ChristopherRabotin
commented
11 months ago I think I have a similar issue to #45 . It's a Dell/Alienware desktop from 2018 and had the nvidia drivers some time in the past.
From what I understand, the Secure Boot seems to be set correctly:
# hexdump -C /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c
00000000 06 00 00 00 01 |.....|
00000005
# hexdump -C /sys/firmware/efi/efivars/SetupMode-8be4df61-93ca-11d2-aa0d-00e098032b8c
00000000 06 00 00 00 00 |.....|
00000005
# mokutil --sb-state
SecureBoot enabledSome of the commands work:
# mokutil --list-enrolled
[key 1]
SHA1 Fingerprint: 46:59:83:8c:82:03:fe:15:52:ad:19:e1:86:09:db:21:7e:3a:d2:4f
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=openSUSE Secure Boot CA, C=DE, L=Nuremberg, O=openSUSE Project/emailAddress=build@opensuse.org
Validity
Not Before: Aug 26 16:12:07 2013 GMT
Not After : Jul 22 16:12:07 2035 GMT
Subject: CN=openSUSE Secure Boot CA, C=DE, L=Nuremberg, O=openSUSE Project/emailAddress=build@opensuse.org
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:de:df:61:92:7a:a4:fe:83:d1:7d:3b:68:0e:b1:
a7:f0:4e:92:93:fc:47:3e:70:2d:4e:88:dc:9a:9e:
fa:33:b4:a6:db:0e:23:c1:0d:a8:c1:d5:65:04:84:
04:ff:3a:48:18:4f:39:32:e4:ca:4e:f9:04:9e:9f:
0f:cd:20:5d:61:ab:a7:00:d8:a5:ff:2b:7f:be:e8:
47:c3:2f:5b:02:c8:bb:de:8e:1a:e9:46:d3:86:ef:
ff:88:99:90:eb:10:89:b8:8b:3f:3e:a8:07:c6:55:
7a:6e:d3:5f:fc:83:3c:3d:16:ed:26:c5:13:73:92:
b1:70:1e:22:95:c8:00:6c:25:76:46:f1:a2:d9:d0:
b0:98:68:0f:a7:2d:b1:0d:67:89:ca:94:4a:ea:12:
c5:91:55:76:7f:6c:7a:2e:f9:18:89:9f:f8:f4:24:
43:d5:35:6a:cb:00:0e:2e:ed:4b:e2:5d:09:d8:1b:
97:70:99:9e:5a:6f:a6:81:a8:9d:a9:58:76:7d:69:
71:82:d3:ba:3a:96:43:9b:f0:da:15:c6:4e:e9:c8:
15:b9:e9:cb:c7:e4:71:ce:ea:10:1b:6b:c4:2a:70:
01:a9:52:b4:17:de:00:52:cf:7d:e4:fd:0f:4d:03:
18:b2:90:28:d4:6f:c4:ae:56:bc:36:60:49:46:8b:
6b:0b
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Subject Key Identifier:
68:42:60:0D:E2:2C:4C:47:7E:95:BE:23:DF:EA:95:13:E5:97:17:62
X509v3 Authority Key Identifier:
keyid:68:42:60:0D:E2:2C:4C:47:7E:95:BE:23:DF:EA:95:13:E5:97:17:62
DirName:/CN=openSUSE Secure Boot CA/C=DE/L=Nuremberg/O=openSUSE Project/emailAddress=build@opensuse.org
serial:01
X509v3 Key Usage: critical
Digital Signature, Certificate Sign, CRL Sign
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
8a:a3:89:c2:8e:d9:f9:82:0b:f3:33:ce:e9:19:17:17:a3:65:
80:cd:33:ae:06:51:56:29:b6:38:87:7b:f4:9d:fc:28:8e:aa:
e0:53:12:0e:3a:60:c7:06:d8:3a:61:76:3b:77:08:f4:94:a4:
8c:7c:47:3a:99:d8:84:9b:17:cc:20:62:2e:e2:76:e4:c6:36:
0d:26:e9:2e:53:35:0a:fb:3a:35:93:45:c3:93:82:c1:0b:f3:
08:e9:57:1f:59:37:a9:d0:6c:69:fb:68:ea:7f:3b:af:d3:f7:
59:27:8e:d4:c7:96:73:f4:0c:0a:f7:3e:e4:af:6c:8c:c7:7a:
6f:09:79:f4:41:1f:e3:6f:11:fb:3e:6c:b1:a0:7b:e4:92:b7:
ca:f9:32:f5:de:c3:b0:73:7d:e3:b3:82:5d:cd:ec:61:dc:fe:
0c:3e:c6:b5:e7:6c:2d:5d:92:73:ff:ed:aa:6a:a9:9b:66:9e:
5e:3a:6d:70:b0:31:c0:ce:df:2f:21:10:68:0c:87:f3:77:a0:
33:31:0a:0f:15:f6:ee:32:88:c5:9a:53:71:cd:0d:1a:a1:28:
89:d0:bf:f6:56:ac:4b:3b:36:06:2b:01:c5:eb:e5:dc:72:83:
3d:94:ac:28:83:13:fb:c1:5d:27:9c:13:f6:32:5f:f6:1f:4a:
b7:3e:53:8aBut others won't do anything:
# mokutil --trust-mok
password length: 8~16
input password:
input password again:
Failed to request new MokListTrustedNew stateIs there a way to add and sign a dummy kernel module that emulates the nvidia driver signing?
lcp
Hi there,
I have an issue I have no idea where to start debugging, and I was hoping you had some hints.
When I try to install the G05 Nvidia drivers on OpenSuse Tumbleweed, trying to enroll the keys causes an error on boot and the computer restarts. The only way to "fix" this is by rolling back to a previously working snapshot. That isn't the point of my question:
If I try to enroll the keys as root, I get the following errors:
Searching for the "shim verbose" error led me to these specific lines: https://github.com/lcp/mokutil/blob/master/src/mokutil.c#L1699-L1701 .
What would be some typical reasons for setting the verbosity to fail ?
Thanks