Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #975118

Bug#935945: linux-image-5.2.0-2-amd64: does not load signed kernel modules when UEFI Secure Boot is enabled

Cross-posted to 2 groups.

Show all headers | View raw

I have this problem too and opened a duplicate #939773 earlier with some
investigation. Rephrasing my investigation from that duplicate:

In this kernel MOK key gets inserted into the .platform keyring (I see
CONFIG_INTEGRITY_PLATFORM_KEYRING is set to true in the kernel config) which
isn't used for validation of module signatures. I've found this related bug in
Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1701096. There are some
links to upstream patches but I've just checked linux master and
kernel/module_signing.c is still using only .secondary_trusted_keyring and
.builtin_trusted_keyring to verify modules signatures while MOK key is added
to .platform keyring.

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#935945: linux-image-5.2.0-2-amd64: does not load signed kernel modules when UEFI Secure Boot is enabled <bedrichperi@email.cz> - 2019-08-28 12:00 +0200
  Bug#935945: linux-image-5.2.0-2-amd64: does not load signed kernel modules when UEFI Secure Boot is enabled Sven Willner <sven.willner@gmail.com> - 2019-09-13 20:40 +0200
  Bug#935945: linux-image-5.2.0-2-amd64: does not load signed kernel modules when UEFI Secure Boot is enabled Marek Rusinowski <marekrusinowski@gmail.com> - 2019-09-14 18:00 +0200
  Bug#935945: refreshed patch Niv Sardi <x@xaiki.net> - 2019-10-07 00:40 +0200
  Bug#935945: Add patch Niv Sardi <x@xaiki.net> - 2019-10-10 17:40 +0200

csiph-web