4

I am trying to modprobe wireguard as root, and it fails with:

modprobe: ERROR: could not insert 'wireguard': Operation not permitted

Adding verbose I get one more line:

[root@localhost ben]# insmod /lib/modules/5.2.11-100.fc29.x86_64/extra/wireguard.ko.xz
insmod: ERROR: could not insert module /lib/modules/5.2.11-100.fc29.x86_64/extra/wireguard.ko.xz: Operation not permitted

dkms runs fine without error. I've also disabled selinux and that made no difference. I don't see anything in the journalctl logs.

Looking through man pages and Google have not turned anything up.

I did find this helpful line in dmesg:

Lockdown: modprobe: Loading of unsigned module is restricted; see man kernel_lockdown.7

However that man page does not exist.

How can I debug this? Any pointers on where to go next?

4

Finally found something on it. It appears to be a "feature" where unsigned code can't be loaded into the kernel when UEFI secure boot is enabled (which it is).

To get the module loading, disable kernel lockdown via sys-rq:

# echo 1 > /proc/sys/kernel/sysrq
# echo x > /proc/sysrq-trigger

Then modprobe should work:

modprobe wireguard

For more information, see:

https://mjg59.dreamwidth.org/50577.html

https://bugzilla.redhat.com/show_bug.cgi?id=1599197

  • 1
    This is a great answer, and it fixed my issue. Unfortunately, you have to do this every time you update the kernel. – user2597747 Nov 12 '19 at 18:42
  • For me this issue is still present: # modprobe -vvv wireguard modprobe: INFO: custom logging function 0x55cf4e172a20 registered insmod /lib/modules/5.3.11-300.fc31.x86_64/kernel/net/wireguard.ko.xz modprobe: INFO: Failed to insert module '/lib/modules/5.3.11-300.fc31.x86_64/kernel/net/wireguard.ko.xz': Operation not permitted modprobe: ERROR: could not insert 'wireguard': Operation not permitted modprobe: INFO: context 0x55cf4eb9b4c0 released @Freedom_Ben do you have maybe some idea why? – valentt Nov 25 '19 at 11:18
0

I have similar problem, but get different verbose output from modprobe:

# modprobe -vvv wireguard
modprobe: INFO: custom logging function 0x55cf4e172a20 registered
insmod /lib/modules/5.3.11-300.fc31.x86_64/kernel/net/wireguard.ko.xz  
modprobe: INFO: Failed to insert module '/lib/modules/5.3.11-300.fc31.x86_64/kernel/net/wireguard.ko.xz': Operation not permitted
modprobe: ERROR: could not insert 'wireguard': Operation not permitted
modprobe: INFO: context 0x55cf4eb9b4c0 released

Any ideas how to get wireguard module loaded? I removed it and rebuild it without success:

dkms remove -m wireguard -v 0.0.20191012 -k 5.3.11-300.fc31.x86_64
dkms install -m wireguard -v 0.0.20191012

Any help us much appreciated.

  • Just wanted to say I'm still struggling with this too, so while I can't offer help I can offer commiseration :-) – Freedom_Ben Dec 2 '19 at 0:17
  • Did you get it working @valentt? At this point I may just wait until wireguard is part of the kernel. Supposedly that's happening soon. – Freedom_Ben Dec 17 '19 at 22:38
0

My Fedora 31 distribution didn't accepted echoing to SysRq. Arch Linux wiki suggested to use Alt+PrtSc+x (on laptops, where Fn is part of the keyboard). Lockdown was successfully disabled and wireguard successfully loaded. I installed akmod, so modprobe wireguard worked for me as alternative to SysRq+x (redhat manual says - it should be pressed on physically attached keyboard).

  • after rebooting: echo 1 > /proc/sys/kernel/sysrq is still required for Alt+PrtSc+x to be accepted by the system – igor Dec 29 '19 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.