Hi,
I've setup my new laptop with secureboot, and now, I can't use the DKMS
modules from Virtualbox, as they aren't signed. I've been told by Sledge
that I should use MOK to do that, and that DKMS packages are supposed to
have all in them to support MOK.
So my question is:
- where may I find a do
On 10/25/19 4:52 PM, Thomas Goirand wrote:
> Hi,
>
> I've setup my new laptop with secureboot, and now, I can't use the DKMS
> modules from Virtualbox, as they aren't signed. I've been told by Sledge
> that I should use MOK to do that, and that DKMS packages are supposed to
> have all in them to s
* Thomas Goirand:
> I've setup my new laptop with secureboot, and now, I can't use the DKMS
> modules from Virtualbox, as they aren't signed. I've been told by Sledge
> that I should use MOK to do that, and that DKMS packages are supposed to
> have all in them to support MOK.
I don't think secure
On 10/27/19 10:45 AM, Florian Weimer wrote:
> * Thomas Goirand:
>
>> I've setup my new laptop with secureboot, and now, I can't use the DKMS
>> modules from Virtualbox, as they aren't signed. I've been told by Sledge
>> that I should use MOK to do that, and that DKMS packages are supposed to
>> ha
On Sun, Oct 27, 2019 at 10:45:49AM +0100, Florian Weimer wrote:
> * Thomas Goirand:
> > I've setup my new laptop with secureboot, and now, I can't use the DKMS
> > modules from Virtualbox, as they aren't signed. I've been told by Sledge
> > that I should use MOK to do that, and that DKMS packages
Steve Langasek writes:
> On Sun, Oct 27, 2019 at 10:45:49AM +0100, Florian Weimer wrote:
>> * Thomas Goirand:
>> I don't think secure boot provides any benefit at all if you store the
>> kernel module signing key on the same machine.
>
> Generate the MOK certificate with EKU 1.3.6.1.4.1.2312.16.1.2
On Thu, Nov 07, 2019 at 03:04:16AM +0100, Ansgar wrote:
> Steve Langasek writes:
> > On Sun, Oct 27, 2019 at 10:45:49AM +0100, Florian Weimer wrote:
> >> * Thomas Goirand:
> >> I don't think secure boot provides any benefit at all if you store the
> >> kernel module signing key on the same machine.
* Steve Langasek:
>> and this is the reason we have to require all modules to be signed by
>> default.
>
> Enforcement of kernel module signatures is part of what's called the
> "lockdown" featureset. It is optional, and not a requirement from
> the UEFI spec,
The requirement is in the Microsoft
8 matches
Mail list logo