2

If the linux kernel is compiled to check for kernel modules signing, it checks the validity of the public key (X.509) w.r.t the current system time. For the first time the system is booting up, it hasn't received external time sync and the default time is still 1 Jan 1970. I am wondering how is this issue resolved in other implementations using kernel module signing?

2

The kernel normally gets its first 'base' time from the RTC or Real Time Clock so while it won't be as accurate yet as after the NTP protocol has updated the time. it is sufficient to validate a signature of a certificate. you can set this value normally in the BIOS before ever booting an OS.

| improve this answer | |
  • What if the processor does not have battery and hence no RTC? – ritzp May 27 '15 at 23:21
  • you have to set it to a correct time in the BIOS pre boot. or have the validation fail. – LvB May 27 '15 at 23:23
  • 2
    If you don't have battery then all certificate validation will fail and not just kernel modules. Every HTTPS site you visit will display the non-validation warning. I suppose at this stage your problem is not that of kernel module warning but fixing the motherboard. – void_in May 28 '15 at 4:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.