[go: up one dir, main page]

Menu

#55 Secure Boot on RHEL

1.0
open
nobody
None
2021-12-23
2021-12-10
No

My SCST service does not want to come up on an RHEL 8.5 when Secure Boot is turned on; even after I have gone to the UEFI menu and registered the keys using MOK menu per README instructions here: https://github.com/bvanassche/scst/blob/master/README.module-signing

I get the following error:
● mediator-scst.service
Loaded: loaded (/etc/systemd/system/mediator-scst.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Wed 2021-12-08 10:26:33 EST; 1 day 22h ago
Process: 7320 ExecStart=/etc/init.d/scst start (code=exited, status=5)

Dec 08 10:26:33 scs000040681 systemd[1]: mediator-scst.service: Service RestartSec=100ms expired, scheduling restart.
Dec 08 10:26:33 scs000040681 systemd[1]: mediator-scst.service: Scheduled restart job, restart counter is at 5.
Dec 08 10:26:33 scs000040681 systemd[1]: Stopped mediator-scst.service.
Dec 08 10:26:33 scs000040681 systemd[1]: mediator-scst.service: Start request repeated too quickly.
Dec 08 10:26:33 scs000040681 systemd[1]: mediator-scst.service: Failed with result 'exit-code'.
Dec 08 10:26:33 scs000040681 systemd[1]: Failed to start mediator-scst.service.

My System's Info:
cat /etc/redhat-release: Red Hat Enterprise Linux release 8.5 (Ootpa)
mokutil --sb-state: SecureBoot enabled
modprobe scst && modprobe -r scst:
modprobe: FATAL: Module scst not found in directory /lib/modules/4.18.0-348.2.1.el8_5.x86_64

Please, note that I have tried this on various RHEL OSes and each one is giving me a different result! I will be happy to see it working on the latest OS release of RHEL, which is 8.5!

Any help/hint is greatly appreciated - or if this is a bug (maybe the README file need be updated), please, address it.

Discussion

  • Mike Khosraviani

    More info about the system:

    root@localhost default]# find /lib/modules/ -name "scst.ko"
    /lib/modules/4.18.0-348.el8.x86_64/extra/scst.ko
    [root@localhost default]#
    [root@localhost default]# rpm -qa | grep scst
    [root@localhost default]#

     
  • Mike Khosraviani

    Solved my issue! In addition to mokutil --import; I had to use the .priv and .der keys to sign the kernel modules. Thank you for all your help/hint that helped me resolve this issue.

    I am closing this issue.

     

Log in to post a comment.