Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #64218 > unrolled thread

dkms with secureboot

Back to article view | Back to linux.debian.kernel

Contents

  dkms with secureboot Hideki Yamane <henrich@iijmio-mail.jp> - 2019-06-04 08:30 +0200
    Re: dkms with secureboot Luca Boccassi <bluca@debian.org> - 2019-06-04 19:50 +0200
      Re: dkms with secureboot Hideki Yamane <henrich@iijmio-mail.jp> - 2019-06-06 04:30 +0200
    Re: dkms with secureboot Ben Hutchings <ben@decadent.org.uk> - 2019-06-04 23:20 +0200

#64218 — dkms with secureboot

Hi,

> linux (4.19.37-1) unstable; urgency=medium
(snip)
>   * Import patches to enable loading keys from UEFI db and MOK from
>     http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git to
>     allow kernel modules built by users (eg: by dkms) to be verified, and
>     to load dbx and MOKX for the equivalent blacklisting functionality.

 It seems that we can use virtualbox with secure boot enabled, however,
 I got an error as below

> $ sudo modprobe vboxdrv
> modprobe: ERROR: could not insert 'vboxdrv': Required key not available

 Do I forget to do something or need extra step for it?



-- 
Hideki Yamane <henrich@iijmio-mail.jp>

[toc] | [next] | [standalone]

#64220

[Multipart message — attachments visible in raw view] — view raw

> Hi,
> 
> > linux (4.19.37-1) unstable; urgency=medium
> (snip)
> >   * Import patches to enable loading keys from UEFI db and MOK from
> >     
> http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git to
> >     allow kernel modules built by users (eg: by dkms) to be
> verified, and
> >     to load dbx and MOKX for the equivalent blacklisting
> functionality.
> 
>  It seems that we can use virtualbox with secure boot enabled,
> however,
>  I got an error as below
> 
> > $ sudo modprobe vboxdrv
> > modprobe: ERROR: could not insert 'vboxdrv': Required key not
> available
> 
>  Do I forget to do something or need extra step for it?

It requires manual steps: you need to have a personal key, load it in
MOK and use it to sign the out of tree modules manually.

I wanted to have a look at porting the dkms patches from Ubuntu that
automate that, but unfortunately I really had no spare time in the past
couple of weeks.

-- 
Kind regards,
Luca Boccassi

[toc] | [prev] | [next] | [standalone]

#64225

Hi,

 Thanks, Luca

On Tue, 04 Jun 2019 18:39:59 +0100
Luca Boccassi <bluca@debian.org> wrote:
> It requires manual steps: you need to have a personal key, load it in
> MOK and use it to sign the out of tree modules manually.
> 
> I wanted to have a look at porting the dkms patches from Ubuntu that
> automate that, but unfortunately I really had no spare time in the past
> couple of weeks.

 Okay, I got it.
 How about adding this restriction in release notes?


-- 
Hideki Yamane <henrich@iijmio-mail.jp>

[toc] | [prev] | [next] | [standalone]

#64223

[Multipart message — attachments visible in raw view] — view raw

On Tue, 2019-06-04 at 14:53 +0900, Hideki Yamane wrote:
> Hi,
> 
> > linux (4.19.37-1) unstable; urgency=medium
> (snip)
> >   * Import patches to enable loading keys from UEFI db and MOK from
> >     http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git to
> >     allow kernel modules built by users (eg: by dkms) to be verified, and
> >     to load dbx and MOKX for the equivalent blacklisting functionality.
> 
>  It seems that we can use virtualbox with secure boot enabled, however,
>  I got an error as below
> 
> > $ sudo modprobe vboxdrv
> > modprobe: ERROR: could not insert 'vboxdrv': Required key not available
> 
>  Do I forget to do something or need extra step for it?

Yes, you would have to actually sign the module and enrol the signing
key.  Unfortunately I don't believe there's a simple way to do that at
present.

It is also possible to disable shim's signature checking using mokutil
(which then has to be confirmed interactively on the following boot). 
These patches make the kernel follow shim's behaviour.  This is useful
if the system firmware makes it difficult to disable Secure Boot.

Ben.

-- 
Ben Hutchings
Once a job is fouled up, anything done to improve it makes it worse.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web