Since Linux 5.4, the kernel supports a hardening feature called "lockdown". Once enabled, this prevents (among other things) kernel modules from being loaded unless they are signed [1] with the same key as the kernel itself. Usually, this would be enabled in early boot using the "lockdown=confidentiality" parameter on the kernel cmdline in the bootloader.

However, a side effect of this is that out of tree modules (like DKMS modules, and those out of tree modules that Archlinux ships as addional precompiled packages in its repositories) cannot be loaded anymore once lockdown is enabled.

It seems desirable that those precompiled modules (I'm mainly thinking of wireguard, but there are other precompiled modules that could benefit from this as well) would be signed using the private key that is autogenerated for module signing whilst the respective kernel package is built. That private key can be found in ./certs/signing_key.pem after the kernel was built (with . being the root directory of the kernel source tree). Obviously this still wouldn't allow people to use DKMS if they enable lockdown, but it would still be better than nothing I guess.


[1] https://www.kernel.org/doc/html/v5.4/admin-guide/module-signing.html