For ENSL 10.7.15 and later:

NOTE: For distributions that support the Secure Boot feature, see KB96586 - Supported distributions for the ENSL Secure Boot feature.

The following packages need to be installed.

Tool	Provided by Package	Used On	Purpose
mokutil	mokutil	Target system	Manually enroll the public key
keyctl	keyutils	Target system	Optional; used to display public keys in the system keyring

Make sure that the shim, grub, and mokutil are up to date before you perform the steps below:

1. Download and extract the KernelModuleSignKeyPub.zip file in the "Attachment" section of this article.
2. Copy the public key file to the target system.
3. Import the public key into the BIOS using the command below:
   
   [root@localhost ~]# mokutil --import <path>/KernelModuleSignKeyPub.der
   input password:
   input password again:
    
4. Restart the system. The pending MOK enrollment request is identified by shim.efi, which starts the MokManager.efi. To complete this process, perform the following steps:
   1. On the Perform MOK management screen, select Enroll MOK to add the imported key to the system keyring.
   2. On the Enroll MOK screen, select View key to see the imported key details.
   3. On the Enroll MOK screen, select Continue to import the key.
   4. On the Enroll the key(s) screen, click Yes to enroll the key in the system keyring.
   5. Enter the same password entered while importing the key in step 3.
   6. On the Perform MOK management screen, select Reboot.
       
5. Verify that the key has been added:
   
   [root@localhost ~]# keyctl list %:.platform
   6 keys in keyring:
   807358922: ---lswrv     0     0 asymmetric: VMware, Inc.: 4ad8ba0472073d28127706ddc6ccb9050441bbc7
   555208707: ---lswrv     0     0 asymmetric: Red Hat Secure Boot (CA key 1): 4016841644ce3a810408050766e8f8a29c65f85c
   274135278: ---lswrv     0     0 asymmetric: MUSARUBRA US LLC: Musarubra US LLC: f2e3a47ee53989d2ebbc32abdea7d1d8bb556e3a
   434549956: ---lswrv     0     0 asymmetric: Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53
   156985236: ---lswrv     0     0 asymmetric: Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4
   454359069: ---lswrv     0     0 asymmetric: VMware, Inc.: VMware Secure Boot Signing: 04597f3e1ffb240bba0ff0f05d5eb05f3e15f6d7

For ENSL 10.6.6 and later:
Follow the steps below to sign kernel modules for UEFI Secure Boot.

NOTE: Both the Build system and Target system should have the same kernel and operating system versions.

Use two systems as follows:

• One system to sign the modules (known as the Build system)
• One system with UEFI Secured Boot where the modules need to be deployed (known as the Target system)

The following packages need to be installed.

Tool	Provided by Package	Used On	Purpose
openssl	openssl	Build system	Generates public and private X.509 key pair
sign-file	kernel-devel	Build system	Perl script used to sign kernel modules
mokutil	mokutil	Target system	Manually enroll the public key
keyctl	keyutils	Target system	Optional, used to display public keys in the system keyring

NOTE: Kernel signing can be done in one system and the public key and signed kernel modules can be added to other Target systems with UEFI Secured Boot.

On both the Build system and Target system, install ENSLTP with OAS disabled and Access Protection disabled:
 
On the Build system, perform the following steps:

1. Run the following commands:
   
   yum install openssl
   yum install kernel-devel
    
2. Create the configuration file below for generating a key:
   
   [root@localhost ~]# cat << EOF > ensl_configuration_file.config
   [ req ]
   default_bits = 4096
   distinguished_name = ensl
   prompt = no
   string_mask = utf8only
   x509_extensions = myexts
   
   [ ensl ]
   O = Corporation
   CN = Organization signing key
   emailAddress = email_address@corporation.com
   
   [ myexts ]
   basicConstraints=critical,CA:FALSE
   keyUsage=digitalSignature
   subjectKeyIdentifier=hash
   authorityKeyIdentifier=keyid
   EOF
    
