Pre-flight checklist
Request type
Summary
Signed external kernel modules are rejected by the Fedora CachyOS kernel, while the same modules work with the stock Fedora kernel.
The module is signed with a key enrolled in UEFI DB, but the CachyOS kernel reports:
modprobe: ERROR: could not insert 'nvidia': Key was rejected by service
and dmesg shows:
Loading of module with unavailable key is rejected
Motivation / use case
I use Secure Boot with externally built kernel modules (for example, NVIDIA driver modules).
The same signed module loads successfully with Fedora's stock kernel, but fails with the CachyOS kernel. This prevents using Secure Boot together with out-of-tree modules.
Patch / upstream reference (if available)
Related discussion:
The kernel configuration contains the Secure Boot related options from that change, including:
CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_MACHINE_KEYRING=y
CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=y
However, platform keys still do not appear to be usable for module signature verification.
Possible missing configuration or patch differences compared with Fedora kernel may involve:
CONFIG_INTEGRITY_CA_MACHINE_KEYRING
CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
or other Fedora-specific changes related to trusted keyring handling.
Testing / benchmarks
Environment:
- Fedora 44
- kernel-cachyos 7.1.3-cachyos1.fc44.x86_64
- Secure Boot enabled
- Key source: UEFI DB (not MOK)
Module signature:
modinfo nvidia
signer: Database Key
sig_hashalgo: sha512
Key status:
keyctl list %:.platform
asymmetric: Database Key
The key is present in the platform keyring.
However:
keyctl search %:.secondary_trusted_keys asymmetric "Database Key"
keyctl_search: Required key not available
The same signed NVIDIA module works with Fedora's official kernel.
Additional context
Relevant CachyOS kernel configuration:
CONFIG_MODULE_SIG=y
CONFIG_MODULE_SIG_ALL=y
CONFIG_MODULE_SIG_HASH="sha512"
CONFIG_INTEGRITY=y
CONFIG_INTEGRITY_SIGNATURE=y
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
CONFIG_INTEGRITY_TRUSTED_KEYRING=y
CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_MACHINE_KEYRING=y
CONFIG_SYSTEM_TRUSTED_KEYRING=y
CONFIG_SECONDARY_TRUSTED_KEYRING=y
Could you please check whether the CachyOS Fedora kernel requires additional configuration or patches to allow UEFI DB keys to be used for external module signature verification?
Pre-flight checklist
Request type
Summary
Signed external kernel modules are rejected by the Fedora CachyOS kernel, while the same modules work with the stock Fedora kernel.
The module is signed with a key enrolled in UEFI DB, but the CachyOS kernel reports:
and dmesg shows:
Motivation / use case
I use Secure Boot with externally built kernel modules (for example, NVIDIA driver modules).
The same signed module loads successfully with Fedora's stock kernel, but fails with the CachyOS kernel. This prevents using Secure Boot together with out-of-tree modules.
Patch / upstream reference (if available)
Related discussion:
The kernel configuration contains the Secure Boot related options from that change, including:
However, platform keys still do not appear to be usable for module signature verification.
Possible missing configuration or patch differences compared with Fedora kernel may involve:
or other Fedora-specific changes related to trusted keyring handling.
Testing / benchmarks
Environment:
Module signature:
Key status:
The key is present in the platform keyring.
However:
The same signed NVIDIA module works with Fedora's official kernel.
Additional context
Relevant CachyOS kernel configuration:
Could you please check whether the CachyOS Fedora kernel requires additional configuration or patches to allow UEFI DB keys to be used for external module signature verification?