Skip to content

[FEATURE] Signed external kernel modules rejected on Fedora CachyOS kernel despite DB key being trusted #101

Description

@a012-alex

Pre-flight checklist

  • I have searched existing issues/PRs and this has not been requested before.
  • I have read the Contributing Guidelines.

Request type

  • New patch / patchset inclusion
  • Kernel config change (enable/disable option)
  • New kernel variant
  • Scheduler tuning / addition
  • Compiler / LTO / PGO optimization
  • Security hardening
  • Driver or hardware enablement
  • Other

Summary

Signed external kernel modules are rejected by the Fedora CachyOS kernel, while the same modules work with the stock Fedora kernel.

The module is signed with a key enrolled in UEFI DB, but the CachyOS kernel reports:

modprobe: ERROR: could not insert 'nvidia': Key was rejected by service

and dmesg shows:

Loading of module with unavailable key is rejected

Motivation / use case

I use Secure Boot with externally built kernel modules (for example, NVIDIA driver modules).

The same signed module loads successfully with Fedora's stock kernel, but fails with the CachyOS kernel. This prevents using Secure Boot together with out-of-tree modules.

Patch / upstream reference (if available)

Related discussion:

The kernel configuration contains the Secure Boot related options from that change, including:

CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_MACHINE_KEYRING=y
CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=y

However, platform keys still do not appear to be usable for module signature verification.

Possible missing configuration or patch differences compared with Fedora kernel may involve:

CONFIG_INTEGRITY_CA_MACHINE_KEYRING
CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY

or other Fedora-specific changes related to trusted keyring handling.

Testing / benchmarks

Environment:

  • Fedora 44
  • kernel-cachyos 7.1.3-cachyos1.fc44.x86_64
  • Secure Boot enabled
  • Key source: UEFI DB (not MOK)

Module signature:


modinfo nvidia

signer:         Database Key
sig_hashalgo:   sha512

Key status:


keyctl list %:.platform

asymmetric: Database Key

The key is present in the platform keyring.

However:


keyctl search %:.secondary_trusted_keys asymmetric "Database Key"

keyctl_search: Required key not available

The same signed NVIDIA module works with Fedora's official kernel.

Additional context

Relevant CachyOS kernel configuration:


CONFIG_MODULE_SIG=y
CONFIG_MODULE_SIG_ALL=y
CONFIG_MODULE_SIG_HASH="sha512"

CONFIG_INTEGRITY=y
CONFIG_INTEGRITY_SIGNATURE=y
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
CONFIG_INTEGRITY_TRUSTED_KEYRING=y
CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_MACHINE_KEYRING=y

CONFIG_SYSTEM_TRUSTED_KEYRING=y
CONFIG_SECONDARY_TRUSTED_KEYRING=y

Could you please check whether the CachyOS Fedora kernel requires additional configuration or patches to allow UEFI DB keys to be used for external module signature verification?

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions