Two weeks ago I have upgraded my machine to Fedora 23. I fought a bit with the installation of Nvidia proprietary driver. The main reason was that new kernel modules to load need to be signed with a key accepted by Secure Boot. Below are steps I have followed to achieve this configuration.
Creating New X.509 Key Pair
The openssl tool can be used to generate a public and private X.509 key pair that will be used to sign a kernel module after it has been built.
First, it is recommended to create a configuration file to pass parameters.
Hereafter is an example named x509-configuration.ini. Values starting by
YOUR_ need to be replaced by your own data:
[ req ] default_bits = 4096 distinguished_name = req_distinguished_name prompt = no string_mask = utf8only x509_extensions = myexts [ req_distinguished_name ] O = YOUR_USERNAME CN = YOUR_USERNAME emailAddress = YOUR_EMAIL_ADDRESS [ myexts ] basicConstraints=critical,CA:FALSE keyUsage=digitalSignature subjectKeyIdentifier=hash authorityKeyIdentifier=keyid
Then, key pair can be generated as follows:
openssl req -x509 -new -nodes -utf8 -sha256 -days 36500 -batch -config x509-configuration.ini -outform DER -out public_key.der -keyout private_key.priv
Output are two files:
Enrolling Public Key
At boot, the kernel loads Secure Boot db key database into system keyring. Since
this last is used to check which kernel modules can be loaded, the public key
public_key.der needs to be enrolled in this database in order to accept new
modules signed with our private key
Usually, this operation can be achieved with mokutil Fedora userspace utility:
mokutil --import mpublic_key.der
Unfortunately, this utility was not working for me. I was always getting Failed to enroll new keys. Hopefully, it is possible to enroll a new key from the UEFI interface, directly.
First, copy file
public_key.der on an USB key, then restart your machine and
press the appropriate key to access your UEFI interface.
In my case the right key is F2. Once pressed, the UEFI interface of my SABERTOOTH Z97 MARK 1 motherboard is displayed. To configure Secure Boot keys, I clicked on Advanced Mode, Boot, Secure Boot and Key Management. From the panel I selected Append default DB keys, answered No to the question that asked if I wanted to append default DB keys. This way it asked me from where I wanted to load keys. It allowed me to select my public key from USB key.
Once loaded, you can restart your machine. All new kernel modules signed with the private key generated previously should be loaded with success by the kernel.
Signing kernel module
Move to the folder that contains the nvidia kernel module compiled. If
proprietary driver was installed by
dnf the location should be
At this location, two files should be available:
Signing both modules is as simple as follows (assuming package
perl /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 ~/private_key.priv ~/public_key.der nvidia.ko perl /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 ~/private_key.priv ~/public_key.der nvidia-uvm.ko
Then, module can be loaded with
insmod and loaded modules listed with