3. Create a public-private key:
   
   [root@localhost ~]# openssl req -x509 -new -nodes -utf8 -sha256 -days 36500 -batch -config ensl_configuration_file.config -outform DER -out ensl_public_key.der -keyout ensl_private_key.priv
    
4. Send the public key to the Target system:
   
   [root@localhost ~]# scp ensl_public_key.der <target_sytem_user>@<target_system_IP_address>:<path>
    
5. Find the path of the FileAccess module and sign it:
   
   [root@localhost ~]# ls -lrt /lib/modules/$(uname -r)/mfe_fileaccess
   total 0
   lrwxrwxrwx. 1 root root 86 May 17 11:28 mfe_fileaccess.ko -> /var/McAfee/ens/esp/fileaccess/kernel/3.10.0-862.el7.x86_64/mfe_fileaccess_100612126.ko
   
   [root@localhost ~]# /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 <path>/ensl_private_key.priv <path>/ensl_public_key.der /var/McAfee/ens/esp/fileaccess/kernel/3.10.0-862.el7.x86_64/mfe_fileaccess_100612126.ko
   
   NOTE: Other available FileAccess modules for different kernel versions can be signed in the same manner.
    
6. Send the signed FileAccess kernel module to the Target system in the appropriate path:
   
   NOTE: Stop the ENSLTP services before you perform this step.
   
   [root@localhost ~]# /opt/McAfee/ens/tp/init/mfetpd-control.sh stop
   
   [root@localhost]# scp /var/McAfee/ens/esp/fileaccess/kernel/3.10.0-862.el7.x86_64/mfe_fileaccess_100612126.ko <target_sytem_user>@<target_system_IP_address>:/var/McAfee/ens/esp/fileaccess/kernel/3.10.0-862.el7.x86_64/mfe_fileaccess_100612126.ko​
    
7. Find the path of the AACmodule and sign it:
   
   [root@localhost ~]# ls -lrt /lib/modules/$(uname -r)/mfe_aac
   total 0lrwxrwxrwx. 1 root root 80 May 17 11:28 mfe_aac.ko -> /var/McAfee/ens/esp/aac/kernel/3.10.0-862.el7.x86_64/mfe_aac_100612126.ko
   
   [root@localhost ~]# /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 <path>/ensl_private_key.priv <path>/ensl_public_key.der /var/McAfee/ens/esp/aac/kernel/3.10.0-862.el7.x86_64/mfe_aac_100612126.ko
   
   NOTE: Other available AACmodules for different kernel versions can be signed in the same manner.
    
8. Send the signed AACkernel module to the Target system in the appropriate path:
   
   NOTE: Stop the ENSLTP services before you perform this step.
   
   [root@localhost ~]# /opt/McAfee/ens/tp/init/mfetpd-control.sh stop
   
   [root@localhost TP]# scp /var/McAfee/ens/esp/aac/kernel/3.10.0-862.el7.x86_64/mfe_aac_100612126.ko​ <target_sytem_user>@<target_system_IP_address>:/var/McAfee/ens/esp/aac/kernel/3.10.0-862.el7.x86_64/mfe_aac_100612126.ko​

On the Target system, perform the following steps:

1. Run the following commands:
   
   yum install mokutil
   yum install keyutils
    
2. Check the keys available in the system keyring:
   
   [root@localhost ~]# keyctl list %:.system_keyring
   7 keys in keyring:
   184534242: --alswrv00 asymmetric: Red Hat Enterprise Linux Driver Update Program (key 3): bf57f3e87362bc7229d9f465321773dfd1f77a80416592595:
   --alswrv00 asymmetric: Red Hat Secure Boot (CA key 1): 4016841644ce3a810408050766e8f8a29c65f85c775760976:
   --alswrv00 asymmetric: Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53800716271:
   --alswrv00 asymmetric: Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4517988567:
   --alswrv00 asymmetric: VMware, Inc.: 4ad8ba0472073d28127706ddc6ccb9050441bbc71024395483:
   --alswrv00 asymmetric: Red Hat Enterprise Linux kernel signing key: 5173023bf81637d7bf3c5150134eec841b96fd0b369251456:
   --alswrv00 asymmetric: Red Hat Enterprise Linux kpatch signing key: 4d38fd864ebe18c5f0b72e3852e2014c3a676fc8
    
