
exit 0
|
||||||
25
src/ksigner.conf
Normal file
25
src/ksigner.conf
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
# Configuration file for ksigner
|
||||||
|
# This file is sourced by the ksigner script
|
||||||
|
|
||||||
|
# Key lifetime in days (default: 100 years)
|
||||||
|
KEY_LIFETIME_DAYS=$((365 * 100))
|
||||||
|
|
||||||
|
# Directory paths for keys
|
||||||
|
KEY_PUB_DIR="/etc/pki/sbsign/certs/"
|
||||||
|
KEY_PRIV_DIR="/etc/pki/sbsign/private/"
|
||||||
|
|
||||||
|
# Key filenames
|
||||||
|
KEY_PUB="MOK.pem"
|
||||||
|
KEY_PRIV="MOK.priv"
|
||||||
|
KEY_DER="MOK.der"
|
||||||
|
|
||||||
|
# Automatic signing on kernel updates
|
||||||
|
# Set to true to enable automatic signing when kernels are updated
|
||||||
|
SIGN_ON_UPDATE=true
|
||||||
|
|
||||||
|
# Type of automatic signing to perform
|
||||||
|
# Options: sign, sign-all
|
||||||
|
AUTO_SIGN_TYPE="sign"
|
||||||
|
|
||||||
|
# Log file for automatic signing operations
|
||||||
|
LOG_FILE="/var/log/ksigner.log"
|
||||||
276
src/ksigner.in
Normal file
276
src/ksigner.in
Normal file
@ -0,0 +1,276 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# ksigner - Secure Boot kernel signing utility
|
||||||
|
# Version: @VERSION@
|
||||||
|
|
||||||
|
# Source configuration
|
||||||
|
CONFIG_FILE="/etc/ksigner/ksigner.conf"
|
||||||
|
if [[ -f "$CONFIG_FILE" ]]; then
|
||||||
|
source "$CONFIG_FILE"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Default configuration values (can be overridden in config file)
|
||||||
|
KEY_LIFETIME_DAYS=${KEY_LIFETIME_DAYS:-$((365 * 100))}
|
||||||
|
KEY_PUB_DIR=${KEY_PUB_DIR:-/etc/pki/sbsign/certs/}
|
||||||
|
KEY_PUB=${KEY_PUB:-MOK.pem}
|
||||||
|
KEY_PRIV_DIR=${KEY_PRIV_DIR:-/etc/pki/sbsign/private/}
|
||||||
|
KEY_PRIV=${KEY_PRIV:-MOK.priv}
|
||||||
|
KEY_DER=${KEY_DER:-MOK.der}
|
||||||
|
SIGN_ON_UPDATE=${SIGN_ON_UPDATE:-true}
|
||||||
|
AUTO_SIGN_TYPE=${AUTO_SIGN_TYPE:-sign}
|
||||||
|
|
||||||
|
REQUIRED_BINARIES=(
|
||||||
|
"openssl"
|
||||||
|
"mokutil"
|
||||||
|
"sbsign"
|
||||||
|
"sha512hmac"
|
||||||
|
)
|
||||||
|
|
||||||
|
panic() {
|
||||||
|
echo "ERROR: $1" >&2
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
log() {
|
||||||
|
echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" >&2
|
||||||
|
}
|
||||||
|
|
||||||
|
usage() {
|
||||||
|
echo "Usage: $0 {setup|sign|sign-all|version|status} [vmlinuz_kernel_filepath]"
|
||||||
|
echo " setup - Create and install signing keys"
|
||||||
|
echo " sign - Sign a kernel file (optional: vmlinuz_kernel_filepath)"
|
||||||
|
echo " sign-all - Sign all available kernels"
|
||||||
|
echo " version - Show version information"
|
||||||
|
echo " status - Show signing key status"
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
version() {
|
||||||
|
echo "ksigner version @VERSION@"
|
||||||
|
echo "Copyright (C) 2025"
|
||||||
|
echo "This is free software; see the source for copying conditions."
