title: "PKCS#7 signature not signed with a trusted key" error on modprobe module.ko
body: <p>On Ubuntu 18.04.3, I want to sign a driver which I've built on the same Ubuntu machine and load it via modprobe. This machine has SecureBoot enabled.</p>
  
  <p>After building the driver to get the .ko file, I've attempted to sign the module as follows:</p>
  
  <ol>
  <li>I've created a key by running:</li>
  </ol>
  
  <pre><code>sudo update-secureboot-policy --new-key
  </code></pre>
  
  <p>like the "<strong>How can I do non-automated signing of drivers?</strong>" section <a href="https://wiki.ubuntu.com/UEFI/SecureBoot" rel="nofollow noreferrer">here</a> says to do.
  (No output/error message)</p>
  
  <ol start="2">
  <li>I've tried to enroll the key by running:</li>
  </ol>
  
  <pre><code>sudo update-secureboot-policy --enroll-key**
  </code></pre>
  
  <p>as suggested by the same <a href="https://wiki.ubuntu.com/UEFI/SecureBoot" rel="nofollow noreferrer">page</a>.
  (This results in a one-line output I wasn't sure what to make of:
  "No DKMS modules installed.")</p>
  
  <ol start="3">
  <li>Then I tried signing the modules with the keys by running:</li>
  </ol>
  
  <pre><code>sudo kmodsign sha512 /var/lib/shim-signed/mok/MOK.priv /var/lib/shim-signed/mok/MOK.der my_module.ko
  </code></pre>
  
  <p>as it says to do <a href="https://wiki.ubuntu.com/UEFI/SecureBoot/Signing" rel="nofollow noreferrer">here</a>. (No output/error message)</p>
  
  <p>But when I try installing the module via modprobe:</p>
  
  <pre><code>sudo modprobe my_module.ko**
  </code></pre>
  
  <p>I get the error:</p>
  
  <blockquote>
    <p>modprobe: ERROR: could not insert 'gve': Operation not permitted</p>
  </blockquote>
  
  <p>The dmesg entry I think is relevant says:</p>
  
  <blockquote>
    <p>PKCS#7 signature not sugned with a trusted key</p>
  </blockquote>
  
  <p>I'm not sure whether this means I have not enrolled the keys I created correctly or what other problems there might be.</p>
  
  <p>This is the output I get from running the following commands:</p>
  
  <pre><code>$ mokutil --test-key /var/lib/shim-signed/mok/MOLK.der
  </code></pre>
  
  <p>And the output is:
  /var/lib/shim-signed/mok/MOLK.der is not enrolled</p>
  
  <pre><code>$ sudo mokutil --import /var/lib/shim-signed/mok/MOLK.der
  </code></pre>
  
  <p>And the output is:
  SKIP: /var/lib/shim-signed/mok/MOLK.der is already in the enrollment request</p>
  
  <p>Okay, I think my post might be duplicate of <a href="https://askubuntu.com/questions/760671/could-not-load-vboxdrv-after-upgrade-to-ubuntu-16-04-and-i-want-to-keep-secur">this</a> S/O post, but I'm actually looking to write a script that'll download, build, sign and install the driver but it seems like rebooting is a necessary part of enrolling keys which is a necessary part of signing the driver. Is there a way around this that'll let me automate all of this in a script?</p>