3. Import the public key in the Target system:
   
   [root@localhost ~]# mokutil --import <path>/ensl_public_key.der
   input password:
   input password again:
    
4. Restart the system. The pending MOK enrollment request is identified by shim.efi, which starts the MokManager.efi. To complete this process, perform the following steps:
   1. On the Peform MOK management screen, select Enroll MOK to add the imported key to the system keyring.
   2. On the Enroll MOK screen, select View key to see the imported key details.
   3. On the Enroll the key(s) screen, click Yes to enroll the key in the system keyring.
   4. Enter the same password entered while importing the key in step 3.
   5. On the Peform MOK management screen, select Reboot.


5. Verify that the key has been added:
   
   [root@localhost ~]# keyctl list %:.system_keyring
   8 keys in keyring:
   41273182: --alswrv0     0 asymmetric: Red Hat Enterprise Linux Driver Update Program (key 3): bf57f3e87362bc7229d9f465321773dfd1f77a8025238101: 
   --alswrv     0     0 asymmetric: Red Hat Secure Boot (CA key 1): 4016841644ce3a810408050766e8f8a29c65f85c1057481158: 
   --alswrv     0     0 asymmetric: Corporation: Organization signing key: 079b377b69818d219480d1a8247d00bb44ac99e5302746409: 
   --alswrv     0     0 asymmetric: Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53781519189: 
   --alswrv     0     0 asymmetric: Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4371559668: 
   --alswrv     0     0 asymmetric: VMware, Inc.: 4ad8ba0472073d28127706ddc6ccb9050441bbc7757185255: 
   --alswrv     0     0 asymmetric: Red Hat Enterprise Linux kernel signing key: 5173023bf81637d7bf3c5150134eec841b96fd0b877420410:
   --alswrv     0     0 asymmetric: Red Hat Enterprise Linux kpatch signing key: 4d38fd864ebe18c5f0b72e3852e2014c3a676fc8
    
6. Enable OAS:
   
   [root@localhost ~]#/opt/McAfee/ens/tp/bin/mfetpcli --setoasglobalconfig --oas on
   OAS Enabled Successfully
    
7. Verify that the FileAccess module is loaded:
   
   [root@localhost ~]# lsmod | grep mfe
   mfe_fileaccess_100602103    77171  2
    
8. Enable Access Protection:
   
   [root@localhost ~]# /opt/McAfee/ens/tp/bin/mfetpcli --setapstatus enable
   AP Enabled Successfully
    
9. Verify that the AACmodule is loaded:
   
   [root@localhost ~]# lsmod | grep aac
   mfe_aac_100602103 127171 2

Troubleshooting:

• If the kernel modules aren't loaded:
  Check the imported key in the system keyring and the module information for the signed key. Make sure that the module is signed with the same key that's imported in the system.
   
  [root@localhost ~]# modinfo /var/McAfee/ens/esp/fileaccess/kernel/3.10.0-862.el7.x86_64/mfe_fileaccess_100612126.ko
  filename:       /var/McAfee/ens/esp/fileaccess/kernel/3.10.0-862.el7.x86_64/mfe_fileaccess_100612126.ko
  license:        GPL
  description:    File system hooking module
  author:         McAfee LLC
  retpoline:      Y
  rhelversion:    7.4
  srcversion:     CE04C45CC3C0C81E18D6378
  depends:       
  vermagic:       3.10.0-693.21.1.el7.x86_64 SMP mod_unload modversions
  signer:         Corporation: Organization signing key
  sig_key:        07:9B:37:7B:69:81:8D:21:94:80:D1:A8:24:7D:00:BB:44:AC:99:E5
  sig_hashalgo:   sha256
  parm:           sys_call_table_str:Address of syscall table (charp)
  parm:          kallsyms_lookup_name_str:Address of kallsyms_lookup_name api (charp)
  parm:           netlinkRequestSocket:Netlink Request Socket Number (int)
  parm:           netlinkResponseSocket:Netlink Response Socket Number (int)
  
