July 2020 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1173682] Proprietary NVIDIA drivers won't work with UEFI Secure Boot
by bugzilla_noreply＠suse.com 08 Jul '20

08 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173682 https://bugzilla.suse.com/show_bug.cgi?id=1173682#c25 --- Comment #25 from Wolfgang Bauer <wbauer(a)tmo.at> --- (In reply to Martin Wilck from comment #19) > Let's get this straight: > > - After years of fighting and hassle, NVidia still ships the proprieary > driver and AFAIK has no intention to cease doing that. > - SB is becoming more and more ubiquitous, and SB + unsigned modules is a > general problem, not only on openSUSE but on every Linux distro. > - SUSE and the openSUSE community have done a great deal of work to make > packaging and installing the drivers hassle-free for users. That's work that > NVidia should have done but chose rather not to. > - Now with secure boot and CONFIG_MODULE_SIG=y, the problem gets a new > dimension that the community can't easily solve. It's a catch-22. > - Eventually it's NVidia's problem and only NVidia can solve it "for good", > either by open-sourcing the driver or by packaging and shipping properly > signed driver modules. Yes. And while I do fully agree with this, there's still the problem that some openSUSE Leap 15 users (that upgrade from 15.1 to 15.2) are suddenly left with an unbootable system. I would think that this should be worth a reconsideration. Anyway, as I wrote, it's not *my* problem. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173682] Proprietary NVIDIA drivers won't work with UEFI Secure Boot
by bugzilla_noreply＠suse.com 08 Jul '20

08 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173682 https://bugzilla.suse.com/show_bug.cgi?id=1173682#c24 --- Comment #24 from Martin Wilck <martin.wilck(a)suse.com> --- (In reply to Ricardo Minnaard from comment #18) > How do the AMD drives solve this? Or do they have the same issue? Every proprietary driver has the issue. It can be solved, but the solutions differ between distros. Shipping binary drivers for all Linux distros is a huge task, even for a big company (at my former employer we shipped only drivers for SLE and RHEL, and that was already a lot of work). > Not being able to run these drives is a disaster IMO. It sets Linux back > several years. Yet I do understand the security trait off. I’m no developer, > so I’m not going to lay down some hard critics. I totally agree. The workaround is "disable secure boot". IIUC comment 17, the other issue you had should be fixed soon, too. > If it was up to me, I’d show a pop-up window or a big splash > screen in the GUI informing a user the steps to take to get around this. A > text somewhere in some release notes isn’t enough. I agree. What we could have done out-of-the-box would be to display an "EULA" at package installation time. ("EULA"s are not only for legal issues, they've been used for technical warnings quite a few times). Unfortunately nobody thought about that, and when we did it was too late. Apparently Nvidia+SB users didn't take part in the beta testing. The only thing we could have done at the time the issue came up was revert the change. AFAIK Ubuntu "solves" this problem by not enabling module signing. It's a trade-off between security and convenience, and SUSE and Ubuntu have different positions in that area. I believe we should take a look at NVidia drivers for Fedora. Fedora has enabled module signing long ago. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173682] Proprietary NVIDIA drivers won't work with UEFI Secure Boot
by bugzilla_noreply＠suse.com 08 Jul '20

08 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173682 https://bugzilla.suse.com/show_bug.cgi?id=1173682#c23 --- Comment #23 from Wolfgang Bauer <wbauer(a)tmo.at> --- (In reply to Martin Wilck from comment #19) > (In reply to Wolfgang Bauer from comment #14) > > Sorry to step in again, but if it would be possible in Packman e.g., why > > shouldn't that be possible in the existing NVidia repo too? > > I can't answer that, because I have zero knowledge about how that repo is > maintained. Why do you even ask? It's maintained by Stefan Dirsch AFAIK. In OBS: https://build.opensuse.org/project/show/X11:Drivers:Video You should know that, no? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173754] NVIDIA repository (and others like Packman, Libdvdcss2) missing in Community Repos
by bugzilla_noreply＠suse.com 08 Jul '20

08 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173754 Frank Krüger <fkrueger(a)mailbox.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fkrueger(a)mailbox.org -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173682] Proprietary NVIDIA drivers won't work with UEFI Secure Boot
by bugzilla_noreply＠suse.com 08 Jul '20

08 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173682 https://bugzilla.suse.com/show_bug.cgi?id=1173682#c22 --- Comment #22 from Ricardo Minnaard <opensuse(a)x-labs.nl> --- Ok in the end NVidia needs to solve this. And since all distros will eventually have this issue they need to make a choice. Drop Linux support or make a change? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173682] Proprietary NVIDIA drivers won't work with UEFI Secure Boot
by bugzilla_noreply＠suse.com 08 Jul '20

