Re: [PATCH] doc/user_manual: mention EFI variable access and platform keyring for module signing

[Uladzimir Bely <ubely@ilbers.de>]

On Mon, 2025-01-20 at 18:27 +0000, 'Cetin, Gokhan' via isar-users
wrote:
> Enrolling MOK or importing platform keys is not possible without
> access to EFI variables.
> 
> Signed-off-by: Gokhan Cetin <gokhan.cetin@siemens.com>
> ---
>  doc/user_manual.md | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/doc/user_manual.md b/doc/user_manual.md
> index 62d16c8c..bb8eb21b 100644
> --- a/doc/user_manual.md
> +++ b/doc/user_manual.md
> @@ -1127,7 +1127,15 @@ modprobe example-module
>  mokutil --import /etc/sb-mok-keys/MOK/MOK.der
>  ```
>  
> -Use the previously definded password to enroll the key, then reboot.
> +Use the previously defined password to enroll the key, then reboot.
> +
> +If EFI variable access is disabled on kernel (due to high latencies
> under RT kernel),
> +enrolling will result in failure `EFI variables are not supported on
> this system`.
> +EFI variable access can be enabled by passing `efi=runtime` kernel
> parameter.
> +
> +Similarly, in cases where EFI variables are not supported, the
> system will not be able
> +to import the keys defined on the platform in the kernel platform
> keyring. This will also
> +result in kernel modules not being verified if they are signed with
> one of these platform keys.
>  
>  **Boot self-signed image**:
>  
> -- 
> 2.39.2
> 

Applied to next, thanks.

-- 
Best regards,
Uladzimir.



-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/bcfbe788091f0ab76b592f794fb4dbe4b6b8fca6.camel%40ilbers.de.