  
  [root@localhost ~]# keyctl list %:.system_keyring
  8 keys in keyring:
  41273182: --alswrv     0     0 asymmetric: Red Hat Enterprise Linux Driver Update Program (key 3): bf57f3e87362bc7229d9f465321773dfd1f77a8025238101:
  --alswrv     0     0 asymmetric: Red Hat Secure Boot (CA key 1): 4016841644ce3a810408050766e8f8a29c65f85c1057481158:
  --alswrv     0     0 asymmetric: Corporation: Organization signing key: 079b377b69818d219480d1a8247d00bb44ac99e5302746409:
  --alswrv     0     0 asymmetric: Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53781519189:
  --alswrv     0     0 asymmetric: Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4371559668:
  --alswrv     0     0 asymmetric: VMware, Inc.: 4ad8ba0472073d28127706ddc6ccb9050441bbc7757185255:
  --alswrv     0     0 asymmetric: Red Hat Enterprise Linux kernel signing key: 5173023bf81637d7bf3c5150134eec841b96fd0b877420410:
  --alswrv     0     0 asymmetric: Red Hat Enterprise Linux kpatch signing key: 4d38fd864ebe18c5f0b72e3852e2014c3a676fc8
  
  If the key hasn't been imported in the system and module insertion is tried, the following error displays in /var/log/messages:
  
  May 20 15:27:02 localhost kernel: Request for unknown module key 'Corporation: Organization signing key: 079b377b69818d219480d1a8247d00bb44ac99e5' err -11
  
  Import the appropriate public key in the system and reinsert the module.
   
• If the signed kernel module fails to get inserted in the system with the proper key in its system keyring:
  Check /var/log/messages and /var/McAfee/ens/log/tp/mfetpd.log for further information.

For ENSL 10.6.5 and earlier:
Follow the steps below to sign kernel modules for UEFI Secure Boot.

NOTE: Both the Build system and the Target system should have the same kernel and operating system versions.

Use two systems as follows:

• One system to sign the modules (known as the Build system)
• One system with UEFI Secured Boot where the modules need to be deployed (known as the Target system)

The following packages need to be installed.

Tool	Provided by Package	Used On	Purpose
openssl	openssl	Build system	Generates public and private X.509 key pair
sign-file	kernel-devel	Build system	Perl script used to sign kernel modules
mokutil	mokutil	Target system	Manually enroll the public key
keyctl	keyutils	Target system	Optional, used to display public keys in the system keyring

NOTE: Kernel signing can be done in one system and the public key and signed kernel modules can be added to other Target systems with UEFI Secured Boot.

On both the Build system and Target system, install ENSLTP with on-access scan (OAS) disabled and Access Protection disabled:
 
On the Build system, perform the following steps:

1. Run the following commands:
   
   yum install openssl
   yum install kernel-devel
    
2. Create the configuration file below for generating a key:
   
   [root@localhost ~]# cat << EOF > ensl_configuration_file.config
   [ req ]
   default_bits = 4096
   distinguished_name = ensl
   prompt = no
   string_mask = utf8only
   x509_extensions = myexts
   
   [ ensl ]
   O = Corporation
   CN = Organization signing key
   emailAddress = email_address@corporation.com
   
   [ myexts ]
   basicConstraints=critical,CA:FALSE
   keyUsage=digitalSignature
   subjectKeyIdentifier=hash
   authorityKeyIdentifier=keyid
   EOF
    
3. Create a public-private key:
   
   [root@localhost ~]# openssl req -x509 -new -nodes -utf8 -sha256 -days 36500 -batch -config ensl_configuration_file.config -outform DER -out ensl_public_key.der -keyout ensl_private_key.priv
    
4. Send the public key to the Target system:
   
   [root@localhost ~]# scp ensl_public_key.der <target_sytem_user>@<target_system_IP_address>:<path>
    
5. Find the path of the FileAccess module and sign it:
   
   [root@localhost ~]# ls -lrt /lib/modules/$(uname -r)/fileaccess
   total 0
   lrwxrwxrwx. 1 root root 86 May 17 11:28 fileaccess_mod.ko -> /opt/isec/ens/esp/modules/fileaccess/3.10.0-862.el7.x86_64-fileaccess_mod_100602103.ko
   
   [root@localhost ~]# perl /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 <path>/ensl_private_key.priv <path>/ensl_public_key.der /opt/isec/ens/esp/modules/fileaccess/$(uname -r)*.ko
   
   NOTE: Other available FileAccess modules for different kernel versions can be signed in the same manner.
    
