I'm trying to use signed kernel modules, but getting a failure for the
PKCS#7 signature not signed with a trusted key
There is a potentially related error message during Linux boot:
[ 3.342888] Loading compiled-in X.509 certificates [ 3.391774] Problem loading in-kernel X.509 certificate (-129)
cat /proc/keys shows
The 4.9.x kernel was compiled with the following defconfig options:
... CONFIG_MODULES=y CONFIG_MODULE_UNLOAD=y CONFIG_MODVERSIONS=y CONFIG_MODULE_SRCVERSION_ALL=y CONFIG_MODULE_SIG=y CONFIG_MODULE_SIG_ALL=y CONFIG_MODULE_SIG_FORCE=y CONFIG_MODULE_SIG_SHA256=y CONFIG_MODULE_SIG_HASH="sha256" CONFIG_SYSTEM_TRUSTED_KEYRING=y CONFIG_KEYS_DEBUG_PROC_KEYS=y CONFIG_PERSISTENT_KEYRINGS=y CONFIG_ENCRYPTED_KEYS=y CONFIG_SECURITY_DMESG_RESTRICT=y CONFIG_SECURITY=y CONFIG_SECURITYFS=y CONFIG_SECURITY_PATH=y CONFIG_HARDENED_USERCOPY=y CONFIG_SECURITY_SMACK=y CONFIG_SECURITY_SMACK_BRINGUP=y CONFIG_DEFAULT_SECURITY_DAC=y ...
Modules were signed with a command:
sign-file sha256 certs/signing_key.pem certs/signing_key.x509 <.ko>
I assume I need to fix the in-kernel X.509 certificate loading error, but I haven't come across how to do that. I thought the file
certs/signing_key.pem generated during kernel compilation would be wrapped into the kernel but it appears not based on
/proc/keys. I don't want to disable signing or allow unsigned modules, I just want to sign them properly with a trusted key. If anyone has advice, that would be much appreciated.
The posts I've found regarding nvidia drivers and Ubuntu/Fedora haven't yielded any progress yet. Example: PKCS#7 signature not signed with a trusted key