{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/bugs/issues/1054","labels_url":"https://api.github.com/repos/coreos/bugs/issues/1054/labels{/name}","comments_url":"https://api.github.com/repos/coreos/bugs/issues/1054/comments","events_url":"https://api.github.com/repos/coreos/bugs/issues/1054/events","html_url":"https://github.com/coreos/bugs/issues/1054","id":123995823,"number":1054,"title":"Are kernel modules really signed?","user":{"login":"maticmeznar","id":13099105,"avatar_url":"https://avatars.githubusercontent.com/u/13099105?v=3","gravatar_id":"","url":"https://api.github.com/users/maticmeznar","html_url":"https://github.com/maticmeznar","followers_url":"https://api.github.com/users/maticmeznar/followers","following_url":"https://api.github.com/users/maticmeznar/following{/other_user}","gists_url":"https://api.github.com/users/maticmeznar/gists{/gist_id}","starred_url":"https://api.github.com/users/maticmeznar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maticmeznar/subscriptions","organizations_url":"https://api.github.com/users/maticmeznar/orgs","repos_url":"https://api.github.com/users/maticmeznar/repos","events_url":"https://api.github.com/users/maticmeznar/events{/privacy}","received_events_url":"https://api.github.com/users/maticmeznar/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/coreos/bugs/labels/area/distribution","name":"area/distribution","color":"bfe5bf"},{"url":"https://api.github.com/repos/coreos/bugs/labels/component/kernel","name":"component/kernel","color":"0052cc"},{"url":"https://api.github.com/repos/coreos/bugs/labels/kind/question","name":"kind/question","color":"c7def8"},{"url":"https://api.github.com/repos/coreos/bugs/labels/team/os","name":"team/os","color":"ffffff"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-12-27T20:50:54Z","updated_at":"2016-01-04T23:57:47Z","closed_at":null,"body":"I was unable to find any relevant CoreOS documentation on a canonical way of enabling signature verification of kernel modules. Also, modinfo doesn't show modules as being signed:\r\n\r\nCoreOS 877.1.0:\r\n```\r\n$ modinfo ip_tables\r\nfilename:       /lib/modules/4.3.0-coreos/kernel/net/ipv4/netfilter/ip_tables.ko\r\ndescription:    IPv4 packet filter\r\nauthor:         Netfilter Core Team <coreteam@netfilter.org>\r\nlicense:        GPL\r\ndepends:        \r\nintree:         Y\r\nvermagic:       4.3.0-coreos SMP mod_unload \r\n```\r\nUbuntu 15.10:\r\n```\r\n$ modinfo ip_tables\r\nfilename:       /lib/modules/4.2.0-22-generic/kernel/net/ipv4/netfilter/ip_tables.ko\r\ndescription:    IPv4 packet filter\r\nauthor:         Netfilter Core Team <coreteam@netfilter.org>\r\nlicense:        GPL\r\nsrcversion:     D6340E11A5121FD07067C61\r\ndepends:        x_tables\r\nintree:         Y\r\nvermagic:       4.2.0-22-generic SMP mod_unload modversions \r\nsigner:         Build time autogenerated kernel key\r\nsig_key:        5B:A1:35:31:09:D2:78:49:DD:D6:FB:D5:54:A5:53:44:38:BE:AF:AB\r\nsig_hashalgo:   sha512\r\n```\r\n^^ Notice the last 3 lines.\r\n\r\nI'd like to know whether the kernel modules are really signed and how to properly enable signature verification."},"comment":{"url":"https://api.github.com/repos/coreos/bugs/issues/comments/168848736","html_url":"https://github.com/coreos/bugs/issues/1054#issuecomment-168848736","issue_url":"https://api.github.com/repos/coreos/bugs/issues/1054","id":168848736,"user":{"login":"vcaputo","id":1452963,"avatar_url":"https://avatars.githubusercontent.com/u/1452963?v=3","gravatar_id":"","url":"https://api.github.com/users/vcaputo","html_url":"https://github.com/vcaputo","followers_url":"https://api.github.com/users/vcaputo/followers","following_url":"https://api.github.com/users/vcaputo/following{/other_user}","gists_url":"https://api.github.com/users/vcaputo/gists{/gist_id}","starred_url":"https://api.github.com/users/vcaputo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vcaputo/subscriptions","organizations_url":"https://api.github.com/users/vcaputo/orgs","repos_url":"https://api.github.com/users/vcaputo/repos","events_url":"https://api.github.com/users/vcaputo/events{/privacy}","received_events_url":"https://api.github.com/users/vcaputo/received_events","type":"User","site_admin":false},"created_at":"2016-01-04T23:57:47Z","updated_at":"2016-01-04T23:57:47Z","body":"Signing is enabled, and the modules do have `~Module signature appended~` at the end, but modinfo is not reporting the signature information in the recent builds I explored.  I *suspect* I may have broken this somehow in the course of https://github.com/coreos/coreos-overlay/pull/1663, but it's unclear to me what exactly did it."}}