Linux Mint 19.3 + Signed RT Kernel failed + UEFI-Bios

chiron@chiron-SystemFZ16:~$ halcompile halcompile: Befehl nicht gefunden. chiron@chiron-SystemFZ16:~$ inxi -Fz System: Host: chiron-SystemFZ16 Kernel: 5.3.0-24-lowlatency x86_64 bits: 64 Desktop: MATE 1.22.2 Distro: Linux Mint 19.3 Tricia Machine: Type: Desktop Mobo: ASUSTeK model: TUF Z390-PRO GAMING v: Rev X.0x serial: <filter> UEFI: American Megatrends v: 2417 date: 06/03/2019 CPU: Topology: 8-Core model: Intel Core i7-9700KF bits: 64 type: MCP L2 cache: 12.0 MiB Speed: 801 MHz min/max: 800/5100 MHz Core speeds (MHz): 1: 800 2: 800 3: 800 4: 800 5: 800 6: 800 7: 800 8: 800 Graphics: Device-1: NVIDIA GP107GL [Quadro P1000] driver: nouveau v: kernel Display: x11 server: X.Org 1.20.4 driver: modesetting unloaded: fbdev,vesa resolution: 3840x2160~60Hz OpenGL: renderer: NV137 v: 4.3 Mesa 19.0.8 Audio: Device-1: Intel Cannon Lake PCH cAVS driver: snd_hda_intel Device-2: NVIDIA GP107GL High Definition Audio driver: snd_hda_intel Sound Server: ALSA v: k5.3.0-24-lowlatency Network: Device-1: Intel Ethernet I219-V driver: e1000e IF: eno1 state: up speed: 100 Mbps duplex: full mac: <filter> Drives: Local Storage: total: 2.73 TiB used: 91.98 GiB (3.3%) ID-1: /dev/nvme0n1 vendor: Samsung model: SSD 970 EVO Plus 500GB size: 465.76 GiB ID-2: /dev/sda vendor: Samsung model: SSD 860 EVO 500GB size: 465.76 GiB ID-3: /dev/sdb type: USB vendor: Seagate model: ST2000LM007-1R8174 size: 1.82 TiB Partition: ID-1: / size: 456.96 GiB used: 62.74 GiB (13.7%) fs: ext4 dev: /dev/sda2 Sensors: System Temperatures: cpu: 37.0 C mobo: N/A gpu: nouveau temp: 41 C Fan Speeds (RPM): cpu: 0 gpu: nouveau fan: 1721 Info: Processes: 268 Uptime: 25m Memory: 31.28 GiB used: 1.29 GiB (4.1%) Shell: bash inxi: 3.0.32 chiron@chiron-SystemFZ16:~$

chiron@chiron-SystemFZ16:~$ sbsign Usage: sbsign [options] --key <keyfile> --cert <certfile> <efi-boot-image> Sign an EFI boot image for use with secure boot. Options: --key <keyfile> signing key (PEM-encoded RSA private key) --cert <certfile> certificate (x509 certificate) --detached write a detached signature, instead of a signed binary --output <file> write signed data to <file> (default <efi-boot-image>.signed, or <efi-boot-image>.pk7 for detached signatures) chiron@chiron-SystemFZ16:~$ sudo update-secureboot-policy --enroll-key [sudo] Passwort für chiron: Das hat nicht funktioniert, bitte nochmal probieren. [sudo] Passwort für chiron: No DKMS modules installed. chiron@chiron-SystemFZ16:~$ kmodsign sha512 \ > /var/lib/shim-signed/mok/MOK.priv \ > /var/lib/shim-signed/mok/MOK.der \ > module.ko At main.c:248: - SSL error:0200100D:system library:fopen:Permission denied: ../crypto/bio/bss_file.c:72 - SSL error:2006D002:BIO routines:BIO_new_file:system lib: ../crypto/bio/bss_file.c:81 kmodsign: /var/lib/shim-signed/mok/MOK.priv: Permission denied chiron@chiron-SystemFZ16:~$ bootctl status System: Firmware: n/a (n/a) Secure Boot: enabled Setup Mode: user Current Loader: Product: n/a ESP: n/a File: └─n/a Boot Loader Entries