Folks, I have installed vmware on Fedora 33. It does not start due to the following error:
modprobe vmmon
modprobe: ERROR: could not insert 'vmmon': Key was rejected by service
modprobe vmnet
modprobe: ERROR: could not insert 'vmnet': Key was rejected by service
dmesg shows
vmmon: Loading of unsigned module is rejected
The modules have been compiled from source. How do I get around this issue so I can run vmware?
Any help is appreciated.
Paolo
Jorge, thank you for the information, however, since there is a good reason to have secure boot enabled and since Fedora 33 boots with it enabled I would like to find a solution that does not require this. Additionally this system boots to Windows so I really don't want to mess around with issues booting Windows.
Paolo
On 2/3/21 10:36 AM, Jorge Fábregas wrote:
On 2/3/21 2:33 PM, Paolo Galtieri wrote:
vmmon: Loading of unsigned module is rejected
This looks like you're booting off UEFI in "secure mode" where kernel and its modules need to be signed. Try disabling "secure mode" in the machine's firmware setup.
HTH, Jorge _______________________________________________ users mailing list -- users@lists.fedoraproject.org To unsubscribe send an email to users-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org
On Wed, Feb 03, 2021 at 11:53:04AM -0800, Paolo Galtieri wrote:
Jorge, thank you for the information, however, since there is a good reason to have secure boot enabled and since Fedora 33 boots with it enabled I would like to find a solution that does not require this. Additionally this system boots to Windows so I really don't want to mess around with issues booting Windows.
The only alternative is to sign the kernel modules with your own certificate, and load that certificate into the firmware as a valid Secure Boot CA.
https://docs.fedoraproject.org/en-US/fedora/f33/system-administrators-guide/...
On Wed, 3 Feb 2021 14:59:16 -0500 Jonathan Billings billings@negate.org wrote:
The only alternative is to sign the kernel modules with your own certificate, and load that certificate into the firmware as a valid Secure Boot CA.
https://docs.fedoraproject.org/en-US/fedora/f33/system-administrators-guide/...
I see from that page a signing program called sign-file, but no mention of pesign. Is pesign deprecated, or is sign-file just an alternate way of signing?
On Wed, Feb 03, 2021 at 01:34:02PM -0700, stan via users wrote:
On Wed, 3 Feb 2021 14:59:16 -0500 Jonathan Billings billings@negate.org wrote:
The only alternative is to sign the kernel modules with your own certificate, and load that certificate into the firmware as a valid Secure Boot CA.
https://docs.fedoraproject.org/en-US/fedora/f33/system-administrators-guide/...
I see from that page a signing program called sign-file, but no mention of pesign. Is pesign deprecated, or is sign-file just an alternate way of signing?
Best I understand, pesign is for signing UEFI binaries. sign-file is for signing a kernel module.
On Wed, 3 Feb 2021 15:42:54 -0500 Jonathan Billings billings@negate.org wrote:
On Wed, Feb 03, 2021 at 01:34:02PM -0700, stan via users wrote:
On Wed, 3 Feb 2021 14:59:16 -0500 Jonathan Billings billings@negate.org wrote:
The only alternative is to sign the kernel modules with your own certificate, and load that certificate into the firmware as a valid Secure Boot CA.
https://docs.fedoraproject.org/en-US/fedora/f33/system-administrators-guide/...
I see from that page a signing program called sign-file, but no mention of pesign. Is pesign deprecated, or is sign-file just an alternate way of signing?
Best I understand, pesign is for signing UEFI binaries. sign-file is for signing a kernel module.
Thanks, that explains why the results of the commands on the page you gave told me my system wasn't secure booting, and didn't mention my private signing key for UEFI that I use to sign the kernel.
$ mokutil --sb-state This system does't support Secure Boot
# keyctl list %:.builtin_trusted_keys 1 key in keyring: 439922868: ---lswrv 0 0 asymmetric: Fedora kernel signing key: 8ba4f0101defedadc01c847442f27f5ca183572c
-
Jonathan Billings -
Jorge Fábregas -
Paolo Galtieri -
stan