Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #64973 > unrolled thread

Bug#935945: linux-image-5.2.0-2-amd64: does not load signed kernel modules when UEFI Secure Boot is enabled

Back to article view | Back to linux.debian.kernel

Contents

  Bug#935945: linux-image-5.2.0-2-amd64: does not load signed kernel modules when UEFI Secure Boot is enabled <bedrichperi@email.cz> - 2019-08-28 12:00 +0200
    Bug#935945: linux-image-5.2.0-2-amd64: does not load signed kernel modules when UEFI Secure Boot is enabled Sven Willner <sven.willner@gmail.com> - 2019-09-13 20:40 +0200
    Bug#935945: linux-image-5.2.0-2-amd64: does not load signed kernel modules when UEFI Secure Boot is enabled Marek Rusinowski <marekrusinowski@gmail.com> - 2019-09-14 18:00 +0200
    Bug#935945: refreshed patch Niv Sardi <x@xaiki.net> - 2019-10-07 00:40 +0200
    Bug#935945: Add patch Niv Sardi <x@xaiki.net> - 2019-10-10 17:40 +0200
    Bug#935945: marked as done (linux-image-5.2.0-2-amd64: does not  load signed kernel modules when UEFI Secure Boot is enabled) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2019-10-21 00:10 +0200
    Bug#935945: fixed in linux 5.3.7-1 Sven Willner <sven.willner@gmail.com> - 2019-10-25 10:20 +0200
    Bug#935945: (no subject) Sven Willner <sven.willner@gmail.com> - 2019-11-04 14:20 +0100

#64973 — Bug#935945: linux-image-5.2.0-2-amd64: does not load signed kernel modules when UEFI Secure Boot is enabled

Package: src:linux
Version: 5.2.9-2
Severity: important

Dear Maintainer,

   * What led up to the situation?

I regularly update Debian Testing (bullseye) on multiple computers. Two days ago something broke when kernel update from 4.19 to 5.2 arrived. Could you please help me to troubleshoot it?

   * What exactly did you do (or not do) that was effective (or ineffective)?

On computer with UEFI but without enabled Secure Boot everything works just fine and I can load DKMS ZFS module with kernel 5.2.0-2-amd64. On a computer with secure boot enabled I can’t load ZFS kernel module that is signed using my own key that was enrolled into UEFI using "mokutil".

   * What was the outcome of this action?

as root:
# modprobe zfs
modprobe: ERROR: could not insert 'zfs': Operation not permitted

   * What outcome did you expect instead?

Load it as usually. I was able to reproduce the same issue on a different computer with Secure Boot and signed modules.

A few notes:

* It works (modules are loaded) after I boot back to linux-image-4.19.0-5-amd64 (but this is not a solution)

* It works (modules are loaded) after I disable Secure Boot (but this is not a solution)

* I'm sure that the modules are signed. I tested using:

find /lib/modules -name '*.ko' -exec grep -FL '~Module signature appended~' {} \+

