DAMX Suite - Secure Boot Support Implementation#152
Conversation
…tion and Secure Boot support
There was a problem hiding this comment.
Pull request overview
This PR adds comprehensive Secure Boot support for DAMX Suite's kernel driver installation, with intelligent compiler detection for LLVM/Clang-compiled kernels (particularly CachyOS). It also introduces a new utility script for mapping the physical Nitro button on Acer laptops to launch the DAMX GUI.
Changes:
- Added
build_sign_install.shscript with multi-distribution support for building, signing, and installing drivers with Secure Boot - Extended
local-setup.shwith new Secure Boot installation options (menu items 3 and 4) and updated the reinstall option to prompt for Secure Boot preference - Enhanced
MapNitroButton.shwith improved device detection, automatic permission management, and duplicate instance prevention
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 17 comments.
| File | Description |
|---|---|
| scripts/local-setup.sh | Added install_drivers_with_secureboot() function, updated menu with 2 new Secure Boot options, modified perform_install() to accept secure boot parameter |
| scripts/build_sign_install.sh | New comprehensive script for detecting distributions, LLVM kernels, building drivers with appropriate compiler, signing with Secure Boot keys, and installation |
| scripts/MapNitroButton.sh | Refactored device detection logic, improved permission handling with automatic group management and udev rules, added process checking to prevent duplicate launches |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| if is_llvm_kernel || check_kernel_compiler; then | ||
| echo " Detected LLVM-compiled kernel, using Clang..." | ||
| install_dependencies # Ensure clang is installed |
There was a problem hiding this comment.
The install_dependencies function is called again on line 210 after LLVM kernel detection, which could result in unnecessary dependency installation checks. This call is redundant since dependencies were already installed on line 145. Consider removing this duplicate call or adding a guard to prevent reinstallation.
| install_dependencies # Ensure clang is installed |
| sign_driver() { | ||
| # All distros use the kernel's sign-file script for module signing | ||
| if [[ -f "$SIGN_TOOL" ]]; then | ||
| if [[ -z "$KEY" || -z "$CERT" ]]; then | ||
| echo "⚠️ Warning: Secure Boot keys not found, skipping signature..." | ||
| return 0 | ||
| fi | ||
|
|
||
| echo " Using sign-file script (kernel native)..." | ||
| if "$SIGN_TOOL" sha256 "$KEY" "$CERT" "$DRIVER_FILE" 2>&1; then | ||
| return 0 | ||
| else | ||
| echo "⚠️ Warning: Signing attempt had issues, proceeding anyway..." | ||
| return 0 | ||
| fi | ||
| else | ||
| echo "⚠️ Warning: sign-file tool not found at $SIGN_TOOL" | ||
| echo " This usually means kernel headers may not be properly installed." | ||
| echo " Proceeding without signing..." | ||
| return 0 | ||
| fi | ||
| } | ||
|
|
||
| # Call the signing function | ||
| sign_driver | ||
| echo "✅ Driver preparation complete." | ||
|
|
||
| sign_driver |
There was a problem hiding this comment.
The function returns 0 (success) even when signing fails or when secure boot keys are not found (lines 240, 248, 254). This masks signing failures and could lead to the script reporting success when the driver is not actually signed. Consider returning a non-zero exit code when signing fails, or at minimum, set a variable to track the signing status so callers can determine if signing actually succeeded.
