kernel: sign GKI modules
Only signed GKI modules are permitted to export symbols listed in the
android/abi_gki_protected_exports file. Attempting to export these
symbols from an unsigned module will result in the module failing to
load, with a 'Permission denied' error message.
Change-Id: Ie15b00a6c288eda21b319eb0f735cf4f9e6e7933
Signed-off-by: Jis G Jacob <studiokeys@blissroms.org>
diff --git a/build/tasks/kernel.mk b/build/tasks/kernel.mk
index ff4319b..9be3611 100644
--- a/build/tasks/kernel.mk
+++ b/build/tasks/kernel.mk
@@ -525,6 +525,11 @@
if [[ ! "$(SYSTEM_KERNEL_MODULES)" =~ "$$module_name" ]]; then echo $$n; fi; \
done); \
($(call build-image-kernel-modules-bliss,$$filtered_modules,$(KERNEL_MODULES_OUT),$(KERNEL_MODULE_MOUNTPOINT)/,$(KERNEL_DEPMOD_STAGING_DIR),$(BOARD_VENDOR_KERNEL_MODULES_LOAD),,$(KERNEL_MODULES_PARTITION_FILE_LIST),$(SYSTEM_KERNEL_DEPMOD_STAGING_DIR)/lib/modules/0.0/$(SYSTEM_KERNEL_MODULE_MOUNTPOINT))) || exit "$$?"; \
+ (for m in $$(find $(SYSTEM_KERNEL_MODULES_OUT) -type f -name "*.ko"); do \
+ $(KERNEL_OUT)/scripts/sign-file sha1 \
+ $(KERNEL_OUT)/certs/signing_key.pem \
+ $(KERNEL_OUT)/certs/signing_key.x509 "$$m"; \
+ done) || exit "$$?"; \
,\
($(call build-image-kernel-modules-bliss,$$all_modules,$(KERNEL_MODULES_OUT),$(KERNEL_MODULE_MOUNTPOINT)/,$(KERNEL_DEPMOD_STAGING_DIR),$(BOARD_VENDOR_KERNEL_MODULES_LOAD),,$(KERNEL_MODULES_PARTITION_FILE_LIST),)) || exit "$$?"; \
) \