in EFI Variables: Title: ubuntu ID: 0x0000 Status: active, boot-order Partition: /dev/disk/by-partuuid/78c218fe-ad21-4d06-8f51-49f60788bce8 File: └─/EFI/UBUNTU/SHIMX64.EFI Title: Windows Boot Manager ID: 0x0001 Status: active, boot-order Partition: /dev/disk/by-partuuid/59227b98-689c-4ffd-93c0-cba35beb987f File: └─/EFI/MICROSOFT/BOOT/BOOTMGFW.EFI Title: debian ID: 0x0005 Status: active, boot-order Partition: /dev/disk/by-partuuid/78c218fe-ad21-4d06-8f51-49f60788bce8 File: └─/EFI/DEBIAN/GRUBX64.EFI Title: ubuntu ID: 0x0009 Status: active, boot-order Partition: /dev/disk/by-partuuid/59227b98-689c-4ffd-93c0-cba35beb987f File: └─/EFI/UBUNTU/SHIMX64.EFI chiron@chiron-SystemFZ16:~$ mok-util Der Befehl 'mok-util' wurde nicht gefunden, meinten Sie: Befehl 'mokutil' aus dem deb mokutil Versuche: sudo apt install <deb name> chiron@chiron-SystemFZ16:~$ sudo apt install mokutil [sudo] Passwort für chiron: Paketlisten werden gelesen... Fertig Abhängigkeitsbaum wird aufgebaut. Statusinformationen werden eingelesen.... Fertig mokutil ist schon die neueste Version (0.3.0+1538710437.fb6250f-0ubuntu2~18.04.1). Die folgenden Pakete wurden automatisch installiert und werden nicht mehr benötigt: libgladeui-2-6 libgladeui-common Verwenden Sie »sudo apt autoremove«, um sie zu entfernen. 0 aktualisiert, 0 neu installiert, 0 zu entfernen und 0 nicht aktualisiert. chiron@chiron-SystemFZ16:~$ sudo apt autoremove Paketlisten werden gelesen... Fertig Abhängigkeitsbaum wird aufgebaut. Statusinformationen werden eingelesen.... Fertig Die folgenden Pakete werden ENTFERNT: libgladeui-2-6 libgladeui-common 0 aktualisiert, 0 neu installiert, 2 zu entfernen und 0 nicht aktualisiert. Nach dieser Operation werden 8.936 kB Plattenplatz freigegeben. Möchten Sie fortfahren? [J/n] j (Lese Datenbank ... 507063 Dateien und Verzeichnisse sind derzeit installiert.) Entfernen von libgladeui-2-6:amd64 (3.22.1-1) ... Entfernen von libgladeui-common (3.22.1-1) ... Trigger für libc-bin (2.27-3ubuntu1) werden verarbeitet ... chiron@chiron-SystemFZ16:~$ mokutil Usage: mokutil OPTIONS [ARGS...] Options: --help Show help --list-enrolled List the enrolled keys --list-new List the keys to be enrolled --list-delete List the keys to be deleted --import <der file...> Import keys --delete <der file...> Delete specific keys --revoke-import Revoke the import request --revoke-delete Revoke the delete request --export Export keys to files --password Set MOK password --clear-password Clear MOK password --disable-validation Disable signature validation --enable-validation Enable signature validation --sb-state Show SecureBoot State --test-key <der file> Test if the key is enrolled or not --reset Reset MOK list --generate-hash[=password] Generate the password hash --ignore-db Ignore DB for validation --use-db Use DB for validation --import-hash <hash> Import a hash into MOK or MOKX --delete-hash <hash> Delete a hash in MOK or MOKX --set-verbosity <true/false> Set the verbosity bit for shim --pk List the keys in PK --kek List the keys in KEK --db