|
||||||
|
}
|
||||||
|
|
||||||
|
status() {
|
||||||
|
echo "Kernel Signer Status:"
|
||||||
|
echo "====================="
|
||||||
|
echo "Public key file: $KEY_PUB_DIR$KEY_PUB"
|
||||||
|
if [[ -f "$KEY_PUB_DIR$KEY_PUB" ]]; then
|
||||||
|
echo " Status: Found"
|
||||||
|
echo " Details:"
|
||||||
|
openssl x509 -in "$KEY_PUB_DIR$KEY_PUB" -noout -subject -dates 2>/dev/null || echo " Error reading certificate"
|
||||||
|
else
|
||||||
|
echo " Status: Not found"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Private key file: $KEY_PRIV_DIR$KEY_PRIV"
|
||||||
|
[[ -f "$KEY_PRIV_DIR$KEY_PRIV" ]] && echo " Status: Found" || echo " Status: Not found"
|
||||||
|
|
||||||
|
echo "DER key file: $KEY_PUB_DIR$KEY_DER"
|
||||||
|
[[ -f "$KEY_PUB_DIR$KEY_DER" ]] && echo " Status: Found" || echo " Status: Not found"
|
||||||
|
|
||||||
|
echo "MOK keys enrolled:"
|
||||||
|
mokutil --list-enrolled 2>/dev/null | grep -A 3 -B 1 "Kernel Signing" || echo " No custom MOK keys found"
|
||||||
|
|
||||||
|
echo "Configuration file: $CONFIG_FILE"
|
||||||
|
[[ -f "$CONFIG_FILE" ]] && echo " Status: Found" || echo " Status: Using defaults"
|
||||||
|
}
|
||||||
|
|
||||||
|
req_check() {
|
||||||
|
local missing_binaries=()
|
||||||
|
for binary in "${REQUIRED_BINARIES[@]}"; do
|
||||||
|
if ! command -v "$binary" >/dev/null 2>&1; then
|
||||||
|
missing_binaries+=("$binary")
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
if [[ ${#missing_binaries[@]} -gt 0 ]]; then
|
||||||
|
echo "Missing required binaries: ${missing_binaries[*]}" >&2
|
||||||
|
echo "Please install the following packages:" >&2
|
||||||
|
for binary in "${missing_binaries[@]}"; do
|
||||||
|
case "$binary" in
|
||||||
|
"openssl") echo " - openssl" >&2 ;;
|
||||||
|
"mokutil") echo " - mokutil" >&2 ;;
|
||||||
|
"sbsign") echo " - sbsigntools" >&2 ;;
|
||||||
|
"sha512hmac") echo " - hmaccalc" >&2 ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
log "All required binaries are present"
|
||||||
|
}
|
||||||
|
|
||||||
|
version_greater() {
|
||||||
|
local ver1="$1"
|
||||||
|
local ver2="$2"
|
||||||
|
[ "$ver1" = "$(printf '%s\n%s' "$ver1" "$ver2" | sort -V | tail -n1)" ]
|
||||||
|
}
|
||||||
|
|
||||||
|
find_all_kernels() {
|
||||||
|
local all_files=()
|
||||||
|
for file in /boot/vmlinuz-*; do
|
||||||
|
[ -f "$file" ] || continue
|
||||||
|
if [[ "$file" == *"rescue"* ]]; then
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
all_files+=("$file")
|
||||||
|
done
|
||||||
|
echo "${all_files[@]}"
|
||||||
|
}
|
||||||
|
|
||||||
|
find_latest_kernel() {
|
||||||
|
local latest_file=""
|
||||||
|
local latest_version=""
|
||||||
|
for file in /boot/vmlinuz-*; do
|
||||||
|
[ -f "$file" ] || continue
|
||||||
|
if [[ "$file" == *"rescue"* ]]; then
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
local kver="${file#*vmlinuz-}"
|
||||||
|
kver="${kver%%-*}"
|
||||||
|
if [ -z "$latest_version" ] || version_greater "$kver" "$latest_version"; then
|
||||||
|
latest_version="$kver"
|
||||||
|
latest_file="$file"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
echo "$latest_file"
|
||||||
|
}
|
||||||
|
|
||||||
|
setup_signing_keys() {
|
||||||
|
# Step 1: Create the signing keys
|
||||||
|
log "[Step 1] Creating signing keys..."
|
||||||
|
openssl req -new -x509 -newkey rsa:4096 \
|
||||||
|
-keyout $KEY_PRIV \
|
||||||
|
-outform DER -out $KEY_DER \
|
||||||
|
-nodes -days $KEY_LIFETIME_DAYS -subj "/CN=Kernel Signing/" ||
|
||||||
|
panic "[Step 1] Failed to create signing keys"
|
||||||
|
|
||||||
|
# Step 2: Convert the keys to PEM format
|
||||||
|
log "[Step 2] Converting keys to PEM format..."
|
||||||
|
openssl x509 -inform der -in $KEY_DER -out $KEY_PUB ||
|
||||||
|
panic "[Step 2] Failed to convert keys to PEM format"
|
||||||
|
|
||||||
|
# Step 3: Create the directory for the keys
|
||||||
|
log "[Step 3] Creating the directory for the keys..."
|
||||||
|
mkdir -p $KEY_PUB_DIR $KEY_PRIV_DIR ||
|
||||||
|
panic "[Step 3] Failed to create the directory for the keys"
|
||||||
|
|
||||||
|
# Step 4: Copy the keys to the directory
|
||||||
|
log "[Step 4] Copying the keys to the directory..."
|
||||||
|
mv -f $KEY_DER $KEY_PUB $KEY_PUB_DIR ||
|
||||||
|
panic "[Step 4a] Failed to copy the keys to the directory"
|
||||||
|
mv -f $KEY_PRIV $KEY_PRIV_DIR ||
|
||||||
|
panic "[Step 4b] Failed to copy the keys to the directory"
|
||||||
|
|
||||||
|
# Step 5: Set the permissions for the keys
|
||||||
|
log "[Step 5] Setting the permissions for the keys..."
|
||||||
|
chmod -R 600 $KEY_PRIV_DIR ||
|
||||||
|
panic "[Step 5] Failed to set the permissions for the keys"
|
||||||
|
|
||||||
|
# Step 6: Import the keys to the MOK
|
||||||
|
log "[Step 6] Importing the keys to the MOK..."
