Comment 0 for bug 1969432

Revision history for this message
Yuan-Chen Cheng (ycheng-twn) wrote :

Steps to reproduce:

1. enroll mok, and use the mok to sign dkms
2. make sure secure boot is on, and boots with kernel
3. load the kernel by either modprobe or insmod.

Expected:
the kernel module can be loaded.

Actually:
the kernel module can't be loaded.

Failed kernel: 5.17.0-1003-oem
Passed kernel: 5.15.0-25-generic

With 5.17 kernel, using command "dmesg | grep 509", I can't see the mok key.
With 5.15 kernel above, I can see the mok key is loaded like:

[ 0.896168] integrity: Loading X.509 certificate: UEFI:MokListRT (MOKvar table)
[ 0.896283] integrity: Loaded X.509 cert 'ubuntu Secure Boot Module Signature key: 670bc7d76f65d9cfc786f5501de6af89bf3973e7'