https://bugzilla.suse.com/show_bug.cgi?id=1173158https://bugzilla.suse.com/show_bug.cgi?id=1173158#c30
Jiri Slaby <jslaby(a)suse.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jslaby(a)suse.com
--- Comment #30 from Jiri Slaby <jslaby(a)suse.com> ---
(In reply to Martin Wilck from comment #26)
> sold. But that's just a single, once-in-a-system-lifetime MOK operation away.
The upstream kernel does not verify module signatures against MOK keys. You
need a non-upstream patch:
patches.suse/KEYS-Make-use-of-platform-keyring-for-module-signatu.patch
for that. Leap indeed inherits it from SLE, TW doesn't have it...
So TW should keep MODULE_SIG as I don't want to lose the ability to check if
modules are genuine. If you ask me, I would not set SIG_FORCE to allow loading
of other modules (like nvidia, but there are many others, like those built by
myself). Loading such a module properly taints the kernel which is good.
For Leap, I have no opinion.
--
You are receiving this mail because:
You are the assignee for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1173138https://bugzilla.suse.com/show_bug.cgi?id=1173138#c5
Takashi Iwai <tiwai(a)suse.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |huy.phung1292(a)gmail.com
Flags| |needinfo?(huy.phung1292@gma
| |il.com)
--- Comment #5 from Takashi Iwai <tiwai(a)suse.com> ---
Any chance to test 5.7.2 and later?
--
You are receiving this mail because:
You are the assignee for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1173158https://bugzilla.suse.com/show_bug.cgi?id=1173158#c23
--- Comment #23 from Ludwig Nussel <lnussel(a)suse.com> ---
(In reply to Martin Wilck from comment #17)
> It's indeed not easy. We could use a key stored in a standard location on
> the user's system. However, at the very least the build procedure should
> allow to enter the pass phrase for the key in a secure manner. Otherwise the
> secret key would need to be stored unencrypted on the target system, which
> would forfeit the use of secure boot, or a locked-down kernel, almost
> entirely.
Right now we are loading unsigned modules so there is not much of a difference
to that. In the worst case if storing the private key really is a concern, a
new one could be created for each rebuild of the ko and the private key deleted
afterwards. Sure, that means enrolling the key on reboot then. If one really
decides to play that secure boot game it's a matter of picking your poison
basically :-)
--
You are receiving this mail because:
You are the assignee for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1173158https://bugzilla.suse.com/show_bug.cgi?id=1173158#c20
--- Comment #20 from Michal Kubeček <mkubecek(a)suse.com> ---
(In reply to Martin Wilck from comment #19)
> I didn't make myself clear. That "real KMP" I talked about would not trigger
> the rebuild. It would rather rely on KABI, like real KMPs do. If the KABI
> changes, the "real KMP" would need to be rebuilt. I'd hope that wouldn't
> happen too often, at least not on Leap.
We do not check kABI in Leap kernel branches like we do in SLE but as
openSUSE-15.2 shares the codebase (same tarball and patches) with SLE15-SP2,
the risk of breaking kABI in a way that would cause trouble is relatively low.
It would have to be a kABI breakage that would only manifest in parts of the
code which are built in openSUSE-15.2 but not SLE15-SP2.
--
You are receiving this mail because:
You are the assignee for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1173248
Stefan Dirsch <sndirsch(a)suse.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Component|Kernel |X11 3rd Party Driver
Assignee|kernel-bugs(a)opensuse.org |gfx-bugs(a)suse.de
QA Contact|qa-bugs(a)suse.de |sndirsch(a)suse.com
--
You are receiving this mail because:
You are the assignee for the bug.
https://bugzilla.suse.com/show_bug.cgi?id=1173239https://bugzilla.suse.com/show_bug.cgi?id=1173239#c1
Takashi Iwai <tiwai(a)suse.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |tiwai(a)suse.com
Assignee|kernel-bugs(a)opensuse.org |daniel.wagner(a)suse.com
--- Comment #1 from Takashi Iwai <tiwai(a)suse.com> ---
It looks like the commit was blacklisted.
Daniel, could you check it again?
--
You are receiving this mail because:
You are the assignee for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1173115http://bugzilla.opensuse.org/show_bug.cgi?id=1173115#c11
Martin Wilck <martin.wilck(a)suse.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |martin.wilck(a)suse.com
--- Comment #11 from Martin Wilck <martin.wilck(a)suse.com> ---
(In reply to Ludwig Nussel from comment #10)
>
> So similar checks could be done in the kernel spec file and skip mokutil
> when built with the openSUSE keys.
Or mokutil itself should have a list of keys that don't need to be added to the
MoK db. We could have a list of fingerprints of built-in keys somewhere under
/etc/uefi, and could check the cert to be imported against this list before
importing.
And if we don't, we should at least improve the message of the mokutil screen
at boot, explaining why it's popping up.
--
You are receiving this mail because:
You are the assignee for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1173071
Bug ID: 1173071
Summary: Kernel 5.7.1 does not boot
Classification: openSUSE
Product: openSUSE Tumbleweed
Version: Current
Hardware: Other
OS: Other
Status: NEW
Severity: Normal
Priority: P5 - None
Component: Kernel
Assignee: kernel-bugs(a)opensuse.org
Reporter: bdonauba(a)gmail.com
QA Contact: qa-bugs(a)suse.de
Found By: ---
Blocker: ---
Created attachment 838888
--> http://bugzilla.opensuse.org/attachment.cgi?id=838888&action=edit
last words of Kernel 5.7.1
With the last tumbleweed update came Kernel 5.7.1. Unfortunately it does not
boot on my system. I attached a photo of the "last words" at boot because
journalctl --boot=-1 gives me the log of the last successful boot.
--
You are receiving this mail because:
You are the assignee for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1173085
Bug ID: 1173085
Summary: Realtek RTL8117 NIC not recognized by Leap 15.2 RC
Classification: openSUSE
Product: openSUSE Distribution
Version: Leap 15.2
Hardware: x86-64
OS: Other
Status: NEW
Severity: Normal
Priority: P5 - None
Component: Kernel
Assignee: kernel-bugs(a)opensuse.org
Reporter: seroton10(a)gmail.com
QA Contact: qa-bugs(a)suse.de
Found By: ---
Blocker: ---
Created attachment 838907
--> http://bugzilla.opensuse.org/attachment.cgi?id=838907&action=edit
Hardware info
On my motherboard (Asus Pro WS X570-ACE) there are two NICs present:
* Realtek RTL8117
* Intel I211-AT Gigabit LAN
Leap 15.1 recognizes both, but on a fresh install of Leap 15.2 RC only the
Intel NIC is recognized. That is, the command "ip a" lists only one Ethernet
adapter on 15.2 RC, whereas it lists two on 15.1.
In dmesg I find the following error which I think is relevant:
[ 6.650810] r8169 0000:06:00.1: unknown chip XID 54a
Please add support for the Realtek RTL8117 NIC in the 15.2 kernel.
--
You are receiving this mail because:
You are the assignee for the bug.