2

I'm having a little trouble signing my zfs module in Fedora 27 using UEFI/Secure Boot and I hoped someone here might be able to help.

As a quick explanation for how I would normally do this, I sign the VirtualBox module using keys I have already generated and registered with efibootmgr, with the following command:

# /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 ./key.priv ./key.der $(modinfo -n vboxdrv)

It works fine because vboxdrv exists as an ordinary kernel module, and I do the same thing successfully for every kernel update, and the process is generic enough that I should be able to do the same thing with zfs. But attempting to do so fails. Checking # modinfo -n zfs, I see that the zfs kernel module appears to exist as a compressed file - /lib/modules/4.15.17-300.fc27.x86_64/extra/zfs.ko.xz (and that is the correct current kernel version).

To see if maybe there's another module that exists elswhere, I run # find / -name zfs.ko which returns nothing, so this .xz file is the only zfs module available. Fine, so I run # xz --decompress zfs.ko.xz. This tells me that the data is corrupt (the xz utility is what returns this error, suggesting that it isn't an xz-compressed file, or at least is modified in some way or otherwise can't be handled by the builtin xz).

# modinfo zfs just returns the path to zfs.ko.xz and a modinfo error.

So I'm at a loss at this point. Disabling secure boot is not really an option I want to consider. How am I supposed to sign a compressed module if I can't decompress the file first? Or is it already signed with a key available for me somewhere to download that I'm supposed to register?

  • Did you accidentally corrupt the file yourself? I can't reproduce this; I get a valid zfs.ko kernel module when I decompress zfs.ko.xz – Michael Hampton Apr 20 '18 at 18:32
  • Maybe I did something accidentally. After seeing your comment I just removed zfs altogether and reinstalled it just in case, and now I can decompress it. However signing the resulting file did nothing. I couldn't even get modprobe to recognize the resulting file. – Kefka Apr 20 '18 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.