Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.kernel > #65071 > unrolled thread
| Started by | Marek Rusinowski <marekrusinowski@gmail.com> |
|---|---|
| First post | 2019-09-08 19:50 +0200 |
| Last post | 2019-11-09 22:20 +0100 |
| Articles | 4 — 2 participants |
Back to article view | Back to linux.debian.kernel
Bug#939773: linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures. Marek Rusinowski <marekrusinowski@gmail.com> - 2019-09-08 19:50 +0200
Bug#939773: Duplicate Marek Rusinowski <marekrusinowski@gmail.com> - 2019-09-14 17:20 +0200
Bug#939773: marked as done (linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures.) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2019-10-21 00:10 +0200
Bug#939773: marked as done (linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures.) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2019-11-09 22:20 +0100
| From | Marek Rusinowski <marekrusinowski@gmail.com> |
|---|---|
| Date | 2019-09-08 19:50 +0200 |
| Subject | Bug#939773: linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures. |
| Message-ID | <yE9u1-7AB-3@gated-at.bofh.it> |
Package: src:linux Version: 5.2.9-2 Severity: important Dear Maintainer, I've updated kernel from 4.19 to 5.2 and kernel stopped accepting modules signed with MOK key. I have secure boot enabled on my system and enrolled generated MOK key. I use some out-of-tree modules that use DKMS. In the previous version of the kernel I was signing those modules with the MOK key and they loaded just fine as MOK key was loaded into the trusted keyring in the kernel. After the kernel update, MOK key gets inserted into the .platform keyring (I see CONFIG_INTEGRITY_PLATFORM_KEYRING is set to true in the kernel config) which apparently isn't used for validation of module signatures so I'm unable to load MOK signed modules. I would expect this to still work as the only option I have right now for using DKMS modules is building and using my own kernel image... This is also the method described in https://wiki.debian.org/SecureBoot. I've found this related bug in Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1701096. There are some links to upstream patches but I've just checked linux master and kernel/module_signing.c is still using only secondary_trusted_keyring and builtin_trusted_keyring to verify modules signatures. Thank you, Marek Rusinowski
[toc] | [next] | [standalone]
| From | Marek Rusinowski <marekrusinowski@gmail.com> |
|---|---|
| Date | 2019-09-14 17:20 +0200 |
| Subject | Bug#939773: Duplicate |
| Message-ID | <yGi09-4qG-1@gated-at.bofh.it> |
| In reply to | #65071 |
Sorry, this is a duplicate of #935945
[toc] | [prev] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2019-10-21 00:10 +0200 |
| Subject | Bug#939773: marked as done (linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures.) |
| Message-ID | <yTryG-1WY-15@gated-at.bofh.it> |
| In reply to | #65071 |
[Multipart message — attachments visible in raw view] — view raw
Your message dated Sun, 20 Oct 2019 22:05:41 +0000 with message-id <E1iMJKX-000Ibd-3e@fasolo.debian.org> and subject line Bug#935945: fixed in linux 5.3.7-1 has caused the Debian Bug report #935945, regarding linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures. to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 935945: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=935945 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [next] | [standalone]
| From | "Debian Bug Tracking System" <owner@bugs.debian.org> |
|---|---|
| Date | 2019-11-09 22:20 +0100 |
| Subject | Bug#939773: marked as done (linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures.) |
| Message-ID | <z0Gjk-ji-47@gated-at.bofh.it> |
| In reply to | #65071 |
[Multipart message — attachments visible in raw view] — view raw
Your message dated Sat, 09 Nov 2019 21:10:12 +0000 with message-id <E1iTXzo-0003H6-Bv@fasolo.debian.org> and subject line Bug#935945: fixed in linux 5.3.9-1 has caused the Debian Bug report #935945, regarding linux-image-5.2.0-2-amd64: MOK key not used for verification of modules signatures. to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 935945: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=935945 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.kernel
csiph-web