[PATCH 4/4] Documentation/admin-guide/module-signing.rst: add openssl command option example for CodeSign EKU
flat view
DORMANTno replies
SUPERSEDED
From: Lee, Chun-Yi <hidden>
Date: 2021-03-23 03:57:05
Also in:
keyrings, lkml
Subsystem:
certificate handling, documentation, the rest · Maintainers:
David Howells, David Woodhouse, Jonathan Corbet, Linus Torvalds
Revision v5 of 12 in this series.
Revisions (12)
Add an openssl command option example for generating CodeSign extended key usage in X.509 when CONFIG_CHECK_CODESIGN_EKU is enabled. Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com> --- Documentation/admin-guide/module-signing.rst | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/Documentation/admin-guide/module-signing.rst b/Documentation/admin-guide/module-signing.rst
index 7d7c7c8a545c..ca3b8f19466c 100644
--- a/Documentation/admin-guide/module-signing.rst
+++ b/Documentation/admin-guide/module-signing.rst@@ -170,6 +170,12 @@ generate the public/private key files:: -config x509.genkey -outform PEM -out kernel_key.pem \ -keyout kernel_key.pem +When ``CONFIG_CHECK_CODESIGN_EKU`` option is enabled, the following openssl +command option should be added where for generating CodeSign extended key usage +in X.509:: + + -addext "extendedKeyUsage=codeSigning" + The full pathname for the resulting kernel_key.pem file can then be specified in the ``CONFIG_MODULE_SIG_KEY`` option, and the certificate and key therein will be used instead of an autogenerated keypair.
--
2.16.4