Secureboot: Fix base paths for kernel module signing and verification

[bhouse-nexthop]

Why I did it

Without this change, additional files like usr/share/vim/vim90/tutor/tutor.ko end up getting signed which is inappropriate.

This also skips attempting to verify kernel module signatures if the module path is not specified. Previously it would verify the kernel module signatures twice.

Work item tracking

How I did it

Updated paths specified to signing and verification scripts.

How to verify it

Build with secureboot and observe usr/share/vim/vim90/tutor/tutor.ko is no longer signed.

Which release branch to backport (provide reason below if selected)

• 202205
• 202211
• 202305
• 202311
• 202405
• 202411
• 202505

Tested branch (Please provide the tested image version)

master as of 20250817

Description for the changelog

Secureboot: Fix base paths for kernel module signing and verification

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

Fixes: #23406
Signed-off-by: Brad House bhouse@nexthop.ai

[mssonicbld]

/azp run Azure.sonic-buildimage

[bhouse-nexthop]

@DavidZagury @davidpil2002 @qiluo-msft please review

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[bhouse-nexthop]

@Yarden-Z any comments?

[lguohan]

Here’s a review of the pull request based on the provided diff:

Summary

This PR updates paths and conditions related to kernel modules and secure boot signature verification in several scripts. The main change is switching the kernel modules path from the filesystem root ($FILESYSTEM_ROOT) to specifically ${FILESYSTEM_ROOT}/usr/lib/modules, and tightening a condition to avoid empty directory variables.

Detailed Review

1. build_debian.sh

• Verification Path Update:
  • The script now verifies kernel modules in ${FILESYSTEM_ROOT}/usr/lib/modules instead of the entire $FILESYSTEM_ROOT.
  • For the vmlinuz file, the -k argument has been removed from the verification command, suggesting it is no longer needed for this file.
• Impact:
  • This focuses the verification on the actual location of kernel modules, making the process more precise and possibly faster.
  • Removing -k for vmlinuz could be cleaning up an unnecessary argument.

2. scripts/secure_boot_signature_verification.sh

• Condition Enhancement:
  • The check for KERNEL_MODULES_DIR now ensures it is not empty and exists as a directory:
    if [ ! -z "$KERNEL_MODULES_DIR" -a -d "$KERNEL_MODULES_DIR" ]; then
  • The comment is updated to clarify that kernel modules will be checked only if the directory is specified.
• Impact:
  • This prevents errors when the variable is empty or not a directory, increasing robustness.

3. scripts/signing_secure_boot_dev.sh

• Signing Path Update:
  • The signing script is directed to sign kernel modules specifically in ${FS_ROOT}/usr/lib/modules instead of the whole ${FS_ROOT}.
• Impact:
  • Ensures that only the intended kernel modules are signed, not other files that might be under the filesystem root.

General Assessment

• Code Quality:
  • The changes are clean and concise, improving specificity and error handling.
  • Comments are updated for clarity.
• Functionality:
  • These updates should make secure boot signing and verification more robust by targeting the correct paths and handling empty variables gracefully.
• Risk:
  • Minimal risk, as the changes restrict functionality to more specific paths and add safer checks.

Suggestions / Questions

• If there are cases where kernel modules are stored outside usr/lib/modules, consider documenting or handling those cases.
• Double-check that all downstream scripts and processes expect the updated paths and conditions.

---

Conclusion:
This PR is a good improvement for secure boot signing and verification scripts. The changes are well-targeted and should help prevent errors and improve performance.
If all tests pass and the affected scripts work as expected, I would recommend merging.