Symptoms
When attempting to update KernelCare, you receive a notification that the updates have already been downloaded and an error that the kcare.ko module could not be inserted.
# kcarectl --update
Updates already downloaded
insmod: ERROR: could not insert module /lib/modules/3.10.0-1160.25.1.el7.x86_64/extra/kcare.ko: Required key not available
Unable to load kmod (/lib/modules/3.10.0-1160.25.1.el7.x86_64/extra/kcare.ko 1). Try to run with `--check-compatibility` flag.
#
Description
If you run kcarectl with the --check-compatibility option, you will see that secure boot (UEFI) is enabled. KernelCare does not support UEFI (secure boot) and signing kernel modules.
# /usr/bin/kcarectl --check-compatibility
Secure boot is enabled. Not supported by KernelCare.
#
Workaround
There are two workarounds for this issue. Both should be performed by your system administrator.
The first workaround is to disable secure boot.
OR
The second workaround is for your system administrator to sign /lib/modules/3.10.0-1160.25.1.el7.x86_64/extra/kcare.ko themself.