6. Send the signed FileAccess kernel module to the Target system in the appropriate path:
   
   NOTE: Stop the ENSLTP services before performing this step.
   
   [root@localhost ~]# /opt/isec/ens/threatprevention/bin/isectpdControl.sh stop
   
   [root@localhost]# scp /opt/isec/ens/esp/modules/fileaccess/$(uname -r)*.ko <target_sytem_user>@<target_system_IP_address>:/opt/isec/ens/esp/modules/fileaccess/$(uname -r)*.ko
    
7. Find the path of the AACmodule and sign it:
   
   [root@localhost ~]# ls -lrt /lib/modules/$(uname -r)/mfeaack
   total 0lrwxrwxrwx. 1 root root 80 May 17 11:28 mfeaack.ko -> /opt/isec/ens/esp/modules/aac//kernel/3.10.0-862.el7.x86_64/mfeaack_100602103.ko
   
   [root@localhost ~]#  perl /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 <path>/ensl_private_key.priv <path>/ensl_public_key.der /opt/isec/ens/esp/modules/aac/kernel/$(uname -r)/*.ko
   
   NOTE: Other available AACmodules for different kernel versions can be signed in the same manner.
    
8. Send the signed AACkernel module to the Target system in the appropriate path:
   
   NOTE: Stop the ENSLTP services before you perform this step.
   
   [root@localhost ~]# /opt/isec/ens/threatprevention/bin/isectpdControl.sh stop
   
   [root@localhost TP]# scp /opt/isec/ens/esp/modules/aac/kernel/$(uname -r)/*.ko <target_sytem_user>@<target_system_IP_address>:/opt/isec/ens/esp/modules/aac/kernel/$(uname -r)/*.ko

On the Target system, perform the following steps:

1. Run the following commands:
   
   yum install mokutil
   yum install keyutils
    
2. Import the public key in the Target system:
   
   [root@localhost ~]# mokutil --import <path>/ensl_public_key.der
   input password:
   input password again:
    
3. Restart the system. The pending Machine Owner Key (MOK) enrollment request is identified by shim.efi, which starts the MokManager.efi. To complete this process, perform the following steps:
   1. On the Peform MOK management screen, select Enroll MOK to add the imported key to the system keyring.
   2. On the Enroll MOK screen, select View key to see the imported key details.
   3. On the Enroll the key(s) screen, click Yes to enroll the key in the system keyring.
   4. Enter the same password entered while importing the key in step 3.
   5. On the Peform MOK management screen, select Reboot.


4. Verify that the key has been added:
   
   [root@localhost ~]# keyctl list %:.system_keyring
   8 keys in keyring:
   41273182: --alswrv0     0 asymmetric: Red Hat Enterprise Linux Driver Update Program (key 3): bf57f3e87362bc7229d9f465321773dfd1f77a8025238101:
   --alswrv     0     0 asymmetric: Red Hat Secure Boot (CA key 1): 4016841644ce3a810408050766e8f8a29c65f85c1057481158:
   --alswrv     0     0 asymmetric: Corporation: Organization signing key: 079b377b69818d219480d1a8247d00bb44ac99e5302746409:
   --alswrv     0     0 asymmetric: Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53781519189:
   --alswrv     0     0 asymmetric: Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4371559668:
   --alswrv     0     0 asymmetric: VMware, Inc.: 4ad8ba0472073d28127706ddc6ccb9050441bbc7757185255:
   --alswrv     0     0 asymmetric: Red Hat Enterprise Linux kernel signing key: 5173023bf81637d7bf3c5150134eec841b96fd0b877420410:
   --alswrv     0     0 asymmetric: Red Hat Enterprise Linux kpatch signing key: 4d38fd864ebe18c5f0b72e3852e2014c3a676fc8
    
