@afader - sounds like maybe an issue with your dkms config. This is what my /etc/dkms
looks like:
-rw-r--r-- 1 root root 1.1K Dec 17 10:25 framework.conf
-rw-r--r-- 1 root root 209 May 4 17:37 kernel-sign.conf
-rwxr-xr-x 1 root root 425 May 4 17:37 kernel-sign.sh
lrwxrwxrwx 1 root root 26 May 4 20:55 lkrg.conf -> /etc/dkms/kernel-sign.conf
lrwxrwxrwx 1 root root 26 May 4 19:26 nvidia.conf -> /etc/dkms/kernel-sign.conf
lrwxrwxrwx 1 root root 26 May 4 19:26 zfs.conf -> /etc/dkms/kernel-sign.conf
I have noticed in the past dkms upgrades have left /var/lib/dkms
in need of tidying up. My /var/lib/dkms/*
looks like:
/var/lib/dkms/lkrg:
total 8.0K
drwxr-xr-x 1 root root 92 May 4 21:37 0.9.3
lrwxrwxrwx 1 root root 26 May 4 21:33 kernel-5.15.37-1-lts-x86_64 -> 0.9.3/5.15.37-1-lts/x86_64
lrwxrwxrwx 1 root root 40 May 4 21:37 kernel-5.17.5-hardened1-1-hardened-x86_64 -> 0.9.3/5.17.5-hardened1-1-hardened/x86_64
/var/lib/dkms/nvidia:
total 12K
drwxr-xr-x 1 root root 148 May 5 17:04 510.68.02
lrwxrwxrwx 1 root root 30 May 5 17:03 kernel-5.15.37-1-lts-x86_64 -> 510.68.02/5.15.37-1-lts/x86_64
lrwxrwxrwx 1 root root 44 May 5 17:03 kernel-5.17.5-hardened1-1-hardened-x86_64 -> 510.68.02/5.17.5-hardened1-1-hardened/x86_64
drwxr-xr-x 1 root root 56 May 5 17:04 original_module
/var/lib/dkms/zfs:
total 8.0K
drwxr-xr-x 1 root root 92 May 4 21:37 2.1.4
lrwxrwxrwx 1 root root 26 May 4 21:33 kernel-5.15.37-1-lts-x86_64 -> 2.1.4/5.15.37-1-lts/x86_64
lrwxrwxrwx 1 root root 40 May 4 21:37 kernel-5.17.5-hardened1-1-hardened-x86_64 -> 2.1.4/5.17.5-hardened1-1-hardened/x86_64
I've just rebuilt linux-hardened-5.17.5
with version 0.3.3
My modules live under /lib/modules/5.17.5-hardened1-1-hardened/updates/dkms
icp.ko.zst nvidia-modeset.ko.zst p_lkrg.ko.zst zcommon.ko.zst znvpair.ko.zst
nvidia-drm.ko.zst nvidia-peermem.ko.zst spl.ko.zst zfs.ko.zst zunicode.ko.zst
nvidia.ko.zst nvidia-uvm.ko.zst zavl.ko.zst zlua.ko.zst zzstd.ko.zst
& are all signed:
modinfo /lib/modules/5.17.5-hardened1-1-hardened/updates/dkms/* | grep Local
signer: Local Out of tree kernel module signing key
signer: Local Out of tree kernel module signing key
signer: Local Out of tree kernel module signing key
signer: Local Out of tree kernel module signing key
signer: Local Out of tree kernel module signing key
signer: Local Out of tree kernel module signing key
signer: Local Out of tree kernel module signing key
signer: Local Out of tree kernel module signing key
signer: Local Out of tree kernel module signing key
signer: Local Out of tree kernel module signing key
signer: Local Out of tree kernel module signing key
signer: Local Out of tree kernel module signing key
signer: Local Out of tree kernel module signing key
signer: Local Out of tree kernel module signing key
signer: Local Out of tree kernel module signing key
I did catch a bug or two with the latest updates - perhaps try the latest version ?
Pinned Comments
itoffshore commented on 2024-08-24 21:23 (UTC)
0.75-2
adds examples for kernel alerts from urlwatch in/usr/share/arch-sign-modules/urlwatch