33
# mokutil --
import
mlnx_signing_key_pub.der
To see what keys have been added to the system key ring on the current boot, install the
'keyutils' package and run: #keyctl list %:.system_keyring#
# rpm -qa | grep -E
"kernel-ib|mlnx-ofa_kernel|iser|srp|knem|mlnx-rds|mlnx-nfsrdma|mlnx-nvme|mlnx-rdma-rxe"
| xargs rpm -ql | grep
"\.ko$"
| xargs strip -g
"Request for unknown module key 'Mellanox Technologies signing key:
61feb074fc7292f958419386ffdd9d5ca999e403' err -11"
mkinitrd /boot/initramfs-$(uname -r).img $(uname -r) --force
2.
Add the public key to the MOK list using the mokutil utility.
3.
Reboot the system.
The pending MOK key enrollment request will be noticed by shim.efi and it will launch MokManager.efi
to allow you to complete the enrollment from the UEFI console. You will need to enter the password
you previously associated with this request and confirm the enrollment. Once done, the public key is
added to the MOK list, which is persistent. Once a key is in the MOK list, it will be automatically
propagated to the system key ring and subsequent will be booted when the UEFI Secure Boot is
enabled.
Removing Signature from kernel Modules
The signature can be removed from a signed kernel module using the 'strip' utility which is provided by
the 'binutils' package. The strip utility will change the given file without saving a backup. The operation
can be undo only by resigning the kernel module. Hence, we recommend backing up a copy prior to
removing the signature.
To remove the signature from the MLNX_OFED kernel modules:
1.
Remove the signature.
After the signature has been removed, a message as the below will no longer be presented upon
module loading:
However, please note that a similar message as the following will still be presented:
This message is only presented once, upon first module boot that either has no signature or
whose key is not in the kernel key ring. Therefore, this message may go unnoticed. Once the
system is rebooted after unloading and reloading a kernel module, the message will appear.
(Note that this message cannot be eliminated.)
2.
Update the initramfs on RHEL systems with the stripped modules.
Performance Tuning
Depending on the application of the user's system, it may be necessary to modify the default
configuration of network adapters based on the ConnectX® adapters. In case that tuning is required,
"my_module: module verification failed: signature and/or required key missing - tainting kernel"