08 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173682 https://bugzilla.suse.com/show_bug.cgi?id=1173682#c21 --- Comment #21 from Wolfgang Bauer <wbauer(a)tmo.at> --- (In reply to Wolfgang Bauer from comment #11) > (In reply to Martin Wilck from comment #9) > > Right. Perhaps we should warn users more prominently about this issue. But I > > don't think this should be a reason for Leap to stick with the the unsafe > > setup, which IIRC was rather an oversight in previous Leap versions. > > Breaking existing user's setups on Leap 15 is not nice either though. > Your decision, I suppose. And maybe I should clarify it a bit: I wanted to say it's your decision what to do about it, or whether it's worth to change it. And with "you/your", I do mean SUSE, whoever is responsible for this. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173682] Proprietary NVIDIA drivers won't work with UEFI Secure Boot
by bugzilla_noreply＠suse.com 08 Jul '20

08 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173682 https://bugzilla.suse.com/show_bug.cgi?id=1173682#c20 --- Comment #20 from Ricardo Minnaard <opensuse(a)x-labs.nl> --- (In reply to Martin Wilck from comment #12) > (In reply to Ricardo Minnaard from comment #10) > > > https://pastebin.com/9RnWMc39 > > From the log, I'd hypothesize that the screen goes black *because the nvidia > driver was loaded successfully* and started doing weird things with your > graphics hardware. But I'm not a video driver expert. > > Booting fails because the job for the crypt device times out, probably > because you never had the chance to enter the pass phrase. > > Have you tried typing in the pass phrase blindly? Have you tried > "plymouth.enable=0?" > I will try this first thing tomorrow. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173682] Proprietary NVIDIA drivers won't work with UEFI Secure Boot
by bugzilla_noreply＠suse.com 08 Jul '20

08 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173682 https://bugzilla.suse.com/show_bug.cgi?id=1173682#c19 --- Comment #19 from Martin Wilck <martin.wilck(a)suse.com> --- (In reply to Wolfgang Bauer from comment #14) > Sorry to step in again, but if it would be possible in Packman e.g., why > shouldn't that be possible in the existing NVidia repo too? I can't answer that, because I have zero knowledge about how that repo is maintained. In the past I worked for a company that shipped (other) proprietary drivers in KMP format, properly signed with the company's own key. So I guess if NVidia was willing to do this and spend the necessary effort, they could. NVidia would be powerful enough to even push their key to the major vendors' BIOS. Let's get this straight: - After years of fighting and hassle, NVidia still ships the proprieary driver and AFAIK has no intention to cease doing that. - SB is becoming more and more ubiquitous, and SB + unsigned modules is a general problem, not only on openSUSE but on every Linux distro. - SUSE and the openSUSE community have done a great deal of work to make packaging and installing the drivers hassle-free for users. That's work that NVidia should have done but chose rather not to. - Now with secure boot and CONFIG_MODULE_SIG=y, the problem gets a new dimension that the community can't easily solve. It's a catch-22. - Eventually it's NVidia's problem and only NVidia can solve it "for good", either by open-sourcing the driver or by packaging and shipping properly signed driver modules. > Well, breaking user systems like this is not what I do understand about "closing the leap gap", sorry. Again, "breaking systems" is not the intention. The intention is to minimize differences, and that includes of course important basic kernel security settings like that. By doing this, we bring Leap to a similar security level as SLE. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173682] Proprietary NVIDIA drivers won't work with UEFI Secure Boot
by bugzilla_noreply＠suse.com 08 Jul '20

08 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173682 https://bugzilla.suse.com/show_bug.cgi?id=1173682#c18 --- Comment #18 from Ricardo Minnaard <opensuse(a)x-labs.nl> --- How do the AMD drives solve this? Or do they have the same issue? I’ve been in Suse since Novell bought it, so I’ll be fine. But I’m noticing a Linux growth around me. As me, more people are switching to Linux. People are playing A+ games now on Linux. See YouTube, it’s flooding with gaming on Linux vids. Not being able to run these drives is a disaster IMO. It sets Linux back several years. Yet I do understand the security trait off. I’m no developer, so I’m not going to lay down some hard critics. And if I was able to be part of the solution I’d try. My understanding is too little. If it was up to me, I’d show a pop-up window or a big splash screen in the GUI informing a user the steps to take to get around this. A text somewhere in some release notes isn’t enough. But that is my personal opinion. Ubuntu has or had this wizard for proprietary drivers. Something like that to explain a user why it doesn’t work with secure boot. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1173158] CONFIG_MODULE_SIG=y
by bugzilla_noreply＠suse.com 08 Jul '20

08 Jul '20

https://bugzilla.suse.com/show_bug.cgi?id=1173158 Matthias Bach <marix(a)marix.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |marix(a)marix.org -- You are receiving this mail because: You are on the CC list for the bug.

1 0