13

I am having problems while loading/installing a kernel module. The kernel module builds successfully, but whenever I try to make module_install, the kernel seems to fail to load. It leaves the below error message :-

At main.c:158:
    - SSL error:02001002:system library:fopen:No such file or directory: bss_file.c:175
    - SSL error:2006D080:BIO routines:BIO_new_file:no such file: bss_file.c:178 sign-file: certs/signing_key.pem: No such file or directory
    DEPMOD 4.10.0-20-generic

I have read about this problem and realized that the kernel has now started loading only properly signed modules. I find that the kernel source directory /usr/src/<linux version>/certs in my system does not have the signing_key.pem private key file because of which I see this error.

What should I do ? Can I manually generate a signing_key.pem file and use it further ? What would be some good methods to do so ? Will generating a private key/certificate file using openssl.cnf help me in this regard ? Or should I avoid using signed modules at all and try loading the modules as it is without any verification ?

I am using Ubuntu 17.04 with kernel 4.10.0-20-generic.

1
  • I too am experiencing this. Even though I seem to compile everything fine, the kernel driver never gets loaded. Aug 13, 2017 at 21:14

3 Answers 3

11

In your linux kernel root folder that you're compiling go to the certs folder and run:

openssl req -new -nodes -utf8 -sha512 -days 36500 -batch -x509 -config x509.genkey -outform DER -out signing_key.x509 -keyout signing_key.pem

Where x509.genkey is a file with the contents:

[ req ]
default_bits = 4096
distinguished_name = req_distinguished_name
prompt = no
string_mask = utf8only
x509_extensions = myexts

[ req_distinguished_name ]
CN = Modules

[ myexts ]
basicConstraints=critical,CA:FALSE
keyUsage=digitalSignature
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid

Refer to: https://wiki.gentoo.org/wiki/Signed_kernel_module_support

Option 2, is disable automated signing of modules in the config make menuconfig or make xconfig

4

Based on cryptoboy's answer:

  1. Create x509.genkey file

    echo -e "[ req ] \n\
    default_bits = 4096 \n\
    distinguished_name = req_distinguished_name \n\
    prompt = no \n\
    x509_extensions = myexts \n\
    
    [ req_distinguished_name ] \n\
    CN = Modules \n\
    \n\
    [ myexts ] \n\
    basicConstraints=critical,CA:FALSE \n\
    keyUsage=digitalSignature \n\
    subjectKeyIdentifier=hash \n\
    authorityKeyIdentifier=keyid" > x509.genkey
    
  2. Run:

    openssl req -new -nodes -utf8 -sha512 -days 36500 -batch -x509 -config x509.genkey -outform DER -out signing_key.x509 -keyout signing_key.pem
    
  3. Move key files to desired folder, for example:

    mv signing_key.pem signing_key.x509 `find /usr/src/*-generic/certs`
    
0

this command works for me, on Manjaro Linux, 2023:

https://github.com/webcamoid/akvcam/issues/15#issuecomment-612657792

Some people reported that running sudo depmod -a may fix the problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .