Building out-of-tree kernel modules is not usually recommended for newbies like me so that to avoid problems like
Usually, you have to use modules compiled with your kernel. Saying Y here makes it sometimes possible to use modules compiled for different kernels, by adding enough information to the modules to (hopefully) spot any changes which would make them incompatible with the kernel you are running.
Also the warning:
loading out-of-tree module taints kernel
Forced module loading may lead to situations like undefined symbols / references (functions / variables exported and available at
I researched and found out that you need to sign the module to load it
But it also doesn't make sense when I think about how any developer would be able to extend the kernel by writing modules if this barrier is in place.
It's the intended behavior:
Module signing increases security by making it harder to load a malicious module into the kernel.
And that's why
MODULE_SIG_FORCE is there. On PCs
UEFI Secure Boot necessarily requires kernel and modules to be signed as a part of secure boot chain. Android's
Verified Boot signs whole
boot partition though, which then - using
dm-verity - secures
/vendor; the partitions which may possibly include kernel's loadable modules. So signing modules doesn't seem necessary:
Module signing isn't mandatory and isn't tested against
Quoted from Loadable Kernel Modules.
I assume there is no way of obtaining the private key which the kernel used originally while compiling.
You are right. Public / private key pair is generated (using
openssl) when building kernel. Public key is built into the kernel and can be viewed in
/proc/keys or by:
~# keyctl list %:.system_keyring
If kernel was built with
IKCONFIG_PROC, hash algorithm can be seen by:
~# zcat /proc/config.gz | grep MODULE_SIG_HASH
A perl script is also part of kernel source tree which can be used to sign modules:
~$ sign-file <algorithm> <priv_key_file> <pub_key_file> <module>.ko
Is there a way to disable signature enforcement of the kernel and load the module that I created?
Alternatively, can I somehow sign my module and load it?
Ask the kernel developer to provide the same private key (if possible), otherwise only option is to rebuild whole kernel. Get configuration of running kernel from
/proc/config.gz if available and required. Don't forget to unset
CONFIG_MODULE_SIG or set
SOURCE: Building External Modules