signing of module mandatory for 16.04/32 bit non uefi board

Asked by Musbach

I cannot load my own module because Ubuntu 16.04/32 (4.4.0-59) complains that my module is not signed. "dmesg" says: "module verification failed: signature and/or required key missing - tainting kernel".
Therefore I sign my module my hand: "/usr/src/linux-headers-$(uname -r)/scripts/sign-file …" and "hexdump -C $(modinfo –n MY_MODULE) | tail" shows: "Module signature appended". If I want to insert my key into the keyring with "mokutil", I get the error "EFI variables are not supported on this system". The error message is correct because I am running on a 32 bit machine and my motherboard doesn't support uefi secure boot.
I am stuck. On one hand Ubuntu forces me to sign my module but I have no ways to insert my key into the key ring. Is there a workaround?

Question information

Language:
English Edit question
Status:
Answered
For:
Ubuntu kernel-package Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
actionparsnip (andrew-woodhead666) said :
#1

If you have a bug reported then you don't need a question as well. Keep everything in one place rather than fragmenting the issue

Revision history for this message
Musbach (frank-musbach) said :
#2

I am asking for a workaround.

Revision history for this message
Jeremy (wa113y3s) said :
#3

What happens if you

sudo modprobe -v your-module-name

Also check results for lsmod to see if your module is loaded

Revision history for this message
Musbach (frank-musbach) said :
#4

Here are the infos

# sudo modprobe my_module
modprobe: ERROR: could not insert 'my_module': Device or resource busy

# dmesg | tail -n 2
[21318.657998] my_module: module verification failed: signature and/or required key missing - tainting kernel
[21318.658369] my_module_init_struct: Phys start e3000000, start f9600000, nc-start f9a00000

# lsmod | grep my_module
give no results

Revision history for this message
Jeremy (wa113y3s) said :
#5

What if you
sudo modprobe -r my_module

sudo modprobe -v my_module

If it is the secure boot enforcement it usually says cannot insmod module required key not found.

The error 'module verification failed: signature and/or required key missing - tainting kernel" has been around for a long time and shouldn't interfere with the module loading. I still see if when I use modules compiled from github source code but the module loads. There could be an issue with the 32 bit kernel or something failing within your custom module

Revision history for this message
Musbach (frank-musbach) said :
#7

That are the results:

# sudo modprobe -r my_module
# sudo modprobe -v my_module
insmod /lib/modules/4.4.0-59-generic/updates/dkms/my_module.ko
modprobe: ERROR: could not insert 'hdshm': Device or resource busy
# dmesg | tail -n 2
[ 719.768057] my_module: module verification failed: signature and/or required key missing - tainting kernel
[ 719.768358] my_module_init_struct: Phys start e3000000, start f9600000, nc-start f9a00000

Revision history for this message
Musbach (frank-musbach) said :
#8

I get the following reaction if I redo “sudo modprobe -r my_module” and “sudo modprobe -r my_module” a second time:
1) The terminal output is the same:
insmod /lib/modules/4.4.0-59-generic/updates/dkms/my_module.ko
modprobe: ERROR: could not insert 'my_module': Device or resource busy
2) I see a crash in the dmesg:

