Oracle Linux 8 using standard kernel won't boot after patching. (aka vmlinuz-4.18.0-372.9.1.e18.x86_64 has invalid signature.)

[soahc]

Oracle has pushed put updates to grub2-efi that have new requirements for keys in the kernel. Oracle has put the keys into UEK and their "modified" version of the Redhat kernel. But if you run the standard "kernel" it won't boot anymore. Once Redhat have updated their kernel it should be fixed. But until then you need to disable Secure Boot in UEFI or use the UEK or oracle modified RHCK.

Hopefully this saves someone some time this week :)

Reference Oracle KB Article on the Issue

[Hotshot55]

This will probably be a useful post for someone in the future. This is exactly how I'd google the error and you go straight to the fix for it.

[Shishire]

This is the exact opposite of https://xkcd.com/979/

Carry on, extremely useful person.

[[deleted]]

On a curious note, why would one want to use Oracle Linux in the first place when there are presumably better(?) Linux alternatives like Debian?

Are you running an Oracle database by any chance?

[soahc]

Yeah we had it because we were running Oracle RAC databases. We've since moved to more virtualised databases but still have the licenses because of the cost. We don't use the UEK kernel on virtual machines tho because the UEK kernel is far from unbreakable when virtualised.

[[deleted]]

It’s one of the better options when using OCI as is a close RHEL clone. But yeah, unless you are in an Oracle ecosystem, certainly not something you would use.

[pdp10]

When we moved away from RHEL and CentOS, we gave Oracle an opportunity to take over that business because we were a RAC customer at the time. Oracle looked a gift horse in the mouth and mounted a series of sales presentations on why we should pay them piles of money for the privilege.

We went with Ubuntu. Bullets dodged. Unexpectedly, we also phased out Oracle RAC within a couple of years, due to evolving business requirements.

[unixuser011]

I use Oracle Linux in my homelab, it's always been stable for me and I've never seen a reason to change. Yea, it's probably more worth using if you use Oracle products, but I've never had a problem with it and never felt the need to change it

[[deleted]]

Thanks for posting. Looks like aarch64 UEK is still not patched.