Nvidia problem about sbctl HOT 6 CLOSED

As far as I understand sbctl does not support signing of kernel modules.
If you want to know more checkout #85

To disable signature check of kernel module you can set the following kernel cmdline:
module.sig_enforce=0
But Secureboot usually means that lockdown=confidentiality is on which in turn means module signature also.

Under archlinux I have not been able to run secureboot with an Nvidia card. Under Debian it works because only mok is used there and the kernel are official signed archlinux not.
The difference between mok and sbctl you can read in the above linked article. I did not understand it until today. But you can´t use both.

Perhaps someone can clarify this in a short sentence.

from sbctl.

As far as I know nvidia kernel module has been open sourced so if the kernel module could be embedded in kernel and then made unified kernel image and signed would it then work

from sbctl.

Under archlinux I have not been able to run secureboot with an Nvidia card. Under Debian it works because only mok is used there and the kernel are official signed archlinux not.

This is interesting, I had no such problem. I think the kernel is not built with lockdown enabled, so unless you specify lockdown=confidentiality and add lockdown to lsm=..., there is no reason why it should force itself. When I had an Nvidia card, I could do it easily.

lockdown forces module.sig_enforce=1 AFAIK.

The difference between mok and sbctl you can read in the above linked article. I did not understand it until today. But you can´t use both.

Why not? Sign the shim, boot the shim, which launches the MOK process of validating stuff.
This page explaining it simply.

from sbctl.

As far as I know nvidia kernel module has been open sourced so if the kernel module could be embedded in kernel and then made unified kernel image and signed would it then work

That is not really the case, again the question if it signed by the same key as the one used to sign the kernel. If you build your own kernel, sign the kernel module with that, it will not be rejected.

from sbctl.

@jyash8 Do you mind closing the issue, if my answers were sufficient?

from sbctl.

As far as I know nvidia kernel module has been open sourced so if the kernel module could be embedded in kernel and then made unified kernel image and signed would it then work

That is not really the case, again the question if it signed by the same key as the one used to sign the kernel. If you build your own kernel, sign the kernel module with that, it will not be rejected.

It looks like Nvidia will add upstream support for the official kernel modules, so in the future you will be able to use it without any hassle, if you have the right hardware.

from sbctl.