| sign_driver() { | |
| # All distros use the kernel's sign-file script for module signing | |
| if [[ -f "$SIGN_TOOL" ]]; then | |
| if [[ -z "$KEY" || -z "$CERT" ]]; then | |
| echo "⚠️ Warning: Secure Boot keys not found, skipping signature..." | |
| return 0 | |
| fi | |
| echo " Using sign-file script (kernel native)..." | |
| if "$SIGN_TOOL" sha256 "$KEY" "$CERT" "$DRIVER_FILE" 2>&1; then | |
| return 0 | |
| else | |
| echo "⚠️ Warning: Signing attempt had issues, proceeding anyway..." | |
| return 0 | |
| fi | |
| else | |
| echo "⚠️ Warning: sign-file tool not found at $SIGN_TOOL" | |
| echo " This usually means kernel headers may not be properly installed." | |
| echo " Proceeding without signing..." | |
| return 0 | |
| fi | |
| } | |
| # Call the signing function | |
| sign_driver | |
| echo "✅ Driver preparation complete." | |
| sign_driver | |
| SIGN_DRIVER_STATUS=0 | |
| sign_driver() { | |
| # All distros use the kernel's sign-file script for module signing | |
| if [[ -f "$SIGN_TOOL" ]]; then | |
| if [[ -z "$KEY" || -z "$CERT" ]]; then | |
| echo "⚠️ Warning: Secure Boot keys not found, skipping signature..." | |
| SIGN_DRIVER_STATUS=2 | |
| return 2 | |
| fi | |
| echo " Using sign-file script (kernel native)..." | |
| if "$SIGN_TOOL" sha256 "$KEY" "$CERT" "$DRIVER_FILE" 2>&1; then | |
| SIGN_DRIVER_STATUS=0 | |
| return 0 | |
| else | |
| echo "⚠️ Warning: Signing attempt had issues, proceeding anyway..." | |
| SIGN_DRIVER_STATUS=1 | |
| return 1 | |
| fi | |
| else | |
| echo "⚠️ Warning: sign-file tool not found at $SIGN_TOOL" | |
| echo " This usually means kernel headers may not be properly installed." | |
| echo " Proceeding without signing..." | |
| SIGN_DRIVER_STATUS=3 | |
| return 3 | |
| fi | |
| } | |
| # Call the signing function and report status | |
| sign_driver | |
| case "$SIGN_DRIVER_STATUS" in | |
| 0) | |
| echo "✅ Driver preparation complete and signed." | |
| ;; | |
| 1) | |
| echo "⚠️ WARNING: Driver preparation completed but signing failed." | |
| ;; | |
| 2|3) | |
| echo "⚠️ WARNING: Driver preparation completed without signing." | |
| ;; | |
| esac |
| echo 'KERNEL=="event*", SUBSYSTEM=="input", GROUP="input", MODE="0660"' | sudo tee "$UDEV_RULE" > /dev/null | ||
| sudo udevadm control --reload-rules | ||
| sudo udevadm trigger | ||
| fi | ||
|
|
||
| echo "Reloading script with new group permissions..." | ||
| # This re-runs the script with the new 'input' group active immediately | ||
| exec sg input -c "$0 $@" | ||
| exit 0 | ||
| fi | ||
|
|
||
| # If we are already in the group but still can't read, force udev reload | ||
| echo "User is in 'input' group but still cannot read device." | ||
| echo "Attempting to force udev reload..." | ||
| echo 'KERNEL=="event*", SUBSYSTEM=="input", GROUP="input", MODE="0660"' | sudo tee "/etc/udev/rules.d/99-input-group.rules" > /dev/null |
There was a problem hiding this comment.
The udev rule on line 42 is written to the same file path on line 56, which could create a race condition if multiple instances of this script run simultaneously or if the first write hasn't completed when the second check occurs. Consider adding a lock mechanism or checking if the rule already exists before attempting to write it again.
| # --- 2.5. DETECT LLVM KERNEL --- | ||
| # Check if the kernel was compiled with LLVM/Clang | ||
| is_llvm_kernel() { | ||
| local kernel_version=$(uname -r) |
There was a problem hiding this comment.
The kernel_version variable is declared but never used after line 150. It was likely intended to be used in the kernel config path construction on line 164, but that line uses $(uname -r) directly. Consider either removing the unused variable or using it consistently throughout the function for better maintainability.
|
|
||
| echo "" | ||
| echo "============================================" | ||
| if modinfo "$INSTALLED_PATH" 2>/dev/null | grep -q "signer"; then |
There was a problem hiding this comment.
