hank-test/quick-docs
1
0
Fork 0
mirror of https://pagure.io/fedora-docs/quick-docs.git synced 2024-11-28 06:54:52 +00:00
Code Issues 1 Projects Releases Packages Wiki Activity Actions

Adding information about security implications and key deletion to the MOK enrollment page

Browse source
This commit is contained in:
Jiri Eischmann 2024-07-15 16:30:14 +02:00
parent b1fa43f3d2
commit 7c3861e361
1 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
modules/ROOT/pages/mok-enrollment.adoc
View file

@ -2,6 +2,8 @@
This page documents how to enroll a machine owner key that is created during the Nvidia driver installation (typically in GNOME Software).
====
== Prerequisite
The Nvidia driver has been installed and a machine owner key to self-sign the driver has been created in GNOME Software (or in a similar tool that supports it).
@ -27,3 +29,17 @@ image:mok-util-05.png[mok-util-06.png,title="mokutil start screen"]
6. Select *Reboot* to reboot into the OS with the Nvidia drivers enabled.
image:mok-util-06.png[mok-util-07.png,title="Enroll the key(s) - Password"]
== Security Implications
Note that the enrolled machine owner key will be used to sign any future updates to the module or any other module you will decide to install and they will be implicitly trusted. All future updates will happen transparently with no interaction and/or authorization. Therefore, it's recommended to delete the machine owner key when it's no longer needed.
== Deleting Machine Owner Key
To delete the machine owner key, perform the following command in the terminal:
+
[subs="quotes"]
----
$ *sudo mokutil --delete /etc/pki/akmods/certs/public_key.der*
----