* I can check that the key was loaded from UEFI during boot

Boot log with `4.19.0-5-amd64`
-------------------------------
Aug 26 20:34:54 bedik002 kernel: efi: EFI v2.50 by INSYDE Corp.
Aug 26 20:34:54 bedik002 kernel: efi:  ACPI 2.0=0x7fffd014  SMBIOS=0x7f0d9000  SMBIOS 3.0=0x7f0d7000  ESRT=0x7f0d4158  MEMATTR=0x6f699018  TPMEventLog=0x66e32018
Aug 26 20:34:54 bedik002 kernel: Kernel is locked down from EFI secure boot; see https://wiki.debian.org/SecureBoot
Aug 26 20:34:54 bedik002 kernel: ACPI: UEFI 0x000000007FFFC000 000236 (v01 HPQOEM 8362     00000001 HP   00040000)
Aug 26 20:34:54 bedik002 kernel: ACPI: UEFI 0x000000007FFFB000 000042 (v01 HPQOEM 8362     00000002 HP   00040000)
Aug 26 20:34:54 bedik002 kernel: clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645519600211568 ns
Aug 26 20:34:54 bedik002 kernel: pci 0000:00:02.0: BAR 2: assigned to efifb
Aug 26 20:34:54 bedik002 kernel: Registered efivars operations
Aug 26 20:34:54 bedik002 kernel: Asymmetric key parser 'x509' registered
Aug 26 20:34:54 bedik002 kernel: efifb: probing for efifb
Aug 26 20:34:54 bedik002 kernel: efifb: framebuffer at 0x90000000, using 8100k, total 8100k
Aug 26 20:34:54 bedik002 kernel: efifb: mode is 1920x1080x32, linelength=7680, pages=1
Aug 26 20:34:54 bedik002 kernel: efifb: scrolling: redraw
Aug 26 20:34:54 bedik002 kernel: efifb: Truecolor: size=8:8:8:8, shift=24:16:8:0
Aug 26 20:34:54 bedik002 kernel: fb0: EFI VGA frame buffer device
Aug 26 20:34:54 bedik002 kernel: Loading compiled-in X.509 certificates
Aug 26 20:34:54 bedik002 kernel: Loaded X.509 cert 'Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1'
Aug 26 20:34:54 bedik002 kernel: Loaded X.509 cert 'Debian Secure Boot Signer: 00a7468def'
Aug 26 20:34:54 bedik002 kernel: Loaded UEFI:db cert 'Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53' linked to secondary sys keyring
Aug 26 20:34:54 bedik002 kernel: Loaded UEFI:db cert 'Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4' linked to secondary sys keyring
Aug 26 20:34:54 bedik002 kernel: Loaded UEFI:db cert 'Hewlett-Packard Company: HP UEFI Secure Boot 2013 DB key: 1d7cf2c2b92673f69c8ee1ec7063967ab9b62bec' linked to secondary sys keyring

my key:
Aug 26 20:34:54 bedik002 kernel: Loaded UEFI:MokListRT cert 'bedik002 module signing key: b1025ea690c4c8f9593b0a158045e72586a3c12f' linked to secondary sys keyring

Aug 26 20:34:54 bedik002 kernel: Loaded UEFI:MokListRT cert 'Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1' linked to secondary sys keyring
Aug 26 20:34:54 bedik002 kernel: fb: switching to inteldrmfb from EFI VGA
Aug 26 20:34:54 bedik002 kernel: EFI Variables Facility v0.08 2004-May-17
Aug 26 20:34:54 bedik002 kernel: pstore: Registered efi as persistent store backend
Aug 26 20:34:56 bedik002 systemd[1]: Mounting /boot/efi...
Aug 26 20:34:56 bedik002 systemd[1]: Mounted /boot/efi.
Aug 26 20:35:03 bedik002 systemd[1841]: Listening on GnuPG network certificate management daemon.
Aug 26 20:35:08 bedik002 systemd[2187]: Listening on GnuPG network certificate management daemon.
-------------------------------