The modinfo command on line 280 is passed the path stored in $INSTALLED_PATH, but if modinfo -n on line 276 fails or returns an empty string, this will result in modinfo "" being executed, which will fail with an unclear error. Add a check to verify $INSTALLED_PATH is not empty before using it, or use modinfo "$DRIVER_NAME" directly instead.
| echo "" | |
| echo "============================================" | |
| if modinfo "$INSTALLED_PATH" 2>/dev/null | grep -q "signer"; then | |
| if [ -n "$INSTALLED_PATH" ]; then | |
| MODINFO_TARGET="$INSTALLED_PATH" | |
| else | |
| MODINFO_TARGET="$DRIVER_NAME" | |
| fi | |
| echo "" | |
| echo "============================================" | |
| if modinfo "$MODINFO_TARGET" 2>/dev/null | grep -q "signer"; then |
| if [ ! -f "build_sign_install.sh" ]; then | ||
| echo -e "${RED}Error: build_sign_install.sh not found in Linuwu-Sense directory!${NC}" | ||
| cd .. | ||
| pause | ||
| return 1 | ||
| fi |
There was a problem hiding this comment.
The error handling when build_sign_install.sh is not found (lines 218-223) returns to the parent directory before returning, but the same pattern should be applied if the directory doesn't exist (lines 208-213). Currently, if the directory doesn't exist, the function returns without attempting to change back to the original directory, which could leave the shell in an undefined state. Ensure consistent directory handling across all error paths.
| else | ||
| echo "Launching DAMX..." | ||
| nohup "$APP_COMMAND" >/dev/null 2>&1 & | ||
| sleep 2 |
There was a problem hiding this comment.
The hardcoded 2-second sleep on line 80 after launching DAMX is arbitrary and could be either too long (wasting time) or too short (if DAMX takes longer to start on slower systems). Consider removing this sleep entirely, or make it configurable. The sleep appears to be intended to prevent immediate re-detection of the key press, but the process check on line 75 should be sufficient for this purpose.
| echo "2. After rebooting, go back to the main folder and run './setup.sh'" | ||
| echo " Choose Option 2 (Install without Drivers)." | ||
| else | ||
| echo "2. After rebooting, enroll the Secure Boot key if prompted." | ||
| echo "3. Then run './setup.sh' and choose Option 2 (Install without Drivers)." |
There was a problem hiding this comment.
The instructions on lines 298-299 reference './setup.sh' and 'Option 2 (Install without Drivers)', but based on the local-setup.sh changes, the correct script name is 'local-setup.sh' and Option 2 is now "Install DAMX Suite (without drivers)". This creates confusion for users who will be looking for a non-existent script. Update the instructions to reference the correct script name.
| echo "2. After rebooting, go back to the main folder and run './setup.sh'" | |
| echo " Choose Option 2 (Install without Drivers)." | |
| else | |
| echo "2. After rebooting, enroll the Secure Boot key if prompted." | |
| echo "3. Then run './setup.sh' and choose Option 2 (Install without Drivers)." | |
| echo "2. After rebooting, go back to the main folder and run './local-setup.sh'" | |
| echo " Choose Option 2 (Install DAMX Suite (without drivers))." | |
| else | |
| echo "2. After rebooting, enroll the Secure Boot key if prompted." | |
| echo "3. Then run './local-setup.sh' and choose Option 2 (Install DAMX Suite (without drivers))." |
| echo " Choose Option 2 (Install without Drivers)." | ||
| else | ||
| echo "2. After rebooting, enroll the Secure Boot key if prompted." | ||
| echo "3. Then run './setup.sh' and choose Option 2 (Install without Drivers)." |
There was a problem hiding this comment.
The reference to 'Option 2 (Install without Drivers)' on lines 302 is inconsistent with the current menu options in local-setup.sh. After the menu update, Option 2 is "Install DAMX Suite (without drivers)". Update this reference to match the current menu structure.
| echo " Choose Option 2 (Install without Drivers)." | |
| else | |
| echo "2. After rebooting, enroll the Secure Boot key if prompted." | |
| echo "3. Then run './setup.sh' and choose Option 2 (Install without Drivers)." | |
| echo " Choose Option 2 (\"Install DAMX Suite (without drivers)\")." | |
| else | |
| echo "2. After rebooting, enroll the Secure Boot key if prompted." | |
| echo "3. Then run './setup.sh' and choose Option 2 (\"Install DAMX Suite (without drivers)\")." |
| # This re-runs the script with the new 'input' group active immediately | ||
| exec sg input -c "$0 $@" | ||
| exit 0 |
There was a problem hiding this comment.
