Introduction

For the practice I will choose the kernel 6.4.4 that I have downloaded from the backports repository:

To download the source code we will use apt source:

It will create us a directory with the source code

If we list the contents of the directory with the source code, we will see that the structure is the same as to compile a package in C.

First compilation

The first thing we’re gonna do is use the .config file that has our kernel loaded, mine currently has 10640 lines.

Next we will launch the make oldconfig command to use the current kernel file we are using.

If we see we have 2413 modules configured in a static way and 3855 in a dynamic way:

Let’s pass the localmodconfig parameter, leave the enter pressed to select the different parameters by default.

We see that with this parameter we have significantly reduced the number of modules, as with the method used in the previous step only those we have currently loaded in the kernel are used:

We’ll build the kernel and try it, in my case it starts:

ref1

Second compilation

I will remove some components manually using the make xconfig tool:

After removing several points from the .config I have been left with:

Now we’re going to use a method to compile which will make us .deb packages and use 15 cores for it:

ref1

We will generate 4 .deb packages in the top directory:

We’re going to install them, for that we’ll use a wildcard to install all the .deb:

Finally let’s make sure the kernel is installed:

Sign a kernel

As I have the safe start activated on the laptop, you will need to sign the kernel so you can start it.

So for this we will follow the steps that debian tells us to do it.

If you want to know which keys are in use in your system, several other mokutile calls will help you, for example, sudo mokutile –list-enlisted to show the current list of MOK keys

To generate a new keys to sign the kernel we will create the following directory:

Let’s generate the private and certified key in DER format

Now let’s convert the DER certificate to PEM format:

Now to register a new MOK key, I first issue the request using the mokutile command. I run the following command:

During this process, I will be asked to enter an “one-time password” to confirm the registration. This password is crucial for validating and authorizing the operation.

After issuing the request and providing the password, the key entry is not completed immediately. Instead, I need to restart the system.

When we reboot, we will have a blue screen, we will head for the second MOK roll option:

He’ll tell us if we want to add the keys:

And you will ask us to put the password we have indicated in one use:

Once this has been done, we restart the team:

Once the key is added, we can check it with the following command:

For DKMS (Dynamic Kernel Module Support) to automatically sign the kernel modules, it is necessary to tell you which key to sign the module with. This is done by adding two configuration values to the “/ etc / dkms / framework.conf” file, adjusting the routes as needed.

In addition, we will add the following script:

The script will have the following content:

Now we’re going to define the variables needed to proceed to sign the kernel, the version one makes it with a -r in the debian documentation but my modules have the 6.4.4 prefix. You can check it on the s / lib / modules / route.

Now let’s sign the kernel:

Once the kernel has been signed, we can reboot it and check that it starts. It took me more than usual to get started, but in about 2 minutes it finally starts.