Boot log with `5.2.0-2-amd64` (looks different but it does load the key)
-------------------------------
Aug 26 20:39:37 bedik002 kernel: efi: EFI v2.50 by INSYDE Corp.
Aug 26 20:39:37 bedik002 kernel: efi:  ACPI 2.0=0x7fffd014  SMBIOS=0x7f0d9000  SMBIOS 3.0=0x7f0d7000  ESRT=0x7f0d4158  MEMATTR=0x6f699018  TPMEventLog=0x66e32018
Aug 26 20:39:37 bedik002 kernel: Kernel is locked down from EFI secure boot; see https://wiki.debian.org/SecureBoot
Aug 26 20:39:37 bedik002 kernel: ACPI: UEFI 0x000000007FFFC000 000236 (v01 HPQOEM 8362     00000001 HP   00040000)
Aug 26 20:39:37 bedik002 kernel: ACPI: UEFI 0x000000007FFFB000 000042 (v01 HPQOEM 8362     00000002 HP   00040000)
Aug 26 20:39:37 bedik002 kernel: clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645519600211568 ns
Aug 26 20:39:37 bedik002 kernel: ACPI: Core revision 20190509
Aug 26 20:39:37 bedik002 kernel: pci 0000:00:02.0: BAR 2: assigned to efifb
Aug 26 20:39:37 bedik002 kernel: Registered efivars operations
Aug 26 20:39:37 bedik002 kernel: Asymmetric key parser 'x509' registered
Aug 26 20:39:37 bedik002 kernel: efifb: probing for efifb
Aug 26 20:39:37 bedik002 kernel: efifb: framebuffer at 0x90000000, using 8100k, total 8100k
Aug 26 20:39:37 bedik002 kernel: efifb: mode is 1920x1080x32, linelength=7680, pages=1
Aug 26 20:39:37 bedik002 kernel: efifb: scrolling: redraw
Aug 26 20:39:37 bedik002 kernel: efifb: Truecolor: size=8:8:8:8, shift=24:16:8:0
Aug 26 20:39:37 bedik002 kernel: fb0: EFI VGA frame buffer device
Aug 26 20:39:37 bedik002 kernel: Loading compiled-in X.509 certificates
Aug 26 20:39:37 bedik002 kernel: Loaded X.509 cert 'Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1'
Aug 26 20:39:37 bedik002 kernel: Loaded X.509 cert 'Debian Secure Boot Signer: 00a7468def'
Aug 26 20:39:37 bedik002 kernel: integrity: Loading X.509 certificate: UEFI:db
Aug 26 20:39:37 bedik002 kernel: integrity: Loaded X.509 cert 'Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53'
Aug 26 20:39:37 bedik002 kernel: integrity: Loading X.509 certificate: UEFI:db
Aug 26 20:39:37 bedik002 kernel: integrity: Loaded X.509 cert 'Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4'
Aug 26 20:39:37 bedik002 kernel: integrity: Loading X.509 certificate: UEFI:db
Aug 26 20:39:37 bedik002 kernel: integrity: Loaded X.509 cert 'Hewlett-Packard Company: HP UEFI Secure Boot 2013 DB key: 1d7cf2c2b92673f69c8ee1ec7063967ab9b62bec'
Aug 26 20:39:37 bedik002 kernel: integrity: Loading X.509 certificate: UEFI:MokListRT

my key:
Aug 26 20:39:37 bedik002 kernel: integrity: Loaded X.509 cert 'bedik002 module signing key: b1025ea690c4c8f9593b0a158045e72586a3c12f'

Aug 26 20:39:37 bedik002 kernel: integrity: Loading X.509 certificate: UEFI:MokListRT
Aug 26 20:39:37 bedik002 kernel: integrity: Loaded X.509 cert 'Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1'
Aug 26 20:39:37 bedik002 kernel: fb0: switching to inteldrmfb from EFI VGA
Aug 26 20:39:37 bedik002 kernel: EFI Variables Facility v0.08 2004-May-17
Aug 26 20:39:37 bedik002 kernel: pstore: Registered efi as persistent store backend
Aug 26 20:39:38 bedik002 systemd[1]: Mounting /boot/efi...
Aug 26 20:39:38 bedik002 systemd[1]: Mounted /boot/efi.
Aug 26 20:39:42 bedik002 systemd[1201]: Listening on GnuPG network certificate management daemon.
Aug 26 20:39:55 bedik002 systemd[1546]: Listening on GnuPG network certificate management daemon.
-------------------------------


-- Package-specific info:
** Version:
Linux version 5.2.0-2-amd64 (debian-kernel@lists.debian.org) (gcc version 8.3.0 (Debian 8.3.0-21)) #1 SMP Debian 5.2.9-2 (2019-08-21)

** Command line:
BOOT_IMAGE=/vmlinuz-5.2.0-2-amd64 root=/dev/mapper/sda_crypted ro rootflags=subvol=btroot systemd.show_status=1 quiet quiet

** Not tainted

** Kernel log:
Unable to read kernel log; any relevant messages should be attached

** Model information
sys_vendor: HP
product_name: HP Pavilion Laptop 14-bk0xx
product_version: Type1ProductConfigId
chassis_vendor: HP
chassis_version: Chassis Version
bios_vendor: Insyde
bios_version: F.18
board_vendor: HP
board_name: 8362
board_version: 46.24

