I write a simple hello world kernel module in Linux and I tried to load it to the kernel. but it was not possible because I get this error while I want to load it.

module verification failed: signature and/or required key missing - tainting kernel

I tried to find a solution for that but all of that found was about VM and not a real system.

my secure boot is disabled and I don't want to change kernel config and rebuild it.

I also tried to create a key with openssl and MOK and enroll it but in the last step that tries to sign module, I stopped because of No such file or directory error. I can't find /scripts/sign-file in /usr/lib/linux-headers-5.11.0-16-generic

I followed the answer to this question: Sign Kernel Modules

I am completely confused! can anyone help me??

my os is ubuntu and the kernel version is 5.11.0-16

UPDATE: now I understand my module seems to be signed via command modinfo hello.ko and this is the result:

$ modinfo hello.ko
filename:       /home/###/Documents/kernel/hello.ko
description:    This is the module description.
author:         ###
license:        Dual BSD/GPL
retpoline:      Y
name:           hello
vermagic:       5.11.0-16-generic SMP mod_unload modversions 
sig_id:         PKCS#7
signer:         ###
sig_key:        58:26:4E:F2:6A:5F:2F:DB:F0:21:E0:8C:79:60:E9:C8:78:38:01:3F
sig_hashalgo:   sha256
signature:      67:F2:74:BF:6A:AB:D4:AD:6C:EA:BD:35:D6:7A:9A:94:0F:C7:0F:6B:

but still I get error while inserting module:

$ sudo insmod hello.ko
insmod: ERROR: could not insert module hello.ko: Invalid module format
module verification failed: signature and/or required key missing - tainting kernel

This does not mean your module did not load. All it means is any kernel oops/panic messages will have a bit of information indicating that you have (or had at some point) an unsigned module loaded. This message is just a warning, not an error.

(But if you try to submit a kernel bug report that includes oops/panic messages with a taint mark, you'll very likely get a response "please try and reproduce the bug without any non-standard kernel modules first, or show the source code of your custom module as it might be relevant in troubleshooting the bug". This tends to save the time of kernel developers and distribution maintainers, as people sometimes submit bug reports without mentioning that they are trying something experimental.)

Debian packages the sign-file utility into a linux-kbuild-<kernel version> package. and I believe Ubuntu does the same. So you would need to make sure the package linux-kbuild-5.11 is installed. The path of the sign-file utility would be /usr/lib/linux-kbuild-5.11/scripts/sign-file.

However, when Secure Boot is disabled, the shimx64.efi will just directly load the real grubx64.efi bypassing all the Secure Boot steps, including loading the MOK. With the MOK not loaded, the kernel will have no way to recognize the signature on your module as valid. And with Secure Boot disabled, a signed module with an invalid signature is rejected, while unsigned modules only get a warning and a taint mark on any future oops/panic messages.

insmod: ERROR: could not insert module hello.ko: Invalid module format

After any kernel module loading failure, you should check the dmesg output: it might include a more specific error message. In this case it is likely to indicate that a module signature failed a validity check.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.