diff --git a/README.md b/README.md index 02b3e69..0542eb8 100644 --- a/README.md +++ b/README.md @@ -7,6 +7,7 @@ A secure boot kernel signing utility This package provides a comprehensive solution for signing Linux kernels with custom keys for Secure Boot environments. It includes: - Automatic key generation and MOK enrollment +- Automatic kernel signing via libdnf5 actions plugin - Support for signing individual or all kernels - Configurable through `/etc/ksigner/ksigner.conf` - Comprehensive logging and status reporting @@ -37,6 +38,8 @@ make srpm 3. Install the package: ```bash +sudo dnf install noarch/ksigner*.rpm +# Alternatively sudo rpm -ivh ksigner*.rpm ``` @@ -49,6 +52,8 @@ The following packages will be automatically installed as dependencies: - `hmaccalc` - HMAC generation for signed kernels - `sudo` - Privilege escalation - `bash` (>= 4.0) - Shell scripting features +- `dnf5` - RPM package management +- `libdnf5-plugin-actions` - DNF transaction actions ## Quick Start @@ -79,6 +84,26 @@ sudo ksigner status Edit `/etc/ksigner/ksigner.conf` to customize behavior +```conf +# Key lifetime in days (default: 100 years) +KEY_LIFETIME_DAYS=$((365 * 100)) + +# Directory paths for keys +KEY_PUB_DIR="/etc/pki/sbsign/certs/" +KEY_PRIV_DIR="/etc/pki/sbsign/private/" + +# Key filenames +KEY_PUB="MOK.pem" +KEY_PRIV="MOK.priv" +KEY_DER="MOK.der" + +# Log file +LOG_FILE="/var/log/ksigner.log" + +# Automatically sign kernels when they are installed +# AUTO_SIGN=true +``` + ## Commands - `ksigner setup` - Create and install signing keys @@ -94,6 +119,7 @@ Edit `/etc/ksigner/ksigner.conf` to customize behavior - **Private Key**: `/etc/pki/sbsign/private/MOK.priv` - **DER Key**: `/etc/pki/sbsign/certs/MOK.der` - **Log File**: `/var/log/ksigner.log` +- **Action File**: `/etc/dnf/libdnf5-plugins/actions.d/ksigner.action` ## Security Notes