As many others, I need to run a Windows instance from Virtualbox, don't want to disable Secure Boot, and therefore have problems in making Virtualbox work after kernel updates.

I have already run through the necessary steps, but something must have gone wrong. At present, Virtualbox runs if I disable secure boot, but freezes the whole system as soon as I try to run a VM (which at the moment is in an interrupted state) when secure boot is enabled.

I checked the following:

  • I have generated a certificate (with -subj "/CN=MyName/"). A MOK.der is there, and I enrolled it (mokutil --list-enrolled shows it with another from Canonical). In fact if I try another mokutil -n import MOK.der, I get the output SKIP: MOK.der is already enrolled
  • I am able to sign virtualbox modules by this script:

    <!-- language: bash -->
    for modfile in $(dirname $(modinfo -n vboxdrv))/vbox*.ko; do
      echo "Signing $modfile"
      /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 \
                            /root/module-signing/MOK.priv \
                            /root/module-signing/MOK.der "$modfile"
  • ... and I can check that they are all signed:

    $ grep "MyName" $(dirname $(modinfo -n vboxdrv))/vbox*.ko 
    Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxdrv.ko corrisponde
    Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxnetadp.ko corrisponde
    Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxnetflt.ko corrisponde
    Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxpci.ko corrisponde
  • In fact I can load the modules from command line, with no error messages: $ for modfile in $(dirname $(modinfo -n vboxdrv))/vbox*.ko; do modprobe $(basename -s .ko $modfile); done

  • Nevertheless, I can't find my certificate among those known at BIOS level: None of mokutil --pk , mokutil --kek, mokutil --db, includes "MyName" in the output (but some of them include "Canonical")

So, the questions:

  • Where is the enrolled MOK stored if not in the PK, DB, or KEK? (in fact the modules can be loaded). Which name should I search for in my BIOS utility?
  • What is the shim?
  • I have dkms package installed, and only recently installed also virtualbox-dkms. Are these packages needed or not? In which sequence should I install them? before or after the above procedure? Or should they rather do the whole of it, instead of leaving it to be done by me manually?
  • Should I rather try uninstalling virtualbox, dkms, virtualbox-dkms (etc?) and redo the procedure from scratch?
  • What of the above remains applicable fopr the rest of the modules in the /lib/modules/4.13.0-37-generic/updates/dkms directory (namely bbswitch and nvidia*)? In fact, from the System Settings menu, under System/Software & Updates I see that the Nvidia 384.111 proprietary driver is being used, but then I can neither see it by lsmod | grep nvidia nor modprobe it:

    $ modprobe nvidia_384
    modprobe: ERROR: could not insert 'nvidia_384': Required key not available

Is the situation inconsistent? Where to start from to fix it?


  • btw, I now discovered that sbin/vboxconfig makes modules and saves them in /var/lib/dkms/, while all instructions and code snippets will do the signing in /lib/modules/4.13.0-37-generic/updates/dkms/, and the two are not symlinked... Am I signing the right modules? – lurix66 Mar 19 '18 at 16:33
  • ... and..., what should I check about consistency of version of packages, as I have virtualbox-5.2, dkms, virtualbox-dkms, etc? How to get back to a fresh install? – lurix66 Mar 19 '18 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.