** Loaded modules:
nft_limit
bnep
nft_reject_ipv6
nf_reject_ipv6
nft_reject
fuse
nft_ct
nsh
nf_conncount
nf_nat
nf_conntrack
nf_defrag_ipv6
nf_defrag_ipv4
nf_tables_set
nft_counter
nf_tables
nfnetlink
nls_ascii
nls_cp437
vfat
fat
ext4
mbcache
jbd2
crc32c_generic
snd_soc_skl
snd_soc_skl_ipc
snd_hda_codec_hdmi
snd_soc_sst_ipc
snd_soc_sst_dsp
snd_hda_ext_core
snd_soc_acpi_intel_match
snd_soc_acpi
snd_hda_codec_realtek
intel_rapl
snd_hda_codec_generic
ledtrig_audio
snd_soc_core
snd_compress
x86_pkg_temp_thermal
intel_powerclamp
coretemp
snd_hda_intel
btusb
btrtl
btbcm
btintel
kvm_intel
bluetooth
snd_hda_codec
snd_hda_core
uvcvideo
iwlwifi
snd_hwdep
kvm
snd_pcm
videobuf2_vmalloc
joydev
videobuf2_memops
irqbypass
videobuf2_v4l2
snd_timer
videobuf2_common
efi_pstore
intel_cstate
cfg80211
videodev
intel_uncore
drbg
media
serio_raw
wmi_bmof
pcspkr
intel_rapl_perf
hp_wmi
ansi_cprng
sparse_keymap
efivars
snd
ecdh_generic
iTCO_wdt
iTCO_vendor_support
elan_i2c
ecc
mei_me
watchdog
rfkill
soundcore
crc16
sg
mei
processor_thermal_device
intel_pch_thermal
intel_soc_dts_iosf
battery
tpm_crb
hp_accel
int3403_thermal
tpm_tis
int340x_thermal_zone
pcc_cpufreq
tpm_tis_core
lis3lv02d
tpm
input_polldev
hp_wireless
rng_core
evdev
ac
int3400_thermal
acpi_thermal_rel
acpi_pad
sha512_ssse3
sunrpc
sha512_generic
efivarfs
ip_tables
x_tables
autofs4
btrfs
xor
zstd_decompress
zstd_compress
raid6_pq
libcrc32c
dm_crypt
dm_mod
sd_mod
crct10dif_pclmul
crc32_pclmul
i915
crc32c_intel
ghash_clmulni_intel
i2c_algo_bit
aesni_intel
drm_kms_helper
xhci_pci
xhci_hcd
ahci
libahci
aes_x86_64
crypto_simd
cryptd
r8169
libata
psmouse
glue_helper
usbcore
drm
i2c_i801
scsi_mod
realtek
libphy
usb_common
wmi
video
button


-- System Information:
Debian Release: bullseye/sid
  APT prefers testing
  APT policy: (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 5.2.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages linux-image-5.2.0-2-amd64 depends on:
ii  initramfs-tools [linux-initramfs-tool]  0.135
ii  kmod                                    26-1
ii  linux-base                              4.6

Versions of packages linux-image-5.2.0-2-amd64 recommends:
ii  apparmor             2.13.3-4
ii  firmware-linux-free  3.4

Versions of packages linux-image-5.2.0-2-amd64 suggests:
pn  debian-kernel-handbook  <none>
ii  grub-efi-amd64          2.04-2
pn  linux-doc-5.2           <none>

Versions of packages linux-image-5.2.0-2-amd64 is related to:
pn  firmware-amd-graphics     <none>
pn  firmware-atheros          <none>
pn  firmware-bnx2             <none>
pn  firmware-bnx2x            <none>
pn  firmware-brcm80211        <none>
pn  firmware-cavium           <none>
pn  firmware-intel-sound      <none>
pn  firmware-intelwimax       <none>
pn  firmware-ipw2x00          <none>
pn  firmware-ivtv             <none>
pn  firmware-iwlwifi          <none>
pn  firmware-libertas         <none>
pn  firmware-linux-nonfree    <none>
pn  firmware-misc-nonfree     <none>
pn  firmware-myricom          <none>
pn  firmware-netxen           <none>
pn  firmware-qlogic           <none>
pn  firmware-realtek          <none>
pn  firmware-samsung          <none>
pn  firmware-siano            <none>
pn  firmware-ti-connectivity  <none>
pn  xen-hypervisor            <none>

-- no debconf information

[toc] | [next] | [standalone]

#65108

I also have this problem and, unfortunately did not find this bug report
earlier and opened a duplicate in #940181. As noted there, I believe the
issue can be fixed by setting CONFIG_SECONDARY_TRUSTED_KEYRING=y in the
kernel config.

