sign kernel modules

Question

sign kernel modules

Opened this issue 5 years ago · 12 comments

Hello!
How I should sign kernel modules (dkms) for loading and working properly?
At the moment I have:

modprobe: ERROR: could not insert 'vboxdrv': Operation not permitted

dmesg:

PKCS#7 signature not signed with a trusted key

Thanks in advance!

Answer 1 · 2019-07-03T12:47:30.000Z

Hello!

Here is article on this topic: https://stegard.net/2016/10/virtualbox-secure-boot-ubuntu-fail/

In short, module signature required when Secure Boot is enabled. At this moment linux-secureboot-kit doesn't sign DKMS modules, but I think it is also possible to add signing hook into DKMS post-install scripts or existing kernel post-install hooks.

Recipe above uses machine owner keys (MOK) to sign modules, which enrolment requires additional reboot. Probably we don't need MOK keys and we are already good to go with our db.key and db.crt. I'll try it soon and we'll see if automation in linux-secureboot-kit can be extended to cover DKMS modules along with the rest of protected code.

Answer 2 · 2019-07-03T12:52:42.000Z

@Snawoot thanks a lot for a fast answer!
That's good, firstly I will try sign modules with MOK, and after I will wait for signing DKMS modules by linux-secureboot-kit ;)

Answer 3 · 2019-07-03T13:54:54.000Z

@Snawoot btw, I can't enroll MOK keys in UEFI - tool simply don't starting up on boot. I tried reset to setup mode and clean UEFI keys, but UEFI print me that: Secure Variable Update is locked down!
Also, efi-readvar print me: Variable MokList has no entries

Answer 4 · 2019-07-03T14:05:15.000Z

@mrsmith0x00 Then try to sign with db.key and db.crt instead of MOK keys. I think it has to work. Please tell your results.

Answer 5 · 2019-07-03T14:19:44.000Z

Some docs on this subject suggest my guess is correct: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Kernel_Administration_Guide/sect-signing-kernel-modules-for-secure-boot.html#sect-sources-for-public-keys-used-to-authenticate-kernel-modules

db keys are usable instead of MOK keys

Answer 6 · 2019-07-03T14:21:07.000Z

And since they are already installed in UEFI, you don't have to add them; you may sign modules with it right away.

Answer 7 · 2019-07-03T14:42:03.000Z

@mrsmith0x00 yeah, I think that this will work. But... I deleted my old linux-secure-boot folder with db.key and db.crt (sorry for that). Then I exported db file via efi-readvar -v db -o db.file. How can I solve this problem? Or I should reinstall all with zero?

Answer 8 · 2019-07-03T15:16:50.000Z

No problem. Variables contain only certificates, so private key is lost and you have to reinstall from scratch: remove all keys from UEFI, remove SignedBoot menu entry from UEFI and run install again.

Answer 9 · 2019-07-03T15:44:28.000Z

@Snawoot done! Via:
/usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 /home/user/linux-secureboot-kit/db.key /home/user/linux-secureboot-kit/db.crt /lib/modules/$(uname -r)/updates/dkms/vboxdrv.ko
Thank you!

Answer 10 · 2019-07-03T15:54:57.000Z

Thanks a lot for help! Now closed.

Answer 11 · 2019-07-03T15:55:54.000Z

Nice! Now I have shallow understanding how it should be automated and probably soon it'll be included into linux-secure-boot recipes.

Answer 12 · 2019-07-07T00:46:52.000Z

Short notice: automated signature for DKMS modules has been merged into master along with improved initramfs signature hooks.