Since I recently got a Razer mouse I wanted to install Openrazer to go with it, and I discovered that you need to first follow these steps to sign the Openrazer driver so that secure boot will allow it to run.
I’d like to try and understand what I’m actually doing a little better before I start blindly copy and pasting these commands into my terminal. As far as I understand, secure boot stops untrusted/unsigned drivers from running to protect your system, so to get it to trust Openrazer you have to sign Openrazer yourself.
But here’s the point I get stuck on:
akmods is now already signing kernel modules so that other modules (like VirtualBox) will also work with secure boot.
To me, this sounds like we’ve just unleashed akmods to go around signing everything it can get its hands on. Wouldn’t that make secure boot pointless? Is it safe for akmods to just go round signing anything that’s unsigned? And if so, is there any point in leaving secure boot enabled?
Or am I just completely misunderstanding, and akmods is actually only going to sign certain drivers? In that case, how does it know which to sign?
Thanks for reading this, I hope my question isn’t too dumb n_n
When the akmods package is installed, it enables systemd services to generate Secure Boot certificates and build kernel modules found under /usr/src/akmods
Not really. When malware gets root access you’re pwned anyway.
Any kernel driver module must be properly signed before it can be loaded into the kernel to support the related device.
Akmods is a tool that is used to compile and sign those modules when they are installed.
Only packages that are properly designed and distributed explicitly for use with akmods will be compiled and signed that way.
It is entirely up to the user to determine if they wish to use a device that requires a locally compiled driver, and to determine if they are trusting the source of that software enough to install and use it. Akmods has nothing to do with the content of the source code used to compile the module and is only tasked with compiling the code, signing the binary, and creating the rpm file used for installation.
Akmods does not work with any other software and AFAIK only works with the key that is generated by the kmodgenca command. As shown in that linked instruction, it is possible to configure dkms (another module compiling tool) to use the same signing key.
What this means is that the user is responsible for determining if the package being installed for the driver is from a trust worthy source and if they choose to install and use that driver.
Akmods is a tool, the user is the one who decides if the software is acceptable.