34

I'm using Ubuntu 14.04 LTS and kernel version 3.13.11.4.
I'm trying to load patched KVM modules kvm and kvm-intel and I'm getting the following errors

kvm: module verification failed: signature and/or required key missing - tainting kernel
and kvm: module has bad taint, not creating trace events.

The source used is the same source that created the image that I am currently running.
I've check the symbols and made sure to the error isn't cause by not including EXPORT_SYMBOL_GPL() in the patched files where I exported functions.

I've also seen some stuff about different kernel versions causing this error but I built the kernel that I'm booted in with the same source that I used to create the patched kvm modules.
Everything compile without an warning. Any help is appreciated!

0

4 Answers 4

32

Instead of re-configuring the kernel, this error (module verification failed) could be resolved by just adding one line CONFIG_MODULE_SIG=n to the top of the Makefile for the module itself:

CONFIG_MODULE_SIG=n

# If KERNELRELEASE is defined, we've been invoked from the
# kernel build system and can use its language.
ifneq ($(KERNELRELEASE),)
    obj-m := hello.o

# Otherwise we were called directly from the command
# line; invoke the kernel build system.
else
    KERNELDIR ?= /lib/modules/$(shell uname -r)/build
    PWD := $(shell pwd)

default:
    $(MAKE) -C $(KERNELDIR) M=$(PWD) modules
endif
10
  • 4
    Have you tried it? I find adding "CONFIG_MODULE_SIG=n" still print "module verification failed: signature and/or required key missing - tainting kernel" message.
    – Nan Xiao
    Nov 2, 2015 at 10:05
  • 2
    I use both Suse(3.12) and RHEL 7(3.10.0), and the results are same. I also discuss this issue on kernelnewbies.org, but seems no satisfied answer now. Could you help to check this mail thread? Thanks very much!
    – Nan Xiao
    Nov 2, 2015 at 10:17
  • 2
    This definitely worked for me for a different module: rtl8188 and Ubuntu 15.1
    – JohnAllen
    Apr 16, 2016 at 7:42
  • 5
    What a bad answer! Defining CONFIG_MODULE_SIG=n leads to incorrect module.h parsing while module is being compiled. You'll have divergence of kernel's and module's structure layout. Why so many upvotes here? Sep 15, 2016 at 23:20
  • 2
    @IlyaMatveychikov I remember trying to solve this issue when some sample module in Linux Device Driver failed to build on Ubuntu 14.04. I found it worked for me without making any changes to the Ubuntu default kernel. I guess you know a better way to do it - do you mind posting an answer to fix this issue? My guess is that other people is having this problem too (although it may not apply to newer kernel - not sure)
    – artm
    Nov 19, 2016 at 10:39
18

Go to the kernel source directory and do (for e.g):

./scripts/sign-file sha512 ./signing_key.priv ./signing_key.x509 /lib/modules/3.10.1/kernel/drivers/char/my_module.ko

for kernel 4.4.*, keys location should be as follows:

./scripts/sign-file sha512 ./certs/signing_key.pem ./certs/signing_key.x509 path/to/your/kernel/module.ko 

Check what is the digest algorithm your kernel is using by opening .config and reading it in CONFIG_MODULE_SIG config values.

CONFIG_MODULE_SIG=y CONFIG_MODULE_SIG_ALL=y CONFIG_MODULE_SIG_SHA512=y CONFIG_MODULE_SIG_HASH="sha512"
2
  • 2
    This should be the answer, it signed the custom build module. Mar 7, 2018 at 3:02
  • i install the centos9 freshly, and can't find certs/signing_key.pem and ./certs/signing_key.x509 in /usr/src/kernel Jan 25 at 12:45
16

It seems like the vendor of your system has enabled kernel module signature verification on your kernel which means it won't load any module that the vendor hasn't signed. In other words, your patched module isn't signed (properly) and the kernel will refuse to load it.

The point of this is supposed to prevent malware and rootkits from loading malicious kernel modules.

I suggest you contact your vendor. There may be an option somewhere on your platform to disable signature checking. Otherwise, your vendor may be able to sign the module for you. You might even have the key and the details of the signature verification algorithm and can sign it yourself.

Without knowing what platform you're running on, it's hard to give more specific suggestions.

1
13

In general, if you are building a custom kernel and using make oldconfig. This copies the exiting config-* file from /boot. Now a days most of the kernel modules required to be signed by the linux vendor. So edit the .config and disable CONFIG_MODULE_SIG_ALL and CONFIG_MODULE_SIG, before compiling the kernel.

CONFIG_MODULE_SIG=n
CONFIG_MODULE_SIG_ALL=n
# CONFIG_MODULE_SIG_FORCE is not set 
# CONFIG_MODULE_SIG_SHA1 is not set
# CONFIG_MODULE_SIG_SHA224 is not set
# CONFIG_MODULE_SIG_SHA256 is not set
# CONFIG_MODULE_SIG_SHA384 is not set
1
  • 2
    so kernel needs to be recompiled here? Sorry for lame question perhaps, but I am beginner in Linux and recompiling kernel turns red light for me. Just trying to get ethernet connections working. Looks like I would need extra packages which I dont have to do that (and I wont have since wifi is also not working)
    – rank1
    Oct 28, 2016 at 11:02

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.