[toc] | [prev] | [next] | [standalone]

#65111

I have this problem too and opened a duplicate #939773 earlier with some
investigation. Rephrasing my investigation from that duplicate:

In this kernel MOK key gets inserted into the .platform keyring (I see
CONFIG_INTEGRITY_PLATFORM_KEYRING is set to true in the kernel config) which
isn't used for validation of module signatures. I've found this related bug in
Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1701096. There are some
links to upstream patches but I've just checked linux master and
kernel/module_signing.c is still using only .secondary_trusted_keyring and
.builtin_trusted_keyring to verify modules signatures while MOK key is added
to .platform keyring.

[toc] | [prev] | [next] | [standalone]

#65335 — Bug#935945: refreshed patch

I have refreshed the fedora mentioned patch for current debian TOT:
https://salsa.debian.org/xaiki/linux/commit/ff2ec75144fd87586a4206d394c6ebe6d7f79b4d

[toc] | [prev] | [next] | [standalone]

#65372 — Bug#935945: Add patch

tags 935945 + patch
thanks

I've finally managed to get the time to do the mok dance and test this
patch, I can confirm it fixes this bug.
I have updated the patch to close this bug in the debian/changelog and
created a Merge Request here:
https://salsa.debian.org/kernel-team/linux/merge_requests/177

as you can see in the following log i've built a kernel signed with my
mok key: 8b6895ea20ac18cf58b558b8367eabd6400d021d and was able to build
and insmod a module signed by a newly created Test Key:
4cd5c2c83a310e6d579d55511a554610481e7a54 that lives only in the
.platform keyring

