Commit f3a2ba44e93e2c ("certs: check-in the default x509 config file") adds default x509 keypair config file template, but forgets to mention it in kernel module signing documentation. Update the doc accordingly. Signed-off-by: Bagas Sanjaya <bagasdotme@xxxxxxxxx> --- Documentation/admin-guide/module-signing.rst | 41 ++++++++------------ 1 file changed, 17 insertions(+), 24 deletions(-) diff --git a/Documentation/admin-guide/module-signing.rst b/Documentation/admin-guide/module-signing.rst index 7d7c7c8a545ca6..365d60a6245f17 100644 --- a/Documentation/admin-guide/module-signing.rst +++ b/Documentation/admin-guide/module-signing.rst @@ -133,46 +133,39 @@ kernel so that it can be used to check the signatures as the modules are loaded. Under normal conditions, when ``CONFIG_MODULE_SIG_KEY`` is unchanged from its -default, the kernel build will automatically generate a new keypair using -openssl if one does not exist in the file:: - - certs/signing_key.pem - +default, the kernel build will automatically generate a new keypair in +``certs/signing_key.pem`` using openssl if it doesn't exist, during the building of vmlinux (the public part of the key needs to be built -into vmlinux) using parameters in the:: - - certs/x509.genkey - +into vmlinux) using parameters in the ``certs/x509.genkey`` configuration file (which is also generated if it does not already exist). -It is strongly recommended that you provide your own x509.genkey file. - -Most notably, in the x509.genkey file, the req_distinguished_name section -should be altered from the default:: +If you'd like to provide alternative configuration, copy +``certs/default_x509.genkey`` to ``certs/x509.genkey`` and edit the copy +instead. Most likely, you will want to edit the ``req_distinguished_name`` +section, which identifies the resulting keypair. For example:: [ req_distinguished_name ] - #O = Unspecified company - CN = Build time autogenerated kernel key - #emailAddress = unspecified.user@unspecified.company + O = Example company + CN = Example kernel build + emailAddress = user@xxxxxxxxxxx The generated RSA key size can also be set with:: [ req ] default_bits = 4096 - -It is also possible to manually generate the key private/public files using the -x509.genkey key generation configuration file in the root node of the Linux -kernel sources tree and the openssl command. The following is an example to -generate the public/private key files:: +Optionally, you can also manually generate the keypair so that the same +keypair can be used in multiple builds. To generate it:: openssl req -new -nodes -utf8 -sha256 -days 36500 -batch -x509 \ -config x509.genkey -outform PEM -out kernel_key.pem \ -keyout kernel_key.pem -The full pathname for the resulting kernel_key.pem file can then be specified -in the ``CONFIG_MODULE_SIG_KEY`` option, and the certificate and key therein will -be used instead of an autogenerated keypair. +See :manpage:`openssl-req(1)` for the explanation. + +The full pathname for the resulting ``kernel_key.pem`` file can then be +specified in the ``CONFIG_MODULE_SIG_KEY`` option, and the certificate and key +therein will be used instead of an autogenerated keypair. ========================= base-commit: ac9a78681b921877518763ba0e89202254349d1b -- An old man doll... just what I always wanted! - Clara