kvm: module verification failed: signature and/or required key missing - tainting kernel

Instead of re-configuring the kernel, this error (module verification failed) could be resolved by just adding one line CONFIG_MODULE_SIG=n to the top of the Makefile for the module itself:

CONFIG_MODULE_SIG=n# If KERNELRELEASE is defined, we've been invoked from the# kernel build system and can use its language.ifneq ($(KERNELRELEASE),)    obj-m := hello.o# Otherwise we were called directly from the command# line; invoke the kernel build system.else    KERNELDIR ?= /lib/modules/$(shell uname -r)/build    PWD := $(shell pwd)default:    $(MAKE) -C $(KERNELDIR) M=$(PWD) modulesendif

It seems like the vendor of your system has enabled kernel module signature verification on your kernel which means it won't load any module that the vendor hasn't signed. In other words, your patched module isn't signed (properly) and the kernel will refuse to load it.

The point of this is supposed to prevent malware and rootkits from loading malicious kernel modules.

I suggest you contact your vendor. There may be an option somewhere on your platform to disable signature checking. Otherwise, your vendor may be able to sign the module for you. You might even have the key and the details of the signature verification algorithm and can sign it yourself.

Without knowing what platform you're running on, it's hard to give more specific suggestions.

Go to the kernel source directory and do (for e.g):

./scripts/sign-file sha512 ./signing_key.priv ./signing_key.x509 /lib/modules/3.10.1/kernel/drivers/char/my_module.ko

for kernel 4.4.*, keys location should be as follows:

./scripts/sign-file sha512 ./certs/signing_key.pem ./certs/signing_key.x509 path/to/your/kernel/module.ko 

Check what is the digest algorithm your kernel is using by opening .config and reading it in CONFIG_MODULE_SIG config values.

CONFIG_MODULE_SIG=y CONFIG_MODULE_SIG_ALL=y CONFIG_MODULE_SIG_SHA512=y CONFIG_MODULE_SIG_HASH="sha512"