5. Enable OAS:
   
   [root@localhost ~]#/opt/isec/ens/threatprevention/bin/isecav --setoasglobalconfig --oas on
   OAS Enabled Successfully
    
6. Verify that the FileAccess module is loaded:
   
   [root@localhost ~]# lsmod | grep file
   fileaccess_mod_100602103    77171  2
    
7. Enable Access Protection:
   
   [root@localhost ~]# /opt/isec/ens/threatprevention/bin/isecav --setapstatus enable
   AP Enabled Successfully
    
8. Verify that the AACmodule is loaded:
   
   [root@localhost ~]# lsmod | grep aac
   mfeaack_100602103 127171 2

Troubleshooting:

• If the kernel modules aren't loaded:
  Check the imported key in the system keyring and the module information for the signed key. Make sure that the module is signed with the same key that's imported in the system.
   
  [root@localhost ~]# modinfo /opt/isec/ens/esp/modules/fileaccess/$(uname -r)*.ko
  filename:       /opt/isec/ens/esp/modules/fileaccess/3.10.0-862.el7.x86_64-
  fileaccess_mod_100602103.ko
  license:        GPL
  description:    File system hooking module
  author:         McAfee LLC
  retpoline:      Y
  rhelversion:    7.4
  srcversion:     CE04C45CC3C0C81E18D6378
  depends:       
  vermagic:       3.10.0-693.21.1.el7.x86_64 SMP mod_unload modversions
  signer:         Corporation: Organization signing key
  sig_key:        07:9B:37:7B:69:81:8D:21:94:80:D1:A8:24:7D:00:BB:44:AC:99:E5
  sig_hashalgo:   sha256
  parm:           sys_call_table_str:Address of syscall table (charp)
  parm:          kallsyms_lookup_name_str:Address of kallsyms_lookup_name api (charp)
  parm:           netlinkRequestSocket:Netlink Request Socket Number (int)
  parm:           netlinkResponseSocket:Netlink Response Socket Number (int)
  
  
  [root@localhost ~]# keyctl list %:.system_keyring
  8 keys in keyring:
  41273182: --alswrv     0     0 asymmetric: Red Hat Enterprise Linux Driver Update Program (key 3): bf57f3e87362bc7229d9f465321773dfd1f77a8025238101:
  --alswrv     0     0 asymmetric: Red Hat Secure Boot (CA key 1): 4016841644ce3a810408050766e8f8a29c65f85c1057481158:
  --alswrv     0     0 asymmetric: Corporation: Organization signing key: 079b377b69818d219480d1a8247d00bb44ac99e5302746409:
  --alswrv     0     0 asymmetric: Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53781519189:
  --alswrv     0     0 asymmetric: Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4371559668:
  --alswrv     0     0 asymmetric: VMware, Inc.: 4ad8ba0472073d28127706ddc6ccb9050441bbc7757185255:
  --alswrv     0     0 asymmetric: Red Hat Enterprise Linux kernel signing key: 5173023bf81637d7bf3c5150134eec841b96fd0b877420410:
  --alswrv     0     0 asymmetric: Red Hat Enterprise Linux kpatch signing key: 4d38fd864ebe18c5f0b72e3852e2014c3a676fc8
  
  If the key hasn't been imported in the system and module insertion is tried, the following error displays in /var/log/messages:
  
  May 20 15:27:02 localhost kernel: Request for unknown module key 'Corporation: Organization signing key: 079b377b69818d219480d1a8247d00bb44ac99e5' err -11
  
  Import the appropriate public key in the system and reinsert the module.
   
• If the signed kernel module fails to get inserted in the system with the proper key in its system keyring:
  Check /var/log/messages and /opt/isec/ens/threatprevention/var/isectpd.log for further information.