kernel: Test to validates the kernel module signing and out-of-tree m…#514
Open
manjeetp89 wants to merge 1 commit into
Open
kernel: Test to validates the kernel module signing and out-of-tree m…#514manjeetp89 wants to merge 1 commit into
manjeetp89 wants to merge 1 commit into
Conversation
…odules This test validates the kernel module signing and out-of-tree modules on Qualcomm platforms with Yocto builds. Sample Logs: [INFO] 2026-07-16 04:34:32 - ------------------------------------------------- [INFO] 2026-07-16 04:34:32 - ----------- Starting Kernel_Module_Signing Test ------------- [INFO] 2026-07-16 04:34:32 - --- Checking CONFIG_MODULE_SIG kernel config --- [PASS] 2026-07-16 04:34:32 - Kernel config CONFIG_MODULE_SIG is enabled [PASS] 2026-07-16 04:34:32 - CONFIG_MODULE_SIG is enabled in kernel config. [INFO] 2026-07-16 04:34:32 - CONFIG_MODULE_SIG_FORCE is enabled (unsigned modules will be rejected). [INFO] 2026-07-16 04:34:32 - --- Checking module signature via modinfo --- [INFO] 2026-07-16 04:34:33 - Inspecting module: /usr/lib/modules/6.8.0-117-generic/updates/dkms/zfs.ko [PASS] 2026-07-16 04:34:33 - Module '/usr/lib/modules/6.8.0-117-generic/updates/dkms/zfs.ko' contains a signature field — module signing is active. [INFO] 2026-07-16 04:34:33 - sig_id : PKCS#7 [INFO] 2026-07-16 04:34:33 - signer : las-colo41-d19-18 Secure Boot Module Signature key [INFO] 2026-07-16 04:34:33 - sig_hashalgo: sha512 [INFO] 2026-07-16 04:34:33 - --- Checking for out-of-tree kernel modules --- [INFO] 2026-07-16 04:34:33 - Scanning dmesg for out-of-tree module taints... [INFO] 2026-07-16 04:34:33 - Out-of-tree modules detected in dmesg: [INFO] 2026-07-16 04:34:33 - [65034.832869] tc956x_pcie_eth: loading out-of-tree module taints kernel. [INFO] 2026-07-16 04:34:33 - Scanning /sys/module/*/taint for out-of-tree flags... [INFO] 2026-07-16 04:34:40 - Out-of-tree module (taint=O): openafs [INFO] 2026-07-16 04:34:43 - Out-of-tree module (taint=O): spl [INFO] 2026-07-16 04:34:45 - Out-of-tree module (taint=O): zfs [INFO] 2026-07-16 04:34:45 - --- Locating out-of-tree .ko files outside kernel/ subdirectory --- dir: /usr/lib/modules/6.8.0-117-generic [INFO] 2026-07-16 04:34:45 - Potential out-of-tree .ko files found (outside kernel/ tree): [INFO] 2026-07-16 04:34:45 - /usr/lib/modules/6.8.0-117-generic/updates/dkms/zfs.ko [INFO] 2026-07-16 04:34:45 - /usr/lib/modules/6.8.0-117-generic/updates/dkms/spl.ko [INFO] 2026-07-16 04:34:46 - /usr/lib/modules/6.8.0-117-generic/updates/dkms/openafs.ko.zst [INFO] 2026-07-16 04:34:46 - --- Verifying signatures on out-of-tree modules --- [PASS] 2026-07-16 04:34:46 - SIGNED : /usr/lib/modules/6.8.0-117-generic/updates/dkms/zfs.ko [PASS] 2026-07-16 04:34:46 - SIGNED : /usr/lib/modules/6.8.0-117-generic/updates/dkms/spl.ko [PASS] 2026-07-16 04:34:46 - SIGNED : /usr/lib/modules/6.8.0-117-generic/updates/dkms/openafs.ko.zst [INFO] 2026-07-16 04:34:46 - --- Final Output --- [INFO] 2026-07-16 04:34:46 - CONFIG_MODULE_SIG enabled : YES [INFO] 2026-07-16 04:34:46 - In-tree module signed : YES [INFO] 2026-07-16 04:34:46 - Out-of-tree modules found : YES [PASS] 2026-07-16 04:34:46 - Kernel_Module_Signing PASSED — Module signing is active and kernel config is valid. Signed-off-by: Manjeet Pawar <manjeetp@qti.qualcomm.com>
Srikanth Muppandam (smuppand)
self-requested a review
July 17, 2026 10:22
Contributor
|
manjeetp89 Could you look into the workflows that are failing and resolve them? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
kernel: Test to validates the kernel module signing and out-of-tree modules
This test validates the kernel module signing and out-of-tree modules on Qualcomm platforms with Yocto builds.
