How do I load an unsigned Kernel Module to my signature enforcing Kernel?

Question

I compiled a kernel module (wacom.ko) using the proper kernel source for my device and Google toolchain. When I tried to insmod the module, an error message popped up saying

required keys not available

I researched and found out that you need to sign the module to load it into the kernel if the latter uses signature enforcement (which in my case, it does). I assume there is no way of obtaining the private key which the kernel used originally while compiling. But it also doesn't make sense when I think about how any developer would be able to extend the kernel by writing modules if this barrier is in place.

Is there a way to disable signature enforcement of the kernel and load the module that I created? Alternatively, can I somehow sign my module and load it?

Answer 1

Building out-of-tree kernel modules is not usually recommended for newbies like me so that to avoid problems like vermagic mismatch:

config MODVERSIONS
...
Usually, you have to use modules compiled with your kernel. Saying Y here makes it sometimes possible to use modules compiled for different kernels, by adding enough information to the modules to (hopefully) spot any changes which would make them incompatible with the kernel you are running.

Also the warning:

loading out-of-tree module taints kernel

Forced module loading may lead to situations like undefined symbols / references (functions / variables exported and available at /proc/kallsyms).

I researched and found out that you need to sign the module to load it
...
But it also doesn't make sense when I think about how any developer would be able to extend the kernel by writing modules if this barrier is in place.

It's the intended behavior:

Module signing increases security by making it harder to load a malicious module into the kernel.

And that's why MODULE_SIG_FORCE is there. On PCs UEFI Secure Boot necessarily requires kernel and modules to be signed as a part of secure boot chain. Android's Verified Boot signs whole boot partition though, which then - using dm-verity - secures /system and /vendor; the partitions which may possibly include kernel's loadable modules. So signing modules doesn't seem necessary:

Module signing isn't mandatory and isn't tested against

Quoted from Loadable Kernel Modules.

I assume there is no way of obtaining the private key which the kernel used originally while compiling.

You are right. Public / private key pair is generated (using openssl) when building kernel. Public key is built into the kernel and can be viewed in /proc/keys or by:

~# keyctl list %:.system_keyring

If kernel was built with IKCONFIG_PROC, hash algorithm can be seen by:

~# zcat /proc/config.gz | grep MODULE_SIG_HASH

A perl script is also part of kernel source tree which can be used to sign modules:

~$ sign-file <algorithm> <priv_key_file> <pub_key_file> <module>.ko

Is there a way to disable signature enforcement of the kernel and load the module that I created?

No.

Alternatively, can I somehow sign my module and load it?

Ask the kernel developer to provide the same private key (if possible), otherwise only option is to rebuild whole kernel. Get configuration of running kernel from /proc/config.gz if available and required. Don't forget to unset CONFIG_MODULE_SIG or set CONFIG_MODULE_SIG_ALL.

SOURCE: Building External Modules