Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.debian.kernel > #65071 > unrolled thread

Bug#939773: linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures.

Started byMarek Rusinowski <marekrusinowski@gmail.com>
First post2019-09-08 19:50 +0200
Last post2019-11-09 22:20 +0100
Articles 4 — 2 participants

Back to article view | Back to linux.debian.kernel


Contents

  Bug#939773: linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures. Marek Rusinowski <marekrusinowski@gmail.com> - 2019-09-08 19:50 +0200
    Bug#939773: Duplicate Marek Rusinowski <marekrusinowski@gmail.com> - 2019-09-14 17:20 +0200
    Bug#939773: marked as done (linux-image-5.2.0-2-amd64: MOK key  not used for verification of modules signatures.) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2019-10-21 00:10 +0200
    Bug#939773: marked as done (linux-image-5.2.0-2-amd64: MOK key  not used for verification of modules signatures.) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2019-11-09 22:20 +0100

#65071 — Bug#939773: linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures.

FromMarek Rusinowski <marekrusinowski@gmail.com>
Date2019-09-08 19:50 +0200
SubjectBug#939773: linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures.
Message-ID<yE9u1-7AB-3@gated-at.bofh.it>
Package: src:linux
Version: 5.2.9-2
Severity: important

Dear Maintainer,

I've updated kernel from 4.19 to 5.2 and kernel stopped accepting modules
signed with MOK key.

I have secure boot enabled on my system and enrolled generated MOK key. I use
some out-of-tree modules that use DKMS. In the previous version of the kernel
I was signing those modules with the MOK key and they loaded just fine as MOK
key was loaded into the trusted keyring in the kernel.

After the kernel update, MOK key gets inserted into the .platform keyring
(I see CONFIG_INTEGRITY_PLATFORM_KEYRING is set to true in the kernel config)
which apparently isn't used for validation of module signatures so I'm unable
to load MOK signed modules.

I would expect this to still work as the only option I have right now for
using DKMS modules is building and using my own kernel image... This is also
the method described in https://wiki.debian.org/SecureBoot.

I've found this related bug in Fedora:
https://bugzilla.redhat.com/show_bug.cgi?id=1701096. There are some links to
upstream patches but I've just checked linux master and
kernel/module_signing.c is still using only secondary_trusted_keyring and
builtin_trusted_keyring to verify modules signatures.

Thank you,
Marek Rusinowski

[toc] | [next] | [standalone]


#65110 — Bug#939773: Duplicate

FromMarek Rusinowski <marekrusinowski@gmail.com>
Date2019-09-14 17:20 +0200
SubjectBug#939773: Duplicate
Message-ID<yGi09-4qG-1@gated-at.bofh.it>
In reply to#65071
Sorry, this is a duplicate of #935945

[toc] | [prev] | [next] | [standalone]


#65423 — Bug#939773: marked as done (linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures.)

From"Debian Bug Tracking System" <owner@bugs.debian.org>
Date2019-10-21 00:10 +0200
SubjectBug#939773: marked as done (linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures.)
Message-ID<yTryG-1WY-15@gated-at.bofh.it>
In reply to#65071

[Multipart message — attachments visible in raw view] — view raw

Your message dated Sun, 20 Oct 2019 22:05:41 +0000
with message-id <E1iMJKX-000Ibd-3e@fasolo.debian.org>
and subject line Bug#935945: fixed in linux 5.3.7-1
has caused the Debian Bug report #935945,
regarding linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures.
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
935945: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=935945
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]


#65594 — Bug#939773: marked as done (linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures.)

From"Debian Bug Tracking System" <owner@bugs.debian.org>
Date2019-11-09 22:20 +0100
SubjectBug#939773: marked as done (linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures.)
Message-ID<z0Gjk-ji-47@gated-at.bofh.it>
In reply to#65071

[Multipart message — attachments visible in raw view] — view raw

Your message dated Sat, 09 Nov 2019 21:10:12 +0000
with message-id <E1iTXzo-0003H6-Bv@fasolo.debian.org>
and subject line Bug#935945: fixed in linux 5.3.9-1
has caused the Debian Bug report #935945,
regarding linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures.
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
935945: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=935945
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]


Back to top | Article view | linux.debian.kernel


csiph-web