Sample Logs:
[INFO] 2026-07-16 04:34:32 - ------------------------------------------------- [INFO] 2026-07-16 04:34:32 - ----------- Starting Kernel_Module_Signing Test ------------- [INFO] 2026-07-16 04:34:32 - --- Checking CONFIG_MODULE_SIG kernel config --- [PASS] 2026-07-16 04:34:32 - Kernel config CONFIG_MODULE_SIG is enabled [PASS] 2026-07-16 04:34:32 - CONFIG_MODULE_SIG is enabled in kernel config. [INFO] 2026-07-16 04:34:32 - CONFIG_MODULE_SIG_FORCE is enabled (unsigned modules will be rejected). [INFO] 2026-07-16 04:34:32 - --- Checking module signature via modinfo --- [INFO] 2026-07-16 04:34:33 - Inspecting module: /usr/lib/modules/6.8.0-117-generic/updates/dkms/zfs.ko [PASS] 2026-07-16 04:34:33 - Module '/usr/lib/modules/6.8.0-117-generic/updates/dkms/zfs.ko' contains a signature field — module signing is active.
[INFO] 2026-07-16 04:34:33 - sig_id : PKCS#7
[INFO] 2026-07-16 04:34:33 - signer : las-colo41-d19-18 Secure Boot Module Signature key
[INFO] 2026-07-16 04:34:33 - sig_hashalgo: sha512
[INFO] 2026-07-16 04:34:33 - --- Checking for out-of-tree kernel modules ---
[INFO] 2026-07-16 04:34:33 - Scanning dmesg for out-of-tree module taints...
[INFO] 2026-07-16 04:34:33 - Out-of-tree modules detected in dmesg:
[INFO] 2026-07-16 04:34:33 - [65034.832869] tc956x_pcie_eth: loading out-of-tree module taints kernel.
[INFO] 2026-07-16 04:34:33 - Scanning /sys/module/*/taint for out-of-tree flags...
[INFO] 2026-07-16 04:34:40 - Out-of-tree module (taint=O): openafs
[INFO] 2026-07-16 04:34:43 - Out-of-tree module (taint=O): spl
[INFO] 2026-07-16 04:34:45 - Out-of-tree module (taint=O): zfs
[INFO] 2026-07-16 04:34:45 - --- Locating out-of-tree .ko files outside kernel/ subdirectory ---
dir: /usr/lib/modules/6.8.0-117-generic
[INFO] 2026-07-16 04:34:45 - Potential out-of-tree .ko files found (outside kernel/ tree):
[INFO] 2026-07-16 04:34:45 - /usr/lib/modules/6.8.0-117-generic/updates/dkms/zfs.ko
[INFO] 2026-07-16 04:34:45 - /usr/lib/modules/6.8.0-117-generic/updates/dkms/spl.ko
[INFO] 2026-07-16 04:34:46 - /usr/lib/modules/6.8.0-117-generic/updates/dkms/openafs.ko.zst
[INFO] 2026-07-16 04:34:46 - --- Verifying signatures on out-of-tree modules ---
[PASS] 2026-07-16 04:34:46 - SIGNED : /usr/lib/modules/6.8.0-117-generic/updates/dkms/zfs.ko
[PASS] 2026-07-16 04:34:46 - SIGNED : /usr/lib/modules/6.8.0-117-generic/updates/dkms/spl.ko
[PASS] 2026-07-16 04:34:46 - SIGNED : /usr/lib/modules/6.8.0-117-generic/updates/dkms/openafs.ko.zst
[INFO] 2026-07-16 04:34:46 - --- Final Output ---
[INFO] 2026-07-16 04:34:46 - CONFIG_MODULE_SIG enabled : YES
[INFO] 2026-07-16 04:34:46 - In-tree module signed : YES
[INFO] 2026-07-16 04:34:46 - Out-of-tree modules found : YES
[PASS] 2026-07-16 04:34:46 - Kernel_Module_Signing PASSED — Module signing is active and kernel config is valid.
Signed-off-by: Manjeet Pawar manjeetp@qti.qualcomm.com