[ 719.768057] my_module: module verification failed: signature and/or required key missing - tainting kernel
[ 719.768358] my_module_init_struct: Phys start e3000000, start f9600000, nc-start f9a00000
[ 1576.030967] perf interrupt took too long (5001 > 5000), lowering kernel.perf_event_max_sample_rate to 25000
[43637.770909] my_module_init_struct: Phys start e3000000, start f9e00000, nc-start fa200000
[43638.998400] ------------[ cut here ]------------
[43638.998415] WARNING: CPU: 0 PID: 3862 at /build/linux-5Vy7q8/linux-4.4.0/fs/sysfs/dir.c:31 sysfs_warn_dup+0x60/0x70()
[43638.998418] sysfs: cannot create duplicate filename '/class/my_module'
[43638.998419] Modules linked in: my_module(OE+) lirc_dev rc_core jfs gpio_ich snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel coretemp kvm_intel snd_hda_codec snd_hda_core snd_hwdep kvm snd_pcm snd_seq_midi snd_seq_midi_event irqbypass snd_rawmidi snd_seq input_leds snd_seq_device snd_timer lpc_ich serio_raw snd soundcore shpchp 8250_fintek mac_hid hwmon_vid sunrpc eeprom parport_pc ppdev lp parport autofs4 uvesafb uas usb_storage psmouse ahci firewire_ohci i915 libahci firewire_core crc_itu_t pata_acpi video i2c_algo_bit r8169 drm_kms_helper fjes syscopyarea sysfillrect sysimgblt mii fb_sys_fops drm
[43638.998471] CPU: 0 PID: 3862 Comm: modprobe Tainted: G OE 4.4.0-59-generic #80-Ubuntu
[43638.998473] Hardware name: Kontron Technology 986LCD-M/mITX/986LCD-M/mITX, BIOS 080013 03/04/2011
[43638.998476] c1ad7967 1c7090b8 00000286 f17b7c64 c13ab85f f17b7ca4 c19f07a8 f17b7c94
[43638.998481] c1070427 c19f0774 f17b7cc4 00000f16 c19f07a8 0000001f c1250120 c1250120
[43638.998487] f1112000 f20e1400 f63ac1b0 f17b7cb0 c107049e 00000009 f17b7ca4 c19f0774
[43638.998492] Call Trace:
[43638.998500] [<c13ab85f>] dump_stack+0x58/0x79
[43638.998505] [<c1070427>] warn_slowpath_common+0x87/0xc0
[43638.998508] [<c1250120>] ? sysfs_warn_dup+0x60/0x70
[43638.998511] [<c1250120>] ? sysfs_warn_dup+0x60/0x70
[43638.998514] [<c107049e>] warn_slowpath_fmt+0x3e/0x60
[43638.998517] [<c1250120>] sysfs_warn_dup+0x60/0x70
[43638.998520] [<c12501f8>] sysfs_create_dir_ns+0x78/0x90
[43638.998524] [<c13ae531>] kobject_add_internal+0xa1/0x360
[43638.998528] [<c118d635>] ? kfree_const+0x25/0x30
[43638.998531] [<c13ae91c>] kset_register+0x3c/0x60
[43638.998535] [<c14fef22>] __class_register+0xc2/0x1e0
[43638.998538] [<c14ff068>] ? __class_create+0x28/0x70
[43638.998541] [<c14ff084>] __class_create+0x44/0x70
[43638.998544] [<f8e21000>] ? 0xf8e21000
[43638.998549] [<f8e21040>] my_module_init+0x40/0x1000 [my_module]
[43638.998553] [<c100211a>] do_one_initcall+0xaa/0x200
[43638.998555] [<f8e21000>] ? 0xf8e21000
[43638.998560] [<c11ac3c5>] ? free_vmap_area_noflush+0x45/0xa0
[43638.998564] [<c11c3565>] ? kmem_cache_alloc_trace+0x185/0x1e0
[43638.998568] [<c11704fa>] ? do_init_module+0x21/0x1a6
[43638.998571] [<c11704fa>] ? do_init_module+0x21/0x1a6
[43638.998574] [<c1170529>] do_init_module+0x50/0x1a6
[43638.998579] [<c10f8953>] load_module+0x1533/0x1a40
[43638.998583] [<c10f5519>] ? copy_module_from_fd.isra.53+0xf9/0x190
[43638.998586] [<c10f9095>] SyS_finit_module+0xa5/0xf0
[43638.998589] [<c118d9d3>] ? vm_mmap_pgoff+0xa3/0xc0
[43638.998593] [<c100393d>] do_fast_syscall_32+0x8d/0x150
[43638.998598] [<c17b8b1c>] sysenter_past_esp+0x3d/0x61
[43638.998600] ---[ end trace 1e884c0f3bc9cdbd ]---
[43638.998602] ------------[ cut here ]------------
[43638.998606] WARNING: CPU: 0 PID: 3862 at /build/linux-5Vy7q8/linux-4.4.0/lib/kobject.c:240 kobject_add_internal+0x2e2/0x360()
