0

When I try to use virtualbox (installed through package manager) I get the following error upon opening a virtual machine:

The VirtualBox Linux kernel driver (vboxdrv) is either not loaded or there is a permission problem with /dev/vboxdrv. Please install virtualbox-dkms package and load the kernel module by executing

'modprobe vboxdrv'

as root. If it is available in your distribution, you should install the DKMS package first. This package keeps track of Linux kernel changes and recompiles the vboxdrv kernel module if necessary.

Now when I tried to run sudo modprobe vboxdrv it errors with

modprobe: ERROR: could not insert 'vboxdrv': Required key not available

I also notice at the end of the installation of virtualbox-dkms it shows up with:

DKMS: install completed.
Setting up virtualbox (5.0.40-dfsg-0ubuntu1.16.04.2) ...
vboxweb.service is a disabled or a static unit, not starting it.
Job for virtualbox.service failed because the control process exited with error code. See "systemctl status virtualbox.service" and "journalctl -xe" for details.
invoke-rc.d: initscript virtualbox, action "restart" failed.

Inspecting the status shows

● virtualbox.service - LSB: VirtualBox Linux kernel module
   Loaded: loaded (/etc/init.d/virtualbox; bad; vendor preset: enabled)
   Active: failed (Result: exit-code) since di 2018-03-20 14:05:46 CET; 6min ago
     Docs: man:systemd-sysv-generator(8)

mrt 20 14:05:45 paul-GP60-2QF systemd[1]: Starting LSB: VirtualBox Linux kernel module...
mrt 20 14:05:46 paul-GP60-2QF virtualbox[15359]:  * Loading VirtualBox kernel modules...
mrt 20 14:05:46 paul-GP60-2QF virtualbox[15359]:  * modprobe vboxdrv failed. Please use 'dmesg' to find out why
mrt 20 14:05:46 paul-GP60-2QF virtualbox[15359]:    ...fail!
mrt 20 14:05:46 paul-GP60-2QF systemd[1]: virtualbox.service: Control process exited, code=exited status=1
mrt 20 14:05:46 paul-GP60-2QF systemd[1]: Failed to start LSB: VirtualBox Linux kernel module.
mrt 20 14:05:46 paul-GP60-2QF systemd[1]: virtualbox.service: Unit entered failed state.
mrt 20 14:05:46 paul-GP60-2QF systemd[1]: virtualbox.service: Failed with result 'exit-code'.

Now during installation there was a small "anomaly". - the install procedure asked me to disable secure boot. - I do not wish this, I wish to keep using secure boot (as it works with both ubuntu and windows -and even virtualbox on windows- for now).

Does this mean I can't have secure boot and virtual box? That seems silly considering virtual box runs inside the operating system and ubuntu itself starts just fine.

1 Answer 1

0

Use VirtualBox in secure boot (UEFI)

Using self compiled kernel modules in a secure boot environment is possible. All modules have do be signed and the keys have to be registered in the secure boot BIOS (or boot loader)

Create signing certificate and key

Create a certificate and private key for signing the kernel modules (required package sudo apt-get install openssl).

## Create a signing key and certificate##
## Signing certificate and keys
sign_key=signing_key.priv
sign_crt=signing_key.x509

## Subject for certificate
sign_sub=""
sign_sub+="/O=Your Name"
sign_sub+="/CN=Module Signing Key"
sign_sub+="/[email protected]"
sign_sub+="/"

## Create certificate and keys
if [[ ! -f "$sign_key" ]] && [[ ! -f "$sign_crt" ]]; then
    openssl req -new -x509 -newkey rsa:2048 -keyout "$sign_key" \
        -outform DER -out "$sign_crt" -nodes -days 365 -subj "$sign_sub"
fi
## Print certificate
openssl x509 -in "$sign_crt" -inform DER -noout -text

Build Linux kernel signing tool

Inside the Linux kernel headers under /usr/src/ is the signing tool for the kernel modules (required packages sudo apt-get install build-essential libssl-dev).

## Build signing tool
gcc "/usr/src/linux-headers-$(uname -r)/scripts/sign-file.c" -L \
   /usr/include/openssl/ -lcrypto -lssl -o sign-file

Signing VirtualBox modules

With the signing tool all VirtualBox modules need to be signed.

## Sign virtualbox modules
vbox_mod=()
vbox_mod+=(vboxdrv)
vbox_mod+=(vboxnetadp)
vbox_mod+=(vboxnetflt)
vbox_mod+=(vboxpci)

for module in "${vbox_mod[@]}"; do
    echo "Signing module $module"
    sudo sign-file sha256 "$sign_key" "$sign_crt" \
        "$(modinfo -n "$module")"
done

Add certificate to secure boot

At last, the certificate needs to be added to the secure boot BIOS (requires package sudo apt-get install mokutil)

## Add key to UEFI keyring
sudo mokutil --import "$sign_crt"

It is recommended to create a script to do that, because with every kernel update, the modules need to be sign again. The certificate and key can be reused, so the UEFI keyring must not be updated all the time.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .