Control: reassign -1 src:linux-signed-i386 5.10.120+1 Control: severity -1 serious Control: tag -1 confirmed On Mon, 13 Jun 2022 01:18:00 -0500 Daniel Lewart <lewart3@gmail.com> wrote: > Package: linux-image-5.10.0-15-686-pae > Version: 5.10.120-1 > Severity: normal > > Debian Kernel Team, > > Encountered on a physical machine and reproduced with QEMU: > > $ sudo modprobe rt61pci > modprobe: ERROR: could not insert 'rt61pci': Key was rejected by service > > But it works fine on the following: > * linux-image-5.10.0-14-686-pae Verson 5.10.113-1 > * linux-image-5.10.0-15-amd64 Verson 5.10.120-1 > > Here is some more verbosity: > > $ sudo modprobe -v rt61pci > insmod /lib/modules/5.10.0-15-686-pae/kernel/lib/crc-itu-t.ko > modprobe: ERROR: could not insert 'rt61pci': Key was rejected by service > > $ sudo modprobe -vv crc-itu-t > modprobe: INFO: ../libkmod/libkmod.c:365 kmod_set_log_fn() custom logging function 0x47b800 registered > insmod /lib/modules/5.10.0-15-686-pae/kernel/lib/crc-itu-t.ko > modprobe: INFO: ../libkmod/libkmod-module.c:892 kmod_module_insert_module() Failed to insert module '/lib/modules/5.10.0-15-686-pae/kernel/lib/crc-itu-t.ko': Key was rejected by service > modprobe: ERROR: could not insert 'crc_itu_t': Key was rejected by service > modprobe: INFO: ../libkmod/libkmod.c:332 kmod_unref() context 0x204a2d0 released I can confirm that this module does not load, and this means it has an invalid signature. The detached signature present in the source package seems to be truncated (408 bytes long, where for all other modules the detached signature is 411 bytes long). The amd64 kernel package is also affected, but for a different module (xt_l2tp). Since the truncated signatures are in the source packages, this is a problem introduced by the code signing service and will need to be fixed there. Ben. -- Ben Hutchings It's easier to fight for one's principles than to live up to them.
Attachment:
signature.asc
Description: This is a digitally signed message part