[43638.998609] kobject_add_internal failed for my_module with -EEXIST, don't try to register things with the same name in the same directory.
[43638.998610] Modules linked in: my_module(OE+) lirc_dev rc_core jfs gpio_ich snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel coretemp kvm_intel snd_hda_codec snd_hda_core snd_hwdep kvm snd_pcm snd_seq_midi snd_seq_midi_event irqbypass snd_rawmidi snd_seq input_leds snd_seq_device snd_timer lpc_ich serio_raw snd soundcore shpchp 8250_fintek mac_hid hwmon_vid sunrpc eeprom parport_pc ppdev lp parport autofs4 uvesafb uas usb_storage psmouse ahci firewire_ohci i915 libahci firewire_core crc_itu_t pata_acpi video i2c_algo_bit r8169 drm_kms_helper fjes syscopyarea sysfillrect sysimgblt mii fb_sys_fops drm
[43638.998646] CPU: 0 PID: 3862 Comm: modprobe Tainted: G W OE 4.4.0-59-generic #80-Ubuntu
[43638.998648] Hardware name: Kontron Technology 986LCD-M/mITX/986LCD-M/mITX, BIOS 080013 03/04/2011
[43638.998650] c1ad7967 1c7090b8 00000286 f17b7ca8 c13ab85f f17b7ce8 c1a0bfe0 f17b7cd8
[43638.998655] c1070427 c1a0c218 f17b7d08 00000f16 c1a0bfe0 000000f0 c13ae772 c13ae772
[43638.998660] f2444d0c ffffffef 00000000 f17b7cf4 c107049e 00000009 f17b7ce8 c1a0c218
[43638.998665] Call Trace:
[43638.998668] [<c13ab85f>] dump_stack+0x58/0x79
[43638.998672] [<c1070427>] warn_slowpath_common+0x87/0xc0
[43638.998675] [<c13ae772>] ? kobject_add_internal+0x2e2/0x360
[43638.998677] [<c13ae772>] ? kobject_add_internal+0x2e2/0x360
[43638.998680] [<c107049e>] warn_slowpath_fmt+0x3e/0x60
[43638.998683] [<c13ae772>] kobject_add_internal+0x2e2/0x360
[43638.998686] [<c13ae91c>] kset_register+0x3c/0x60
[43638.998689] [<c14fef22>] __class_register+0xc2/0x1e0
[43638.998692] [<c14ff068>] ? __class_create+0x28/0x70
[43638.998694] [<c14ff084>] __class_create+0x44/0x70
[43638.998696] [<f8e21000>] ? 0xf8e21000
[43638.998700] [<f8e21040>] my_module_init+0x40/0x1000 [my_module]
[43638.998703] [<c100211a>] do_one_initcall+0xaa/0x200
[43638.998705] [<f8e21000>] ? 0xf8e21000
[43638.998708] [<c11ac3c5>] ? free_vmap_area_noflush+0x45/0xa0
[43638.998711] [<c11c3565>] ? kmem_cache_alloc_trace+0x185/0x1e0
[43638.998714] [<c11704fa>] ? do_init_module+0x21/0x1a6
[43638.998717] [<c11704fa>] ? do_init_module+0x21/0x1a6
[43638.998720] [<c1170529>] do_init_module+0x50/0x1a6
[43638.998723] [<c10f8953>] load_module+0x1533/0x1a40
[43638.998727] [<c10f5519>] ? copy_module_from_fd.isra.53+0xf9/0x190
[43638.998730] [<c10f9095>] SyS_finit_module+0xa5/0xf0
[43638.998733] [<c118d9d3>] ? vm_mmap_pgoff+0xa3/0xc0
[43638.998736] [<c100393d>] do_fast_syscall_32+0x8d/0x150
[43638.998739] [<c17b8b1c>] sysenter_past_esp+0x3d/0x61
[43638.998742] ---[ end trace 1e884c0f3bc9cdbe ]---

Revision history for this message
Jeremy (wa113y3s) said :
#9

It is your module that is crashing as it does try to load. This has nothing to do with secure boot or signed modules

Revision history for this message
Musbach (frank-musbach) said :
#10

It is always my_module :)

The kernel refuses my_module the first time. My_module is not shown in lsmod! However the kernel seems to create '/class/my_module' which cause the crash when I retry.

When I retry the kernel complains about '/class/my_module' which alreadyy exsts: "[43638.998418] sysfs: cannot create duplicate filename '/class/my_module'". The first time the kernel didn’t complain and didn’t crash.

Can you help with this problem?

Provide an answer of your own, or ask Musbach for more information if necessary.

To post a message you must log in.