List the keys in db --dbx List the keys in dbx --timeout <-1,0..0x7fff> Set the timeout for MOK prompt Supplimentary Options: --hash-file <hash file> Use the specific password hash --root-pw Use the root password --simple-hash Use the old password hash method --mokx Manipulate the MOK blacklist chiron@chiron-SystemFZ16:~$ mokutil --pk [key 1] SHA1 Fingerprint: ec:d9:88:46:2e:bc:25:e7:ee:a7:91:72:08:9e:f3:fd:d1:b0:24:97 Certificate: Data: Version: 3 (0x2) Serial Number: 53:41:e0:15:c4:3a:f8:a8:48:36:b9:a5:ff:69:14:88 Signature Algorithm: sha256WithRSAEncryption Issuer: CN=ASUSTeK MotherBoard PK Certificate Validity Not Before: Dec 26 23:34:50 2011 GMT Not After : Dec 26 23:34:49 2031 GMT Subject: CN=ASUSTeK MotherBoard PK Certificate Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:d9:84:15:36:c5:d4:ce:8a:a1:56:16:a0:e8:74: cd:58:1e:2a:02:96:1b:c4:37:64:da:8c:6a:24:84: cd:dc:c4:68:04:15:c7:e9:cf:20:a4:45:1a:42:f0: a3:9b:62:22:6e:2a:43:67:17:8d:4d:10:aa:f8:dd: f2:2a:9e:86:ba:91:d0:32:7e:95:be:01:78:73:3a: d3:98:7e:19:f8:16:0e:27:cc:ea:c5:be:b5:80:7e: e8:bc:a8:17:41:b3:ea:55:34:19:53:d7:7e:7d:50: c7:5a:b8:ef:54:f9:13:6e:ab:d6:45:cd:1d:02:94: e2:78:d7:88:a8:10:52:8d:7e:ba:f1:49:36:c0:68: 70:f9:d5:0c:5a:fd:6b:1a:6f:88:c2:37:69:22:42: 92:f3:9d:ae:ef:73:ec:f4:0f:32:42:64:c3:e9:b9: 89:dd:06:e5:cc:2f:6b:f8:00:4e:91:64:f7:03:45: f0:4f:a4:11:83:e9:83:97:e9:a0:dc:2d:c8:03:56: b4:df:61:a6:32:a5:8b:a6:1b:4e:d8:1c:a7:a3:f3: 72:4e:72:f8:fe:69:49:cf:61:f2:e6:59:96:58:b8: 14:7c:ca:f5:e5:6b:f0:6d:da:f7:bc:08:5b:7f:57: e9:96:37:59:5a:70:79:57:0e:c8:82:c8:91:7b:67: f9:2d Exponent: 65537 (0x10001) X509v3 extensions: 2.5.29.1: ?=.../0-1+0)..U..."ASUSTeK MotherBoard PK Certificate..SA...:..H6...i.. Signature Algorithm: sha256WithRSAEncryption 73:27:1a:32:88:0e:db:13:8d:f5:7e:fc:94:f2:1a:27:6b:c2: ca:79:d0:ba:b6:58:bc:df:97:13:5a:4c:dc:a2:e4:90:39:7b: 24:84:7d:2e:a3:95:96:39:a6:6b:c2:a6:51:38:6f:e5:0b:af: c0:91:0a:90:3f:3e:5a:e4:79:16:98:96:32:94:49:ae:00:28: 18:aa:ef:fb:54:95:93:c7:fc:e4:89:ef:96:00:ce:d6:c6:8a: 4d:85:ca:9c:6c:fb:8a:a7:43:60:36:5e:73:97:17:2f:16:46: d0:ce:f0:a0:07:77:62:4d:15:0e:22:f6:91:71:1a:79:e1:85: 1c:0b:2c:94:9f:9d:97:cf:49:b5:dd:ea:6a:e5:a7:61:ec:82: 0d:95:e8:98:5c:e8:72:c6:da:8d:df:21:ec:05:30:0f:79:b8: af:e9:b0:2b:c0:83:73:fe:bf:9d:4a:6d:da:a5:a0:65:37:cf: 2c:87:f1:2b:c6:a3:0e:92:64:57:1a:77:ed:d9:47:40:47:da: ea:ff:23:98:d1:25:b9:72:f5:38:3a:b3:33:a5:5d:f1:44:dc: d8:63:7d:f9:2f:7d:f1:d1:d0:95:c0:a6:75:a8:70:c9:c4:2b: c0:45:04:d0:40:5b:75:7d:e2:b2:0a:3c:1e:64:22:30:d2:02: 84:c5:b7:bb chiron@chiron-SystemFZ16:~$ sbsign Usage: sbsign [options] --key <keyfile> --cert <certfile> <efi-boot-image> Sign an EFI boot image for use with secure boot. Options: --key <keyfile> signing key (PEM-encoded RSA private key) --cert <certfile> certificate (x509 certificate) --detached write a detached signature, instead of a signed binary --output <file> write signed data to <file> (default <efi-boot-image>.signed, or <efi-boot-image>.pk7 for detached signatures) chiron@chiron-SystemFZ16:~$