[Kernel 6.18][Secure Boot] CONFIG_INTEGRITY_MACHINE_KEYRING disabled causes enrolled MOK-signed NVIDIA DKMS modules to be rejected

[lixiangguo]

Environment

OS: deepin 25
Kernel: 6.18.48-amd64-desktop-rolling
NVIDIA GPU: GeForce RTX 3060 Laptop GPU
NVIDIA Driver: 580.119.02-0deepin2
Secure Boot: Enabled

A comparison kernel is also installed:

6.6.155-amd64-desktop-hwe

The NVIDIA driver works correctly with Secure Boot enabled under the 6.6 kernel.

Problem

After booting deepin with kernel:

6.18.48-amd64-desktop-rolling

the NVIDIA kernel driver cannot be loaded while Secure Boot is enabled.

nvidia-smi returns:

NVIDIA-SMI has failed because it couldn't communicate with the NVIDIA driver.

DKMS status

The NVIDIA DKMS module has been successfully built and installed for both kernels:

deepin-anything/0.0, 6.18.48-amd64-desktop-rolling, x86_64: installed
deepin-anything/0.0, 6.6.155-amd64-desktop-hwe, x86_64: installed

nvidia-current/580.119.02, 6.18.48-amd64-desktop-rolling, x86_64: installed
nvidia-current/580.119.02, 6.6.155-amd64-desktop-hwe, x86_64: installed

NVIDIA module

The module exists:

/lib/modules/6.18.48-amd64-desktop-rolling/updates/dkms/nvidia-current.ko.zst

modinfo reports:

version: 580.119.02
name: nvidia
signer: DKMS module signing key
sig_key: 22:F6:FF:0D:A4:ED:E8:5C:24:72:A1:BE:1D:79:FE:A8:BC:E2:C5:DF
sig_hashalgo: sha512

MOK

The corresponding DKMS signing certificate is already enrolled.

mokutil --sb-state:

SecureBoot enabled

The enrolled DKMS certificate fingerprint is:

22:f6:ff:0d:a4:ed:e8:5c:24:72:a1:be:1d:79:fe:a8:bc:e2:c5:df

Therefore the NVIDIA module signing key and the enrolled MOK match.

Failure

Attempting to load the driver:

sudo modprobe nvidia-current

returns:

modprobe: ERROR: could not insert 'nvidia_current': Operation not permitted

Kernel keyrings

With keyutils installed:

sudo keyctl list %:.platform

contains only Microsoft UEFI certificates.

sudo keyctl list %:.secondary_trusted_keys

contains only:

.builtin_trusted_keys

and:

sudo keyctl list %:.machine

returns:

Can't find 'keyring:.machine'

The enrolled DKMS MOK is therefore not present in the kernel trusted keyrings.

Kernel configuration

/proc/config.gz reports:

CONFIG_INTEGRITY=y
CONFIG_INTEGRITY_SIGNATURE=y
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
CONFIG_INTEGRITY_TRUSTED_KEYRING=y
CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_LOAD_UEFI_KEYS=y
CONFIG_SYSTEM_TRUSTED_KEYRING=y
CONFIG_SECONDARY_TRUSTED_KEYRING=y
CONFIG_SYSTEM_BLACKLIST_KEYRING=y

However:

CONFIG_INTEGRITY_MACHINE_KEYRING is not set

Kernel log

The kernel correctly detects Secure Boot:

Kernel is locked down from EFI Secure Boot
secureboot: Secure boot enabled

It subsequently prevents module loading under lockdown:

Lockdown: modprobe: unsigned module loading is restricted

Comparison

The same machine, NVIDIA 580.119.02 driver and enrolled MOK work correctly with:

6.6.155-amd64-desktop-hwe

with Secure Boot enabled.

The problem occurs with:

6.18.48-amd64-desktop-rolling

Suspected cause

The 6.18 desktop kernel is built without:

CONFIG_INTEGRITY_MACHINE_KEYRING

As a result, the .machine keyring is not created and the enrolled Machine Owner Key used to sign the NVIDIA DKMS module does not appear in the kernel trusted keyrings.

This prevents the correctly MOK-signed NVIDIA DKMS module from loading when Secure Boot / kernel lockdown is active.

Request

Please check the x86 desktop configuration for the deepin 6.18 rolling kernel and whether:

CONFIG_INTEGRITY_MACHINE_KEYRING=y

should be enabled to restore MOK-signed third-party/DKMS module support under Secure Boot.

The 6.6 HWE kernel can be used as a working reference.

Please also check whether this is a regression introduced by the 6.18 deepin x86 desktop kernel configuration.