Signing and loading out-of-tree modules

With Secure Boot enabled and lockdown active, the kernel refuses to load a module it cannot verify. The usual response is to turn Secure Boot off. The better response is to enrol your own key, which takes about ten minutes and keeps the guarantee intact.

1. Generate a Machine Owner Key

openssl req -new -x509 -newkey rsa:2048 -nodes -days 3650 
  -subj "/CN=Local module signing/" 
  -keyout MOK.priv -outform DER -out MOK.der

sudo mokutil --import MOK.der

mokutil asks for a one-time password and the enrolment happens in the firmware on the next boot, in a blue screen that appears before the bootloader. That interactive step is deliberate: it is what stops a compromised userspace from enrolling a key by itself.

2. Sign the module

KDIR=/usr/lib/modules/$(uname -r)/build
sudo "$KDIR/scripts/sign-file" sha256 MOK.priv MOK.der ./mydriver.ko
modinfo ./mydriver.ko | grep -E 'signer|sig_key'

Verify before loading. modinfo printing a signer line is the difference between a module that will load and a support ticket.

3. Automate it or it will rot

Every kernel update rebuilds out-of-tree modules through DKMS, and an unsigned rebuild fails to load at the worst possible time. Point DKMS at the key once:

# /etc/dkms/framework.conf
mok_signing_key=/root/mok/MOK.priv
mok_certificate=/root/mok/MOK.der

Keep the private key readable only by root, and off any machine you do not control. A signing key that lives in a dotfiles repository is worse than no Secure Boot at all, because it looks like security.