Introduction: Securing Android with Kernel Module Signing

In the evolving landscape of mobile security, ensuring the integrity of an Android system’s kernel is paramount. Android’s Verified Boot (AVB) provides a robust chain of trust from the hardware root up to the system partition. However, for highly sensitive environments or specialized devices, an additional layer of security is often desired: kernel module signing. This mechanism ensures that only modules signed by a trusted authority can be loaded into the running kernel, preventing malicious or unauthorized code execution.

This expert-level tutorial guides you through setting up a DIY lab environment to test kernel module signing within an Android Open Source Project (AOSP) build. You’ll learn how to generate signing keys, configure the Android kernel to enforce module signatures, build a signed module, and deploy it to a test device. This setup is crucial for developers, security researchers, and system integrators looking to harden Android deployments.

Prerequisites for Your Secure Boot Lab

Before diving into the setup, ensure you have the following:

• Hardware: An Android device with an unlocked bootloader (e.g., Google Pixel series for best AOSP compatibility) and a powerful host PC (Linux recommended for AOSP builds).
• Software:
  • AOSP source code synced to a recent branch (e.g., Android 12 or newer).
  • Android SDK/NDK, `repo`, `git`, `make`, `gcc`, `openssl` installed on your host PC.
  • Sufficient disk space (300GB+) and RAM (16GB+) on your host PC.
• Knowledge: Familiarity with Linux command line, kernel compilation, and basic Android build system concepts.

Understanding Android’s Verified Boot and Kernel Module Signing

Android’s Verified Boot establishes a cryptographic chain of trust, verifying each stage of the boot process before executing it. This includes verifying the bootloader, kernel, and system partitions. While Verified Boot ensures the *initial* kernel image is untampered, kernel module signing extends this trust to dynamically loaded kernel modules. If enabled, the kernel will refuse to load any module that is not cryptographically signed by a trusted key, adding a critical defense against rootkits and unauthorized kernel modifications post-boot.

The Linux kernel itself supports module signing, controlled by specific configuration options. When integrated into an Android context, this feature can be enforced by the Android kernel running on the device, aligning with the overall secure boot philosophy.

Step 1: Setting Up Your AOSP Build Environment

First, set up your AOSP environment if you haven’t already. This involves initializing and syncing the repository, then configuring the build environment for your specific device.

# Install necessary packages (Ubuntu example) sudo apt-get update && sudo apt-get install git-core gnupg flex bison build-essential zip curl zlib1g-dev gcc-multilib g++-multilib libc6-dev-i386 libncurses5 lib32ncurses5-dev x11proto-core-dev libx11-dev lib32z1-dev libgl1-mesa-dev libxml2-utils xsltproc bc rsync libssl-dev # Create AOSP source directory mkdir -p ~/android/aosp cd ~/android/aosp # Initialize repo (replace 'master' with a specific branch like 'android-12.0.0_rXX' if needed) repo init -u https://android.googlesource.com/platform/manifest -b master # Sync the AOSP source code repo sync -j$(nproc --all) # Set up the build environment source build/envsetup.sh # Choose your device (e.g., 'aosp_flame-userdebug' for Pixel 4) lunch aosp_flame-userdebug 

This process can take several hours depending on your internet connection and hardware.

Step 2: Generating Kernel Module Signing Keys

You need a public/private key pair to sign your kernel modules. The private key will be used for signing, and the public key (certificate) will be embedded into the kernel to verify signatures.

# Create a directory for your keys mkdir -p ~/.android-sig-keys cd ~/.android-sig-keys # Create a minimal openssl.cnf file for batch mode cat < openssl.cnf [ req ] default_bits = 4096 default_md = sha512 distinguished_name = req_distinguished_name x509_extensions = v3_ca prompt = no [ req_distinguished_name ] C = US ST = CA L = Mountain View O = Android Kernel Modules OU = Development CN = Android Kernel Signing Key emailAddress = [email protected] [ v3_ca ] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer basicConstraints = CA:true EOF # Generate the signing key pair openssl req -new -nodes -utf8 -sha512 -days 3650 -batch -x509 -config openssl.cnf -out signing_key.x509 -keyout signing_key.pem 

This command generates `signing_key.x509` (your public certificate) and `signing_key.pem` (your private key). Keep `signing_key.pem` secure.

Step 3: Configuring the Android Kernel for Module Signing

Now, you need to configure your Android kernel to enable module signing support and trust your newly generated key.

1. Locate your kernel source: Inside your AOSP directory, the kernel source is typically found under `kernel/common/` or `device/google//kernel-/`. For example, for a Pixel 4, it might be in `device/google/flame/kernel-5.4/`. Navigate to the specific kernel branch you’re building.

2. Modify the kernel configuration: You’ll need to enable several `CONFIG` options in your kernel’s `.config` file or its defconfig fragment. The AOSP build system typically uses defconfig fragments (e.g., `android-base.config`, `android-recommended.config` within `arch/arm64/configs/` or `common/arch/arm64/configs/`). You might add these to a new fragment or an existing one.

   # Example .config entries to add/modify CONFIG_MODULE_SIG=y CONFIG_MODULE_SIG_ALL=y CONFIG_MODULE_SIG_FORCE=y # Forces all modules to be signed CONFIG_MODULE_SIG_SHA512=y # Use SHA512 for signatures CONFIG_SYSTEM_TRUSTED_KEYS="/path/to/signing_key.x509" # IMPORTANT: This needs to point to the cert file. # During kernel build, the path here is relative to the kernel build root. # You will likely need to copy your signing_key.x509 into the kernel source tree, # e.g., kernel/common/certs/signing_key.x509. Then use that path here. CONFIG_MODULE_SIG_KEY="~/.android-sig-keys/signing_key.pem" # This will be set by the Kbuild system for module signing. 

   Note on `CONFIG_SYSTEM_TRUSTED_KEYS`: The kernel build process needs to embed the public key. The path provided to `CONFIG_SYSTEM_TRUSTED_KEYS` should be accessible during the kernel build. A common practice is to copy `signing_key.x509` into `kernel/common/certs/` and reference it as `certs/signing_key.x509`.

3. Rebuild the kernel: After modifying the kernel configuration, you need to rebuild the kernel and the boot image. From your AOSP root directory, run:

   # Make sure your lunch configuration is still active make bootimage -j$(nproc --all) 

   This will compile your kernel with module signing enabled and create a new `boot.img`.

Step 4: Building a Custom Signed Kernel Module

Now let’s create a simple