8

The latest kernel for Ubuntu 16.04 (4.4.0-21) doesn't load the nvidia (and vboxdrv) module anymore.

$ sudo modprobe -v nvidia
insmod /lib/modules/4.4.0-21-generic/updates/dkms/nvidia_361.ko 
modprobe: ERROR: could not insert 'nvidia_361': Required key not available

With 4.4.0-18 it still works. What has changed? How do I fix the problem?

Improve this question
2
  • 3
    4.4.0-21 has enabled CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE. I guess that is the problem.
    – user534566
    Apr 24, 2016 at 15:36
  • 4
    Amazing that this was changed mid-cycle in an LTS release. What the hell is the point of running a "stable" distribution if your drivers quit working during a routine update!
    – Aleksandr Dubinsky
    May 24, 2016 at 14:01

2 Answers 2

Reset to default
4

There is a way to leave secure boot on and use proprietary kernel modules like NVidia or VirtualBox. First download xca app:

sudo apt install xca

Then create new database and generate new key. Next generate CA certificate from that private key. Export private key to PEM format and CA public cert to DER format. Import CA cert to MOK database:

sudo mokutil --import CAcert.cer

Program asks you for password for MOK database. After reboot MOKManager will be executed before GRUB. Select Enroll keys, select cert that you add before and enter password for confirmation. After that your CA cert is added to MOK database. Reboot.

Next find sign-file program in kernel headers scripts directory. For me it is in:

/usr/src/linux-headers-4.4.0-22-lowlatency/scripts/sign-file

Now sign all kernel modules in /lib/modules/4.4.0-22-lowlatency/updates/dkms/. For example:

/usr/src/linux-headers-4.4.0-22-lowlatency/scripts/sign-file sha256 CA.pem CAcert.cer /lib/modules/4.4.0-22-lowlatency/updates/dkms/nvidia_361.ko

After that you will be able to load module without Required key not available error.

After install new kernel or new version of module kernels from dkms directory you must repeat signing procedure.

Links to read to clarify:

https://wiki.ubuntu.com/SecurityTeam/SecureBoot

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System_Administrators_Guide/sect-signing-kernel-modules-for-secure-boot.html

Improve this answer
0

Kernel bug #1571691 had the answer:

sudo apt-get install mokutil; sudo mokutil --disable-validation
Improve this answer
5
  • 2
    Still not working
    – QkiZ
    May 7, 2016 at 23:12
  • @QkiZ take a look at bugs.launchpad.net/ubuntu/+source/linux/+bug/1571691/comments/5 You're supposed to ignore the Failed to request new MokSB state error and reboot your machine.
    – Aleksandr Dubinsky
    May 24, 2016 at 3:14
  • I can handle with this problem. See my answer.
    – QkiZ
    May 24, 2016 at 7:15
  • @QkiZ Yes, but your answer outlines the long and complicated way that has to be repeated every time the kernel is updated. This answer is the much simpler shortcut. At the moment it doesn't work, but hopefully it will be fixed.
    – Aleksandr Dubinsky
    May 24, 2016 at 13:46
  • Little more complicated but it preserve Secure Boot (more secure way than yours). It can be automated by script. Only signing part of my way is repeated after changing kernel or module version. So you choose: security or easy life.
    – QkiZ
    May 24, 2016 at 15:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .