Bug 861322 - MODSIGN: Problem loading in-kernel X.509 certificate (-127) Fedora 18
Summary: MODSIGN: Problem loading in-kernel X.509 certificate (-127) Fedora 18
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: 18
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Kernel Maintainer List
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-09-28 07:23 UTC by xset1980
Modified: 2013-05-02 14:02 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-11-12 21:09:39 UTC
Type: Bug


Attachments (Terms of Use)
MODSIGN error (7.75 KB, image/png)
2012-09-28 07:23 UTC, xset1980
no flags Details
DMESG FULL i686 (43.09 KB, text/plain)
2012-09-29 09:07 UTC, xset1980
no flags Details

Description xset1980 2012-09-28 07:23:22 UTC
Created attachment 618454 [details]
MODSIGN error

Description of problem:

After kernel update to 3.6 rc7 and systemd update, on boot show the message:

"MODSIGN: Problem loading in-kernel X.509 certificate (-127)"

Version-Release number of selected component (if applicable):

Fedora 18 Alpha KDE up to date at 28 sep 2012

How reproducible: Always


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Attach Screenshot

Comment 1 Josh Boyer 2012-09-28 12:43:04 UTC
Please attach the full dmesg from the boot of this machine.

-127 is "Key has expired", which seems fairly unlikely unless the time on your machine is rather incorrect or there is some other bug.

Comment 2 David Howells 2012-09-28 13:56:46 UTC
Do you see somethiung like:

Loading module verification certificates
X.509: Cert 7b70b69b28836d8c4f2fca541559375499b37037 has expired
MODSIGN: Problem loading in-kernel X.509 certificate (-127)

Comment 3 David Howells 2012-09-29 07:23:10 UTC
Is your machine 32-bit or 64-bit?

Comment 4 xset1980 2012-09-29 09:06:29 UTC
@Josh Boyer

Attach full dmesg after boot of the machine.
Is a virtualbox machine, the time is 3 hours more than the real time in my country (America/Argentina/Buenos_Aires, but if i want change it, KDE no allow using root password or user password and show an AVC alert:

El proceso fuente: kcmdatetimehelper
ha intentado este acceso: write
En esta directory: /.kde/share/config (bad traduction... no related with the bug)

And other more:

El proceso fuente: kcmdatetimehelper
ha intentado acceso: unlink
En esta lnk_file: /etc/localtime

After reconfigure the time using system-config-date (that yes work), the -127 is persistent, really, the message error is the same, identically of the screenshot attached.

Attach full dmesg called dmesg_MODSIGN_i686.txt

@David Howells

The installation is a Fedora 18 Alpha KDE spin, from LiveCD, on a virtualbox, using i686 (32 bit) ISO, and up to date.
At time of this feedback, up to date fully.

Comment 5 xset1980 2012-09-29 09:07:15 UTC
Created attachment 618955 [details]
DMESG FULL i686

Comment 6 nucleo 2012-10-02 10:31:56 UTC
The same problem with kernel 3.6.0 installed in 32-bit F18 system
https://koji.fedoraproject.org/koji/buildinfo?buildID=357607

Oct  2 13:14:29 localhost kernel: X.509: Cert cb67c46b01ee734ef6dd1831e6c8edf186eea1f9 has expired
Oct  2 13:14:29 localhost kernel: MODSIGN: Problem loading in-kernel X.509 certificate (-127)
Oct  2 13:14:29 localhost kernel: Request for unknown module key 'Fedora kernel signing key: cb67c46b01ee734ef6dd1831e6c8edf186eea1f9' err -11
Oct  2 13:14:29 localhost kernel: Request for unknown module key 'Fedora kernel signing key: cb67c46b01ee734ef6dd1831e6c8edf186eea1f9' err -11
Oct  2 13:14:29 localhost kernel: Request for unknown module key 'Fedora kernel signing key: cb67c46b01ee734ef6dd1831e6c8edf186eea1f9' err -11
Oct  2 13:14:29 localhost kernel: Request for unknown module key 'Fedora kernel signing key: cb67c46b01ee734ef6dd1831e6c8edf186eea1f9' err -11

Comment 7 Josh Boyer 2012-10-02 11:59:47 UTC
32-bit machines are likely getting an overflow condition due to the 100yr cert expiration time.  I'm testing a fix.

Comment 8 Josh Boyer 2012-10-02 14:00:53 UTC
I've added a patch from David to the F18 and rawhide Fedora git repo.  This should be fixed with the next build.

Comment 9 nucleo 2012-10-03 01:35:17 UTC
No problem with kernel-3.6.0-2.fc18.i686

Comment 10 Fedora Update System 2012-10-03 02:56:55 UTC
kernel-3.6.0-2.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/FEDORA-2012-15232/kernel-3.6.0-2.fc18

Comment 11 Fedora Update System 2012-10-03 17:03:46 UTC
Package kernel-3.6.0-2.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing kernel-3.6.0-2.fc18'
as soon as you are able to, then reboot.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-15232/kernel-3.6.0-2.fc18
then log in and leave karma (feedback).

Comment 12 John Florian 2012-10-11 19:31:54 UTC
I have kernel-3.6.1-1.fc18.i686 and am getting in the system log a bunch of:

kernel: Request for unknown module key 'Fedora kernel signing key: c6fb6e1f2b79b50ab078f4d6b9fc9b2204a692a7' err -11


Am I hitting the same bug from a different angle or do I have some completely different issue?

Comment 13 Josh Boyer 2012-11-12 21:09:39 UTC
This should have long been fixed.

Comment 14 Paul Wouters 2013-05-02 14:02:27 UTC
(In reply to comment #1)
> Please attach the full dmesg from the boot of this machine.
> 
> -127 is "Key has expired", which seems fairly unlikely unless the time on
> your machine is rather incorrect or there is some other bug.

Can I suggest displaying error strings over error codes? This is not the '70's anymore - we have space for a string.


Note You need to log in before you can comment on or make changes to this bug.