┌[~/mok/mok2]
└[cochabamba] sudo keyctl show -x %:.builtin_trusted_keys                            11:23:02
Keyring
0x23f53761 ---lswrv      0     0  keyring: .builtin_trusted_keys
0x3140da79 ---lswrv      0     0   \_ asymmetric: Niv Sardi: 8b6895ea20ac18cf58b558b8367eabd6400d021d
0x01e9fad1 ---lswrv      0     0   \_ asymmetric: Debian Secure Boot Signer: 00a7468def
0x11bd6209 ---lswrv      0     0   \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
┌[~/mok/mok2]
└[cochabamba] sudo keyctl show -x %:.platform                                        11:23:03
Keyring
0x1e71f408 ---lswrv      0     0  keyring: .platform
0x29f6f98b ---lswrv      0     0   \_ asymmetric: Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53
0x3f687f0a ---lswrv      0     0   \_ asymmetric: Debian Secure Boot CA: 6ccece7e4c6c0d1f6149f3dd27dfcc5cbb419ea1
0x0b1fbe3b ---lswrv      0     0   \_ asymmetric: Test Key: 4cd5c2c83a310e6d579d55511a554610481e7a54
0x03ab3e26 ---lswrv      0     0   \_ asymmetric: Canonical Ltd. Master Certificate Authority: ad91990bc22ab1f517048c23b6655a268e345a63
0x0fafa6b4 ---lswrv      0     0   \_ asymmetric: Niv Sardi: 8b6895ea20ac18cf58b558b8367eabd6400d021d
0x04ad134e ---lswrv      0     0   \_ asymmetric: : 6e4c5e40f58b7aad499ef717e69bc28d
0x0e4d3559 ---lswrv      0     0   \_ asymmetric: Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4
┌[~/mok/mok2]
└[cochabamba] hexdump -C wireguard.ko |tail -24                                      11:23:07
00053be0  54 65 73 74 20 4b 65 79  02 14 00 c5 e0 a1 ae 53  |Test Key.......S|
00053bf0  9b 37 c2 3d 84 40 1f 7d  4c bf 8d 2f 99 78 30 0b  |.7.=.@.}L../.x0.|
00053c00  06 09 60 86 48 01 65 03  04 02 01 30 0d 06 09 2a  |..`.H.e....0...*|
00053c10  86 48 86 f7 0d 01 01 01  05 00 04 82 01 00 6c fb  |.H............l.|
00053c20  bb bc 13 9f cb 83 42 0f  db 95 72 b4 1f b3 78 40  |......B...r...x@|
00053c30  5c 9e 57 1f e9 44 b6 7c  da de 4a 9a 27 2c 01 12  |\.W..D.|..J.',..|
00053c40  72 ef 66 a6 ff ea ec 65  1d cc f4 89 37 47 70 6b  |r.f....e....7Gpk|
00053c50  52 62 49 ef e0 01 ab 0a  1c af b7 c8 68 e5 aa 29  |RbI.........h..)|
00053c60  42 92 be da b0 78 e2 7e  25 97 b9 b6 be 07 69 eb  |B....x.~%.....i.|
00053c70  dd 51 36 ce 2c 22 fc 3d  60 6c ff ba c1 03 ad c4  |.Q6.,".=`l......|
00053c80  8b e2 39 a4 87 d2 27 38  21 ce 33 e6 80 51 ad a1  |..9...'8!.3..Q..|
00053c90  b4 8d 55 10 6b 3d fc b5  d6 c7 61 1b 10 bf 61 a9  |..U.k=....a...a.|
00053ca0  b1 2a 13 56 4a 48 f8 9b  20 fb 94 85 fe 79 75 63  |.*.VJH.. ....yuc|
00053cb0  2c b0 72 d0 74 8c 5e 45  8e 4f 27 47 fa 37 62 ce  |,.r.t.^E.O'G.7b.|
00053cc0  ae 9d 18 f8 ef 2c 47 4b  92 01 4e 1e d5 b5 9a f0  |.....,GK..N.....|
00053cd0  d7 c0 47 f0 08 2c 5e d5  4a 12 24 7e 48 9a 9b 55  |..G..,^.J.$~H..U|
00053ce0  4e 93 a7 e4 ec 8b c1 f3  b8 c9 e1 98 c8 54 b2 0e  |N............T..|
00053cf0  8b e0 47 e4 3c c8 ff 84  ac c2 b8 74 f7 24 10 41  |..G.<......t.$.A|
00053d00  6c 09 82 e1 a1 67 a2 7a  3b 95 0a 81 b7 67 9f 6d  |l....g.z;....g.m|
00053d10  c5 9e 12 cf a2 16 b5 d6  f3 71 e8 e4 0e 0a 00 00  |.........q......|
00053d20  02 00 00 00 00 00 00 00  01 8e 7e 4d 6f 64 75 6c  |..........~Modul|
00053d30  65 20 73 69 67 6e 61 74  75 72 65 20 61 70 70 65  |e signature appe|
00053d40  6e 64 65 64 7e 0a                                 |nded~.|
00053d46

[toc] | [prev] | [next] | [standalone]

#65424 — Bug#935945: marked as done (linux-image-5.2.0-2-amd64: does not load signed kernel modules when UEFI Secure Boot is enabled)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Sun, 20 Oct 2019 22:05:41 +0000
with message-id <E1iMJKX-000Ibd-3e@fasolo.debian.org>
and subject line Bug#935945: fixed in linux 5.3.7-1
has caused the Debian Bug report #935945,
regarding linux-image-5.2.0-2-amd64: does not load signed kernel modules when UEFI Secure Boot is enabled
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
935945: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=935945
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#65499 — Bug#935945: fixed in linux 5.3.7-1

affects 935945 + linux-image-5.3.0-1-amd64
affects 935945 + linux-image-amd64

Thanks!

Unfortunately, the problem still persists in linux-image-5.3.0-1-amd64
(Source-Version: 5.3.7-1) as the MOK is added to the ".platform"
keyring, which is not used for module verification (Niv Sardi's patch
should fix that).

[toc] | [prev] | [next] | [standalone]

#65556 — Bug#935945: (no subject)

affects 935945 + linux-image-amd64
thanks

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web