On Wed, Feb 26, 2020 at 5:03 PM Chris Murphy <lists(a)colorremedies.com>
wrote:
User reports a kernel taint message following updating to kernel
5.5.5. Has anything changed in kernel 5.5 that explains this?
This is the message they're seeing:
https://ask.fedoraproject.org/t/kernel-tainted-after-running-updates/5487...
No, nothing has changed here, loading a proprietary module has marked the
kernel as tainted for a very long time. If you went back to 2.6 kernels,
you would see a similar message about the kernel being tainted. The message
has expanded a bit over the years as we check for things like module
signatures, etc, but the end result is the same the taint flag is P for
proprietary module.
https://www.kernel.org/doc/html/latest/admin-guide/tainted-kernels.html
My understanding of these messages is:
1. the proprietary nvidia driver is being loaded and used
2. since the module is not signed, the kernel is tainted
Actually, the kernel would be tainted with the same flag whether the module
was signed or not.
But I'm not sure what else I can infer about kernel taint. Are all the
other lockdowns still in place? Ideally the user would register a key
using mokutil, and sign the module. But if they don't do that, they
are still better off than if they disable UEFI Secure Boot to avoid
getting the kernel taint message, correct?
Unless the user has gone to the trouble of self signing a proprietary
module, and
adding that key to the keyring, UEFI secure boot had to be
disabled to even load the module. Module signatures are used and checked
outside of secure boot as well. Still, even if they do sign the module and
add that key to enable the module to work with secure boot, the kernel will
be tainted P.
Justin