KMODSIGN(1)

💖 KMODSIGN — a.k.a. kmodsign(1) from the User Commands section ✨

okay bestie, sit down, hydrate, and let me tell you about the kernel module signing tool 🎀 this one lives in section 1 of the manual, and it's literally the thing that makes your modules ✨trustworthy✨ to a suspicious kernel. no cap.

---

🌸 NAME 🌸

kmodsign — the kernel module signing tool. that's it, that's the name, short and iconic 💅

---

🦋 SYNOPSIS 🦋

kmodsign [-dpkD] <hash algo> <key> <x509> <module> [<dest>]

so like, flags first, then a hash algo, then your key, then your x509, then the module, and maybe a destination if you're feeling generous 🫶 that's the whole shape of it.

---

✨ DESCRIPTION ✨

Sign a kernel module image for use with an enforcing kernel.

fr fr that's the entire job description: you hand it a kernel module, it signs it, and now an enforcing kernel will actually be chill about loading it. no signature, no entry, iykyk 😭

---

💅 OPTIONS 💅

• -p — ok so this one saves a copy of the p7s signature with a .p7s extension. a lil keepsake 💖
• -d — this gives you a detached signature file (.p7s) only. that's it. just the signature, nothing else. very minimalist of it 🌸
• -D — this one produces a full detached signature block, and the tea is it may be cat'd onto the end of a module 👀 so you can just append it. obsessed.
• -k — switch to using keyid for identification. keyid szn, periodt 🔥

---

⚠️ quick vibe check: those four flags in the synopsis are written glued together as [-dpkD], and yeah you can absolutely stack them. also ngl, <dest> in the synopsis is square-bracketed, so it's optional — if you skip it, don't come crying to me about where the output went 🙈

---

one last thing before you go — this page is kmodsign 4.4, dated July 2026 🎀 and yeah it says kmodsign at the top and bottom too bc man pages are dramatic like that. mwah, go sign something, you ate 👑🌈💜