sbsign: sign a non EFI kernel

Question

The following link explains how to sign a kernel module: https://ubuntu.com/blog/how-to-sign-things-for-secure-boot

sbsign --key MOK.priv --cert MOK.pem my_binary.efi --output my_binary.efi.signed

How can I sign a non EFI kernel image (e.g bzImage) ?

Thank you, Zvika

Answer 1

sbsign and pesign can only sign PE format binaries - the format that UEFI and Windows use. If you want to sign something that isn't a PE binary, then you need a different tool.

If you want to sign a kernel module, you can use an appended signature - sign-file and kmodsign can do that. (But the DKMS system can do it all for you much more easily!)

If you want to sign your own kernel, you have a few options:

• build your kernel as an EFI binary and use sbsign or pesign. There are kernel config options for this.
• use some other mechanism to secure the step from Grub to the kernel, like Grub's detached signature support. Note that this will require you to build your own grub and sign it in a way that the shim (or your UEFI firmware) accepts.