7

The latest kernel for Ubuntu 16.04 (4.4.0-21) doesn't load the nvidia (and vboxdrv) module anymore.

$ sudo modprobe -v nvidia
insmod /lib/modules/4.4.0-21-generic/updates/dkms/nvidia_361.ko 
modprobe: ERROR: could not insert 'nvidia_361': Required key not available

With 4.4.0-18 it still works. What has changed? How do I fix the problem?

  • 2
    4.4.0-21 has enabled CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE. I guess that is the problem. – user534566 Apr 24 '16 at 15:36
  • 4
    Amazing that this was changed mid-cycle in an LTS release. What the hell is the point of running a "stable" distribution if your drivers quit working during a routine update! – Aleksandr Dubinsky May 24 '16 at 14:01
4

There is a way to leave secure boot on and use proprietary kernel modules like NVidia or VirtualBox. First download xca app:

sudo apt install xca

Then create new database and generate new key. Next generate CA certificate from that private key. Export private key to PEM format and CA public cert to DER format. Import CA cert to MOK database:

sudo mokutil --import CAcert.cer

Program asks you for password for MOK database. After reboot MOKManager will be executed before GRUB. Select Enroll keys, select cert that you add before and enter password for confirmation. After that your CA cert is added to MOK database. Reboot.

Next find sign-file program in kernel headers scripts directory. For me it is in:

/usr/src/linux-headers-4.4.0-22-lowlatency/scripts/sign-file

Now sign all kernel modules in /lib/modules/4.4.0-22-lowlatency/updates/dkms/. For example:

/usr/src/linux-headers-4.4.0-22-lowlatency/scripts/sign-file sha256 CA.pem CAcert.cer /lib/modules/4.4.0-22-lowlatency/updates/dkms/nvidia_361.ko

After that you will be able to load module without Required key not available error.

After install new kernel or new version of module kernels from dkms directory you must repeat signing procedure.

Links to read to clarify:

https://wiki.ubuntu.com/SecurityTeam/SecureBoot

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/sect-signing-kernel-modules-for-secure-boot.html

0

Kernel bug #1571691 had the answer:

sudo apt-get install mokutil; sudo mokutil --disable-validation
  • 2
    Still not working – QkiZ May 7 '16 at 23:12
  • @QkiZ take a look at bugs.launchpad.net/ubuntu/+source/linux/+bug/1571691/comments/5 You're supposed to ignore the Failed to request new MokSB state error and reboot your machine. – Aleksandr Dubinsky May 24 '16 at 3:14
  • I can handle with this problem. See my answer. – QkiZ May 24 '16 at 7:15
  • @QkiZ Yes, but your answer outlines the long and complicated way that has to be repeated every time the kernel is updated. This answer is the much simpler shortcut. At the moment it doesn't work, but hopefully it will be fixed. – Aleksandr Dubinsky May 24 '16 at 13:46
  • Little more complicated but it preserve Secure Boot (more secure way than yours). It can be automated by script. Only signing part of my way is repeated after changing kernel or module version. So you choose: security or easy life. – QkiZ May 24 '16 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.