14

Installed Ubuntu with SIP disabled on MacBook 2017 - 0 issues, booted in seconds.

I have been building it out and created a problem while trying to make the WiFi work. At some point (it was very late) a combination of 3 things happened:

  1. I enabled SIP
  2. I attempted to install Broadcom 4360x drivers
  3. I reinstalled Touch pad Drivers from GitHub repository

These are the items :

            [  +0.001007] input: Apple Inc. iBridge as /devices/pci0000:00/0000:00:14.0/usb1/1-3/1-3:1.2/0003:05AC:8600.0001/input/input7
            [  +0.057765] hid-generic 0003:05AC:8600.0001: input,hidraw0: USB HID v1.01 Keyboard [Apple Inc. iBridge] on usb-0000:00:14.0-3/input2
            [  +0.000196] hid-generic 0003:05AC:8600.0002: hiddev0,hidraw1: USB HID v1.01 Device [Apple Inc. iBridge] on usb-0000:00:14.0-3/input3
            [  +0.000230] PKCS#7 signature not signed with a trusted key
            [  +0.000002] PKCS#7 signature not signed with a trusted key
            [  +0.000288] appletb: Touchbar usb device added; dev=0003:05AC:8600.0001
            [  +0.000004] appletb: releasing current hid driver 'hid-generic'

and

            [  +0.002784] ACPI: Dynamic OEM Table Load:
            [  +0.000010] ACPI Exception: AE_NO_MEMORY, SSDT 0xFFFF948D2BD80800 Table is duplicated (20170831/tbdata-562)
            [  +0.000000] No Local Variables are initialized for Method [GCAP]
            [  +0.000000] Initialized Arguments for Method [GCAP]:  (1 arguments defined for method invocation)

located a UUID issue where the boot was taking 2 minutes after installing Kali on same device. It was related to the swap file ID changing.

Kali loads in 2.2 seconds on same device, also Debian, all green down the line.

  • How to get the right PKCS#7 signature? I guess and also how to totally disable ACPI in the kernel, not BIOS. – Earthling Jul 13 '18 at 20:22
  • is not SIP a MacOS concept? Why talking about it with Linux? – Rui F Ribeiro Jul 13 '18 at 21:38
  • 1
    Because it is installed on a MacBook, inorder to setup the boot process properly SIP needs to be disabled temporarily. – Earthling Jul 13 '18 at 22:37
10

PKCS#7 signature not signed with a trusted key

This message is typically coming from a piece of hardware. In your case it's likely the Nvidia graphics card that's emitting this.

This issue is discussed here in more detail, where 2 users were actually experiencing this issue, titled: PKCS Signature error/warnings running dmesg on Ubuntu Mate 18.04.

If you search the internet you'll come across dozens of people that are also experiencing this issue. From the looks of it this issue is still ongoing:

NOTE: The issue seems to be associated with Ubuntu 18.04.

Source of message

Further searches for this message led me to this source code: ubuntu-xenial-kernel/certs/system_keyring.c. These lines are the ones emitting this:

if (!trusted) {
    pr_err("PKCS#7 signature not signed with a trusted key\n");
    ret = -ENOKEY;
}

Further searches will take you to sites that touch on signed kernel modules, such as this one - MODSIGN: Use PKCS#7 for module signatures

(2) Makes use of the PKCS#7 facility to provide module signatures.

Secure boot

Based on this AU Q&A titled: How to install module.ko module without kernel signature or kernel rebuild in Ubuntu 16.04? it was suggested you could either disable secure boot or sign the modules.

You either disable secure boot or sign the kernel module.

To disable secure boot you can follow directions in this Ubuntu wiki page titled: Testing Secure Boot.

References

  • 13
    Strange. I'm getting this message, even with secure boot turned off. – thebunnyrules Nov 17 '18 at 11:28
  • 5
    I also have Secure Boot off and it's not working :/ – Tin Man Feb 15 at 22:22
  • 2
    Ubuntu 18.04.2 LTS here. Had the warnings show up when I installed the CUDA drivers from Nvidia's developer web site. The drivers work, just the irritating warnings are there. – byteborg Mar 1 at 12:06
  • 1
    Ubuntu 18.04.2 LTS here. Have this warning with dmesg with Nvidia graphic card too, but nothing / no additional driver installed. – el-teedee Apr 29 at 19:13
  • 1
    This answer is simply incorrect. Secure boot does not even exist on any Macbook ever produced and even for Apple products that have it other than the the iMac Pro are at least 2018 or later. support.apple.com/en-us/HT208330 support.apple.com/en-us/HT208862 – lucian303 Jul 8 at 3:43
1

I was able to get around this issue by installing the cuda toolkit instead and adding its public key to the trusted keys. Follow the directions here: https://developer.nvidia.com/cuda-downloads

0

As for me, it appeared after a graphic card upgrade, the simple fact to update the drivers did the job

sudo apt purge nvidia-drivers-390
sudo apt install nvidia-drivers-430

Et voilà

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.