4 ms·
> DKMS allows for drivers to be installed without breaking the kernel signature. how is this possible?
by pantalaimon 6y ago
> DKMS allows for drivers to be installed without breaking the kernel signature.
how is this possible?
- reanimus 6y agoYou register an additional key, generated by you/the installer. Ubuntu automates it as part of setup, afaik Fedora doesn't but there are instructions for it. Ubuntu generates a key during installation, then requests UEFI register it as a secure boot signing key. You reboot, UEFI will verify in pre-boot that you asked for the key to be added (usually, some BIOSes let you disable this check). DKMS will use that key to sign the modules. Since the kernel gets the UEFI allowed keys from the firmware, it will see these signed modules as valid and load them.
- MertsA 6y agoIt's not, if a kernel was built and signed that allowed unsigned modules to be loaded that key should be revoked. The way kernel module loading works with secure boot is that modules are signed via kmodsign. https://ubuntu.com/blog/how-to-sign-things-for-secure-boot https://ubuntu.com/blog/how-to-sign-things-for-secure-boot