2

If the linux kernel is compiled to check for kernel modules signing, it checks the validity of the public key (X.509) w.r.t the current system time. For the first time the system is booting up, it hasn't received external time sync and the default time is still 1 Jan 1970. I am wondering how is this issue resolved in other implementations using kernel module signing?

Improve this question

1 Answer 1

Reset to default
2

The kernel normally gets its first 'base' time from the RTC or Real Time Clock so while it won't be as accurate yet as after the NTP protocol has updated the time. it is sufficient to validate a signature of a certificate. you can set this value normally in the BIOS before ever booting an OS.

Improve this answer
3
  • What if the processor does not have battery and hence no RTC?
    – ritzp
    Commented May 27, 2015 at 23:21
  • you have to set it to a correct time in the BIOS pre boot. or have the validation fail.
    – LvB
    Commented May 27, 2015 at 23:23
  • 2
    If you don't have battery then all certificate validation will fail and not just kernel modules. Every HTTPS site you visit will display the non-validation warning. I suppose at this stage your problem is not that of kernel module warning but fixing the motherboard.
    – void_in
    Commented May 28, 2015 at 4:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .