3

I am getting Kernel panic - not syncing: Attempted to kill init! during early boot on my Fedora Linux system. Root and home filesystems cannot have been mounted since both are encrypted and I have not entered the passphrase yet.

This happens with latest kernel (4.7.3). It does not happen with earlier kernels such as (I believe) 4.6.7.

On working kernels, I used this command to obtain the kernel log: from boot

journalctl --dmesg |
sed -n \
  "s/^Sep 05 [0-9]*:[0-9]*:[0-9]* [a-zA-Z0-9.]* kernel: \(efi\|EFI\)/\
    kernel: \1/p"

The output is:

kernel: efi: EFI v2.31 by American Megatrends
kernel: efi:  ACPI 2.0=0xdaf4d000  ACPI=0xdaf4d000  SMBIOS=0xdbf6e498  MPS=0xdbaddc18 
kernel: efifb: probing for efifb
kernel: efifb: framebuffer at 0xe0000000, mapped to 0xffffc90001000000, using 1876k, total 1875k
kernel: efifb: mode is 800x600x32, linelength=3200, pages=1
kernel: efifb: scrolling: redraw
kernel: efifb: Truecolor: size=8:8:8:8, shift=24:16:8:0
kernel: EFI: Loaded cert 'Toshiba Corporation Utility CA 2012: cc37e82804de6d8242718850b1af8d5f' linked to '.system_keyring'
kernel: EFI: Problem loading in-kernel X.509 certificate (-22)
kernel: EFI: Loaded cert 'Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53' linked to '.system_keyring'
kernel: EFI: Loaded cert 'Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4' linked to '.system_keyring'
kernel: EFI: Loaded cert 'Fedora Secure Boot CA: fde32599c2d61db1bf5807335d7b20e4cd963b42' linked to '.system_keyring'

22 corresponds to EINVAL which is not particularly helpful.

I have not been able to obtain any logs from the panicking kernel.

The exit code is 0xb which makes me suspect a segfault in systemd.

How can I identify the source of the problem, and how can I fix it?

Edit: Disabling secure boot makes the problem go away, but I don't want to do that permanently. Is there a way that I can disable the (presumably) problematic certificate?

  • 1
    This looks like a secure boot thingy, disable that [redacted]. There's nothing secure about secure boot. You EFI menu should have an option to disable secure boot. – grochmal Sep 5 '16 at 19:38
  • @grochmal can you explain? I thought that secure boot is a useful defense against persistent rootkits. – Demi Sep 5 '16 at 23:50
  • We have an awesome answer by AstroDan and another pretty good one by pabouk note that they both describe secure boot in detail, read 'till the end both of them. The point being that proper rootkits will work below the level of the secure boot, and can sign their own EIF stub before the EFI firmware tries to check it. – grochmal Sep 6 '16 at 0:09
  • 1
    @grochmal I don't get that from either AstroDan's or pabouk's answer: both seem to imply that secure boot can work. As I understand it, Fedora signs all drivers, so kernel-mode rootkits are not possible without a kernel/driver bug. – Demi Sep 6 '16 at 1:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.