|
||||||
|
mokutil --import $KEY_PUB_DIR$KEY_DER ||
|
||||||
|
panic "[Step 6] Failed to import the keys to the MOK"
|
||||||
|
|
||||||
|
echo
|
||||||
|
log "Signing keys have been created and installed"
|
||||||
|
echo
|
||||||
|
echo "Please reboot your computer and enroll the keys with MOK"
|
||||||
|
echo
|
||||||
|
echo "Enroll MOK -> Continue -> Yes -> Enter password -> OK"
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
sign_kernel() {
|
||||||
|
local kern_version="$1"
|
||||||
|
local kern_file="$2"
|
||||||
|
|
||||||
|
# Step 1: Sign the kernel
|
||||||
|
log "[Step 1] Signing '$kern_version'..."
|
||||||
|
/usr/bin/sbsign \
|
||||||
|
--key "$KEY_PRIV_DIR$KEY_PRIV" \
|
||||||
|
--cert "$KEY_PUB_DIR$KEY_PUB" \
|
||||||
|
"$kern_file" \
|
||||||
|
--output "$kern_file.signed" ||
|
||||||
|
panic "[Step 1] Failed to sign '$kern_version'"
|
||||||
|
|
||||||
|
# Step 2: Verify the kernel was signed
|
||||||
|
log "[Step 2] Verifying '$kern_file' was signed"
|
||||||
|
[ -f "$kern_file.signed" ] ||
|
||||||
|
panic "'$kern_file.signed' was not found"
|
||||||
|
|
||||||
|
# Step 3: Move the signed kernel
|
||||||
|
log "[Step 3] Moving '$kern_file.signed' to '$kern_file'"
|
||||||
|
mv -f "$kern_file.signed" "$kern_file" ||
|
||||||
|
panic "Failed to move '$kern_file.signed'"
|
||||||
|
|
||||||
|
# Step 4: Make the kernel executable
|
||||||
|
log "[Step 4] Setting permissions for '$kern_file'"
|
||||||
|
chmod +x "$kern_file" ||
|
||||||
|
panic "Failed to make '$kern_file' executable"
|
||||||
|
|
||||||
|
# Step 5: Create the HMAC
|
||||||
|
log "[Step 5] Creating HMAC for '$kern_file'"
|
||||||
|
sha512hmac "$kern_file" >"${kern_file/vmlinuz/.vmlinuz}.hmac" ||
|
||||||
|
panic "Failed to create HMAC for '$kern_file'"
|
||||||
|
|
||||||
|
echo
|
||||||
|
log "Signed '$kern_version' successfully"
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
file_checks() {
|
||||||
|
local kfile="$1"
|
||||||
|
[ -e "$kfile" ] ||
|
||||||
|
panic "Kernel file '$kfile' was not found"
|
||||||
|
[ -e "$KEY_PUB_DIR$KEY_PUB" ] ||
|
||||||
|
panic "'$KEY_PUB_DIR$KEY_PUB' was not found, please run 'setup' first"
|
||||||
|
[ -e "$KEY_PRIV_DIR$KEY_PRIV" ] ||
|
||||||
|
panic "'$KEY_PRIV_DIR$KEY_PRIV' was not found, please run 'setup' first"
|
||||||
|
}
|
||||||
|
|
||||||
|
main() {
|
||||||
|
case "$1" in
|
||||||
|
"setup")
|
||||||
|
req_check
|
||||||
|
setup_signing_keys
|
||||||
|
;;
|
||||||
|
"sign")
|
||||||
|
req_check
|
||||||
|
shift
|
||||||
|
[ -n "$1" ] &&
|
||||||
|
kfile="$1" ||
|
||||||
|
kfile="$(find_latest_kernel)"
|
||||||
|
kver="${kfile#*vmlinuz-}"
|
||||||
|
kver="${kver%%-*}"
|
||||||
|
file_checks "$kfile"
|
||||||
|
sign_kernel "$kver" "$kfile"
|
||||||
|
;;
|
||||||
|
"sign-all")
|
||||||
|
req_check
|
||||||
|
all_kernels_str=$(find_all_kernels)
|
||||||
|
read -ra all_kernels <<<"$all_kernels_str"
|
||||||
|
for kfile in "${all_kernels[@]}"; do
|
||||||
|
[ -n "$kfile" ] || continue
|
||||||
|
kver="${kfile#*vmlinuz-}"
|
||||||
|
kver="${kver%%-*}"
|
||||||
|
file_checks "$kfile"
|
||||||
|
sign_kernel "$kver" "$kfile"
|
||||||
|
done
|
||||||
|
;;
|
||||||
|
"version")
|
||||||
|
version
|
||||||
|
;;
|
||||||
|
"status")
|
||||||
|
status
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
usage
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
# Ensure running as root
|
||||||
|
[[ $EUID -eq 0 ]] || exec sudo "$0" "$@"
|
||||||
|
|
||||||
|
main "$@"
|
||||||
Loading…
x
Reference in New Issue
Block a user