http://bugzilla.suse.com/show_bug.cgi?id=925479 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mmarek@suse.com -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=925479 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|kernel-maintainers@forge.pr |mmarek@suse.com |ovo.novell.com | --- Comment #2 from Marcus Meissner --- there are some candidates: commit b0191b238e32268bb3b48b43928c8af3cf509eea Author: Lee, Chun-Yi Date: Sat Jan 31 00:09:27 2015 +0800 KEYS: close race between key lookup and freeing (bnc#912202). commit 8a264a3b8772215f544b1d362967927515249279 Author: Michal Marek Date: Tue Dec 17 21:14:03 2013 +0100 Port module signing changes from SLE11-SP3 (fate#314508) -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=925479 Takashi Iwai changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tiwai@suse.com --- Comment #5 from Takashi Iwai --- The recent commit taken from SLE11-SP3 tries to convert *.crt files to *.x509, and avoid auto-generating the key. But openSUSE has no keys set up: [ 393s] + for f in '/home/abuild/rpmbuild/SOURCES/*.crt' [ 393s] + test -e /home/abuild/rpmbuild/SOURCES/_projectcert.crt [ 393s] + out=_projectcert.crt [ 393s] + out=_projectcert.x509 [ 393s] + openssl x509 -inform PEM -in /home/abuild/rpmbuild/SOURCES/_projectcert.crt -outform DER -out _projectcert.x509 [ 394s] + touch x509.genkey .... So it takes only the project default *.crt, no UEFI certificate. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=925479 --- Comment #7 from Takashi Iwai --- (In reply to Heiko Rommel from comment #6)

(In reply to Takashi Iwai from comment #5)

...

So it takes only the project default *.crt, no UEFI certificate.

What is the expected run-time effect of that ?

I am asking since - according to our test procedure for secure booting - secure-boot was reported as still working.

My wild guess is that it's just because you imported the same signature at the very first installation. Or I might miss something obvious... -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=925479 --- Comment #9 from Joey Lee --- The error -19 is ENODEV. It caused by asymmetric key type didn't build in to openSUSE kernel, but system keyring codes in kernel found a embedded key and try to using asymmetric key type to parse it, so no key type fail! This issue exposed a couple of things need to think: - First: Looks SYSTEM_TRUSTED_KEYRING kernel config should select ASYMMETRIC_KEY_TYPE. I will send patch to upstream to add the changes in init/Kconfig - Second: the SYSTEM_TRUSTED_KEYRING a.k.a. system kerying is used by: MODULE_SIG, IMA, PKCS7(new), KEXEC_BZIMAGE_VERIFY_SIG(new), none of above functions enabled on openSUSE 13.2. So, we should think may disable SYSTEM_TRUSTED_KEYRING from openSUSE kernel. - Third: Per dmesg, looks load_system_certificate_list() codes found a embedded key in kernel binary then tried to parser it. If we don't need kernel module sign or IMA. Maybe we can remove the embedded key in kernel. I will disable SYSTEM_TRUSTED_KEYRING in openSUSE 13.2 and openSUSE Factory until we enable IMA or kexec binary verification in future openSUSE version. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=925479 e p changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bertyfogs@gmail.com --- Comment #10 from e p --- Experiencing the same bug with the recent kernel-desktop-3.16.7-13.2 update. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=925479 --- Comment #11 from Philipp - --- (In reply to e p from comment #10)

Experiencing the same bug with the recent kernel-desktop-3.16.7-13.2 update.

Me too. (Mainboard ASRock 960GM/U3S3 FX) -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=925479 Andrei Borzenkov changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |arvidjaar@gmail.com --- Comment #20 from Andrei Borzenkov --- (In reply to Andrey Polunkin from comment #16)

The same with nvidia - X fails to start.

https://bugzilla.opensuse.org/show_bug.cgi?id=927018

Any workaround?

Rebuild driver for new kernel or boot previous version. If you do not know how to rebuild - remove RPM and reinstall. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=925479 Alexander König changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |alexander.koenig@koenig-a.d | |e --- Comment #24 from Alexander König --- I got the same message after ugrading to the new kernel version yesterday (13th April) - 3.16.7-17-desktop Problem loading in-kernel X.509 certificate (-19) Furthermore I got a x windows problem after the kernel upgrade - NVIDIA graphic drivers not starting properly (this never happened before after kernel upgrades) This problem could be solved by refreshing the NVIDIA driver installation via YaST. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=925479 --- Comment #26 from Alexander König --- (In reply to Andrea Celli from comment #25)

Thanks Alexander, but i'm not a smart user :-( How can i "Refresh the NVIDIA driver installation via YaST"?

I started Yast -> Software management -> Search Nvidia and i found i X11-videonvidia-G02 i xf86-video-nouveau i xf86-video-nv

Actually i was using the first one.

As possible actions i find: toggle Install delete update Taboo lock

Do i have to delete driver and install it again?

By the way, can i remove NV and Nouveau drivers?

bye, andrea

Hi Andrea, first of all I was lucky that some low resolution X windows system popped up instead of NVIDIA. Therefore I was still able to use the graphical YaST UI. Furthermore you seem to have an older NVIDIA version than I have. I selected in YaST to display the software source NVIDIA and then selected "update" for all as installed listed rpms. This should also be possible with the text version of YaST. If this doesn't work, delete the NVIDIA and check whether it then starts with NV or Noveau. Best regards, Alexander -- You are receiving this mail because: You are on the CC list for the bug.