1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
|
Dynamic Kernel Module System (DKMS)
==
This intention of this README is to explain how DKMS can be used in conjunction
with tarballs which contain a dkms.conf file within them.
The DKMS project (and any updates) can be found at: https://github.com/dell/dkms
Installation
--
Installation is performed from the source directory with one of the following
commands:
```
make install
make install-debian
make install-redhat
```
Distribution specific installations (RPM, DEB, etc.) are not contained in this
source repository.
Installation via DKMS Tarballs
--
DKMS can install directly from the following:
1. Generic module source tarballs which contain a dkms.conf file
2. Specially created DKMS tarballs with module source, pre-built module
binaries and a dkms.conf file
3. Specially created DKMS tarballs with pre-built module binaries and a
dkms.conf file
4. Manual placement of module source and dkms.conf file into
`/usr/src/<module>-<moduleversion>/` directory
In order to load any tarball into the DKMS tree, you must use the following
command:
```
# dkms ldtarball /path/to/dkms_enabled.tar.gz
```
This command will first inspect the tarball to ensure that it contains a
dkms.conf configuration file for that module. If it cannot find this file
anywhere within the archive, then the ldtarball will fail.
From here, it will place the source in the tarball into
`/usr/src/<module>-<moduleversion>/`. If source already exists in the directory,
it will not overwrite it unless the --force option is specified. If the tarball
is of type "c" above and does not contain source, it will only continue to load
the tarball if existing module source is found in
`/usr/src/<module>-<moduleversion>/` or if the --force option is specified.
Continuing on, if the tarball is of type "b" or "c" it will then load any
pre-built binaries found within the tarball into the dkms tree, but will stop
short of installing them. Thus, all pre-built binaries will then be of in the
*built* state when checked from the `dkms status` command. You can then use the
`dkms install` command to install any of these binaries.
To create a tarball of type "1" above, you need only to take module source and a
dkms.conf file for that module and create a tarball from them. Tarballs of
type *2* or type *3* are created with the `dkms mktarball` command. To create
a type *3* tarball, you must specify the flag `--binaries-only` with the
`mktarball`.
Installation on Systems with no Module Source and/or Compiler
--
If you choose not to load module source on your system or if you choose not to
load a compiler such as gcc onto your system, DKMS can still be used to install
modules. It does this through use of DKMS binary only tarballs as explained in
this README under tarballs of type *c*.
If your system does not have module source, loading the dkms tarball will fail
because of this. To avoid this, use the --force flag, as such:
```
# dkms ldtarball /path/to/dkms_enabled.tar.gz --force
```
This will load the pre-built binaries into the dkms tree, and create the
directory `/usr/src/<module>-<moduleversion>/` which will only contain the
module's dkms.conf configuration file. Once the tarball is loaded, you can then
use `dkms install` to install any of the pre-built modules.
Of course, since module source will not be located in your dkms tree, you will
not be able to build any modules with DKMS for this package.
Module signing
--
By default, DKMS generates a self signed certificate for signing modules at
build time and signs every module that it builds before it gets compressed in
the configured kernel compression mechanism of choice.
This requires the `openssl` command to be present on the system.
Private key and certificate are auto generated the first time DKMS is run and
placed in `/var/lib/dkms`. These certificate files can be pre-populated with
your own certificates of choice.
The location as well can be changed by setting the appropriate variables in
`/etc/dkms/framework.conf`. For example, to allow usage of the system default
Ubuntu `update-secureboot-policy` set the configuration file as follows:
```
mok_signing_key="/var/lib/shim-signed/mok/MOK.priv"
mok_certificate="/var/lib/shim-signed/mok/MOK.der"
```
NOTE: If any of the files specified by `mok_signing_key` and
`mok_certificate` are non-existant, dkms will re-create both files.
The paths specified in `mok_signing_key`, `mok_certificate` and `sign_file` can
use the variable `${kernelver}` to represent the target kernel version.
```
sign_file="/lib/modules/${kernelver}/build/scripts/sign-file"
```
The variable `mok_signing_key` can also be a `pkcs11:...` string for a [PKCS#11
engine](https://www.rfc-editor.org/rfc/rfc7512), as long as the `sign_file`
program supports it.
Secure Boot
--
On an UEFI system with Secure Boot enabled, modules require signing (as
described in the above paragraph) before they can be loaded and the firmware of
the system must know the correct public certificate to verify the module
signature.
For importing the MOK certificate make sure `mokutil` is installed.
To check if Secure Boot is enabled:
```
# mokutil --sb-state
SecureBoot enabled
```
With the appropriate key material on the system, enroll the public key:
```
# mokutil --import /var/lib/dkms/mok.pub
```
You'll be prompted to create a password. Enter it twice, it can also be blank.
Reboot the computer. At boot you'll see the MOK Manager EFI interface:
Press any key to enter it, then select "Enroll MOK":
Then select "Continue":
And confirm with "Yes" when prompted:
After this, enter the password you set up with `mokutil --import` in the
previous step:
At this point you are done, select "OK" and the computer will reboot trusting
the key for your modules:
After reboot, you can inspect the MOK certificates with the following command:
```
# mokutil --list-enrolled | grep DKMS
Subject: CN=DKMS module signing key
```
To check the signature on a built DKMS module that is installed on a system:
```
# modinfo dkms_test | grep ^signer
signer: DKMS module signing key
```
The module can now be loaded without issues.
Further Documentation
--
Once DKMS is installed, you can reference its man page for further information
on different DKMS options and also to understand the formatting of a module's
dkms.conf configuration file.
The DKMS project is located at: https://github.com/dell/dkms
|
