Yrurtj

Issue:

I'm trying to use signed kernel modules, but getting a failure for the insmod command:

PKCS#7 signature not signed with a trusted key

There is a potentially related error message during Linux boot:

[    3.342888] Loading compiled-in X.509 certificates

[    3.391774] Problem loading in-kernel X.509 certificate (-129)

The command cat /proc/keys shows .builtin_trusted_keys: empty

Setup:

The 4.9.x kernel was compiled with the following defconfig options:

...

CONFIG_MODULES=y

CONFIG_MODULE_UNLOAD=y

CONFIG_MODVERSIONS=y

CONFIG_MODULE_SRCVERSION_ALL=y

CONFIG_MODULE_SIG=y

CONFIG_MODULE_SIG_ALL=y

CONFIG_MODULE_SIG_FORCE=y

CONFIG_MODULE_SIG_SHA256=y

CONFIG_MODULE_SIG_HASH="sha256"

CONFIG_SYSTEM_TRUSTED_KEYRING=y

CONFIG_KEYS_DEBUG_PROC_KEYS=y

CONFIG_PERSISTENT_KEYRINGS=y

CONFIG_ENCRYPTED_KEYS=y

CONFIG_SECURITY_DMESG_RESTRICT=y

CONFIG_SECURITY=y

CONFIG_SECURITYFS=y

CONFIG_SECURITY_PATH=y

CONFIG_HARDENED_USERCOPY=y

CONFIG_SECURITY_SMACK=y

CONFIG_SECURITY_SMACK_BRINGUP=y

CONFIG_DEFAULT_SECURITY_DAC=y

...

Modules were signed with a command:
sign-file sha256 certs/signing_key.pem certs/signing_key.x509 <.ko>

Comments:

I assume I need to fix the in-kernel X.509 certificate loading error, but I haven't come across how to do that. I thought the file certs/signing_key.pem generated during kernel compilation would be wrapped into the kernel but it appears not based on /proc/keys. I don't want to disable signing or allow unsigned modules, I just want to sign them properly with a trusted key. If anyone has advice, that would be much appreciated.

The posts I've found regarding nvidia drivers and Ubuntu/Fedora haven't yielded any progress yet. Example:
PKCS#7 signature not signed with a trusted key

I think the kernel compilation expects the signing_key.* files in the base directory of the kernel source tree and not under a ”certs” subdirectory. The compilation process should automatically sign the standard modules for you; only third-party modules should need manual signing.

Also, my old script for compiling a 4.9.* kernel with signed modules had the certificate file in DER format. Perhaps it was necessary?

In the 4.14 and newer kernels, the procedure is a bit different: there is a kernel configuration option for specifying the pathname of the certificate file.