Key was rejected by service

[Paolo Galtieri]

Folks,
  I have installed vmware on Fedora 33.  It does not start due to the 
following error:

modprobe vmmon

modprobe: ERROR: could not insert 'vmmon': Key was rejected by service

modprobe vmnet

modprobe: ERROR: could not insert 'vmnet': Key was rejected by service

dmesg shows

vmmon: Loading of unsigned module is rejected

The modules have been compiled from source.  How do I get around this 
issue so I can run vmware?

Any help is appreciated.

Paolo

[Jorge Fábregas]

On 2/3/21 2:33 PM, Paolo Galtieri wrote:
> vmmon: Loading of unsigned module is rejected

This looks like you're booting off UEFI in "secure mode" where kernel
and its modules need to be signed.  Try disabling "secure mode" in the
machine's firmware setup.

HTH,
Jorge

[Paolo Galtieri]

Jorge,
   thank you for the information, however, since there is a good reason 
to have secure boot enabled and since Fedora 33 boots with it enabled I 
would like to find a solution that does not require this.  Additionally 
this system boots to Windows so I really don't want to mess around with 
issues booting Windows.

Paolo

On 2/3/21 10:36 AM, Jorge Fábregas wrote:
> On 2/3/21 2:33 PM, Paolo Galtieri wrote:
> > vmmon: Loading of unsigned module is rejected
>
> This looks like you're booting off UEFI in "secure mode" where kernel
> and its modules need to be signed.  Try disabling "secure mode" in the
> machine's firmware setup.
>
> HTH,
> Jorge
> _______________________________________________
> users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]

[Jonathan Billings]

On Wed, Feb 03, 2021 at 11:53:04AM -0800, Paolo Galtieri wrote:
> Jorge,
>   thank you for the information, however, since there is a good reason to
> have secure boot enabled and since Fedora 33 boots with it enabled I would
> like to find a solution that does not require this.  Additionally this
> system boots to Windows so I really don't want to mess around with issues
> booting Windows.

The only alternative is to sign the kernel modules with your own
certificate, and load that certificate into the firmware as a valid
Secure Boot CA.

https://docs.fedoraproject.org/en-US/fedora/f33/system-administrators-guide/...

[stan]

On Wed, 3 Feb 2021 14:59:16 -0500
Jonathan Billings  wrote:
> The only alternative is to sign the kernel modules with your own
> certificate, and load that certificate into the firmware as a valid
> Secure Boot CA.
>
> https://docs.fedoraproject.org/en-US/fedora/f33/system-administrators-guide/...

I see from that page a signing program called sign-file, but no mention
of pesign.  Is pesign deprecated, or is sign-file just an alternate
way of signing?

[Jonathan Billings]

On Wed, Feb 03, 2021 at 01:34:02PM -0700, stan via users wrote:
> On Wed, 3 Feb 2021 14:59:16 -0500
> Jonathan Billings  wrote:
> > The only alternative is to sign the kernel modules with your own
> > certificate, and load that certificate into the firmware as a valid
> > Secure Boot CA.
> >
> > https://docs.fedoraproject.org/en-US/fedora/f33/system-administrators-guide/...
>
> I see from that page a signing program called sign-file, but no mention
> of pesign.  Is pesign deprecated, or is sign-file just an alternate
> way of signing?

Best I understand, pesign is for signing UEFI binaries.  sign-file is
for signing a kernel module.

[stan]

On Wed, 3 Feb 2021 15:42:54 -0500
Jonathan Billings  wrote:
> On Wed, Feb 03, 2021 at 01:34:02PM -0700, stan via users wrote:
> > On Wed, 3 Feb 2021 14:59:16 -0500
> > Jonathan Billings  wrote:
> > > The only alternative is to sign the kernel modules with your own
> > > certificate, and load that certificate into the firmware as a
> > > valid Secure Boot CA.
> > >
> > > https://docs.fedoraproject.org/en-US/fedora/f33/system-administrators-guide/...
> >
> > I see from that page a signing program called sign-file, but no
> > mention of pesign.  Is pesign deprecated, or is sign-file just an
> > alternate way of signing?
>
> Best I understand, pesign is for signing UEFI binaries.  sign-file is
> for signing a kernel module.

Thanks, that explains why the results of the commands on the page you
gave told me my system wasn't secure booting, and didn't mention my
private signing key for UEFI that I use to sign the kernel.

$ mokutil --sb-state
This system does't support Secure Boot

# keyctl list %:.builtin_trusted_keys
1 key in keyring:
439922868: ---lswrv     0     0 asymmetric: Fedora kernel signing key: 8ba4f0101defedadc01c847442f27f5ca183572c