【22.03-LTS-SP1】modprobe强制加载内核模块失败Key was rejected by service

【环境信息】
1） OS版本及分支:openEuler 22.03-LTS-SP1
2） 内核信息:5.10.0-136.22.0.98.oe2203sp1.x86_64
【问题复现步骤】
1.安装22.03-LTS-SP1系统
2.查看loop模块信息

```
modinfo loop

filename:       /lib/modules/5.10.0-136.22.0.98.oe2203sp1.x86_64/kernel/drivers/block/loop.ko.xz
alias:          devname:loop-control
alias:          char-major-10-237
alias:          block-major-7-*
license:        GPL
srcversion:     374632838F9104E7F25831E
depends:
retpoline:      Y
intree:         Y
name:           loop
vermagic:       5.10.0-136.22.0.98.oe2203sp1.x86_64 SMP mod_unload modversions
sig_id:         PKCS#7
signer:         openEuler kernel signing key
sig_key:        55:B2:F7:B9:1E:D6:BD:C9:3A:46:9F:81:94:35:98:CA:90:C1:D7:AA
sig_hashalgo:   sha256
signature:      20:1A:EA:A9:65:40:F5:2E:44:CA:C0:97:03:65:0F:3B:32:32:E9:53:
                6B:6B:84:6B:B7:B7:0E:4B:51:23:47:D9:FB:29:25:20:4C:5D:FF:B2:
                1A:14:A8:DB:43:04:6A:8C:85:B0:F8:26:53:16:44:AD:4F:C4:0B:5F:
                FE:B4:34:07:8E:2A:5A:C5:84:92:56:FF:67:E4:62:C4:20:33:51:9E:
                46:E6:CE:AB:24:05:45:A8:96:3D:BF:2B:60:0E:B2:3F:84:C8:2F:21:
                34:50:5C:A8:BF:C0:07:A7:B1:2D:DE:14:98:F2:13:85:FA:02:20:C1:
                32:80:BA:A0:4F:4E:51:01:BA:68:81:4C:D3:F1:DE:68:F8:59:F9:75:
                D4:D5:10:40:7A:BE:D4:0C:BE:4B:D2:D2:07:CE:DF:AB:5C:31:96:A4:
                FB:63:2C:C6:97:A6:92:42:FD:FF:3D:CE:F7:19:C0:52:5D:7F:CB:5A:
                BE:DB:19:0E:0E:46:09:AB:BE:21:92:2C:98:FF:6E:D9:AD:47:3D:74:
                A7:D5:07:D8:5E:5E:1D:EF:27:BD:53:16:BE:CE:EA:FF:42:86:5D:EB:
                6F:67:5D:CC:5A:B6:3E:52:B7:F9:77:5B:72:AB:63:6B:0D:10:9A:F9:
                FC:7D:36:65:CD:C3:E6:06:28:D9:CF:39:FF:79:0A:4C:93:E1:DD:41:
                34:41:D1:DB:DA:B2:FF:5C:C8:1D:D2:25:B6:B9:A6:C8:00:DD:37:6E:
                79:81:BF:B8:C0:8E:BF:B3:87:76:25:0E:C0:DC:85:C2:E7:92:09:AD:
                62:32:BB:D8:93:0A:27:D4:51:C5:34:15:34:CC:64:7E:36:6C:0A:78:
                B2:5E:41:11:45:13:5E:F0:90:D4:E7:DE:47:04:4F:BD:4B:8A:F3:3F:
                B7:A0:AC:AA:5C:F4:1F:1F:CB:AE:82:F6:5C:89:96:1D:F8:D9:FC:F5:
                4C:BA:C1:00:94:83:60:E4:01:CF:73:C2:AF:2B:EB:90:C3:5E:37:AA:
                E0:CD:D5:3A:6D:B9:B9:E4:8E:3E:88:52:30:13:4A:2A:B6:8F:15:F6:
                8B:85:DF:1F:98:D9:5A:4D:20:B9:1F:B6:6B:F7:7B:F0:B5:70:86:5B:
                80:C3:DD:6B:77:FB:5A:4A:85:79:A0:5F:26:9F:60:0A:A1:58:42:2C:
                27:E5:65:70:65:55:86:56:C6:89:E3:AD:F7:4A:E2:77:E1:3B:86:E6:
                3C:1F:29:83:58:7D:5B:29:79:12:2A:F0:1A:DF:4D:C4:A5:E6:16:7A:
                59:B3:5C:64:64:8C:3B:01:A0:0E:1A:11:9E:C8:F4:B2:FC:99:BE:70:
                73:CC:CA:87:FC:26:1A:E4:8A:16:A0:8D
parm:           max_loop:Maximum number of loop devices (int)
parm:           max_part:Maximum number of partitions per loop device (int)

```
3.使用modprobe加载内核模块正常
```
modprobe loop
```
4.使用modprobe强制加载内核模块

```
modprobe -r loop (卸载步骤3的插入)
modprobe -f loop
modprobe: ERROR: could not insert 'loop': Key was rejected by service
```
备注：正常modprobe可以加载，使用-f是验证kmod功能是否正常，20.03SP3的ISO是可以正常运行；通过跟踪只都走到mod check流程。只是加了-f后modprobe可能去除了elf的__Version节。

5：当前trace后发现是crypto/rsa-pkcs1pad.c的方法返回了-EKEYREJECTED

```
501         /* Do the actual verification step. */
502         if (memcmp(req_ctx->out_buf + ctx->key_size, out_buf + pos,
503                    req->dst_len) != 0)
504                 err = -EKEYREJECTED;
```

modprobe-11636   [000] d... 60998.127440: pkcs1pad_verify_complete: (public_key_verify_signature+0x289/0x3a0 <- pkcs1pad_verify_complete) ret=0xffffff7f

src-openEuler/kernel
关闭

内容风险标识

评论 (2)

src-openEuler/kernel关闭 .gitee-modal { width: 500px !important; }

内容风险标识