The exec sg input -c "$0 $@" command on line 49 will re-execute the script with the input group active, but it doesn't preserve the original process tree context. If this script is launched by a process monitor or systemd, the exec call could break the parent-child relationship. Additionally, using $@ without quotes could cause issues with arguments containing spaces. Use "$@" with proper quoting instead.
| # This re-runs the script with the new 'input' group active immediately | |
| exec sg input -c "$0 $@" | |
| exit 0 | |
| # This re-runs the script with the new 'input' group active immediately, | |
| # preserving argument boundaries and the original process tree context. | |
| CMD=$(printf '%q ' "$0" "$@") | |
| sg input -c "$CMD" | |
| exit $? |
Overview
This update adds comprehensive Secure Boot support for the Linuwu-Sense kernel driver, with special compatibility for CachyOS and LLVM-compiled kernels. The installation process now intelligently detects the kernel compiler and builds the driver with the appropriate toolchain.
Changes Summary
📁 File:
Linuwu-Sense/build_sign_install.shNew Features:
LLVM Kernel Detection Function (
is_llvm_kernel())/proc/version, kernel config files, system infoSmart Compiler Selection
LLVM=1 CC=clang) for LLVM-compiled kernelsAdditional Detection Method (
check_kernel_compiler())Key Improvements:
📁 File:
local-setup.shNew Functions:
install_drivers_with_secureboot()build_sign_install.shscriptMenu Updates:
Expanded from 5 to 7 installation options:
Updated Functions:
perform_install()use_securebootparameter (3rd parameter)install_drivers()orinstall_drivers_with_secureboot()main_menu()📁 File:
MapNitroButton.sh✨ NEWPurpose:
Enables the physical Nitro button on Acer laptops to launch the DAMX GUI application. Provides seamless hardware integration for quick access to system controls.
Key Features:
Device Detection
/dev/input/event*device dynamicallyPermission Management
inputgroup for device accesssgcommand for immediate group activation without logoutSmart Application Launching
nohupError Handling
Usage:
Technical Details:
Supported Input Devices:
Key Code Monitored: 425 (Nitro/Gaming button)
Launch Command:
DAMX(uses the command shortcut created during installation)Running Processes Check:
Integration with DAMX Suite:
DAMXcommand shortcut created during setuplocal-setup.shDistribution Support
Fully Supported:
How It Works:
LLVM=1 CC=clang LLVM=1flagsmakewithout special flagsUsage Examples
Installation with Secure Boot Support (Complete Suite):
sudo ./local-setup.sh # Select option 3: Install DAMX Suite (complete with Secure Boot support)Installation with Secure Boot Support (Drivers Only):
sudo ./local-setup.sh # Select option 4: Install drivers only (with Secure Boot support)Update with Secure Boot Option:
Technical Details
Kernel Compiler Detection:
The
is_llvm_kernel()function checks:modinfokernel version magic string/proc/version(primary method for CachyOS)/boot/config-*or/proc/config.gz)Build Flags Used:
For LLVM Kernels:
For GCC Kernels:
Testing & Validation
Tested On:
Build Output Example (CachyOS):
Real-World Usage - Personal Testing on CachyOS + KDE
System Configuration:
Daily Usage Workflow:
1. Installation (One-time setup)
2. KDE Startup Script Integration
Setup is simple and straightforward:
/path/to/MapNitroButton.shThe script will now launch automatically on every KDE login and listen for the Nitro button.
3. Daily Usage
Screenshots:
Performance Observations:
Breaking Changes
None. All existing functionality is preserved and enhanced.
Backward Compatibility
✅ Fully backward compatible with existing installations and scripts.