As many others, I need to run a Windows instance from Virtualbox, don't want to disable Secure Boot, and therefore have problems in making Virtualbox work after kernel updates.

I have already run through the necessary steps, but something must have gone wrong. At present, Virtualbox runs if I disable secure boot, but freezes the whole system as soon as I try to run a VM (which at the moment is in an interrupted state) when secure boot is enabled.

I checked the following:

  • I have generated a certificate (with -subj "/CN=MyName/"). A MOK.der is there, and I enrolled it (mokutil --list-enrolled shows it with another from Canonical). In fact if I try another mokutil -n import MOK.der, I get the output SKIP: MOK.der is already enrolled
  • I am able to sign virtualbox modules by this script:

    <!-- language: bash -->
    for modfile in $(dirname $(modinfo -n vboxdrv))/vbox*.ko; do
      echo "Signing $modfile"
      /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 \
                            /root/module-signing/MOK.priv \
                            /root/module-signing/MOK.der "$modfile"
  • ... and I can check that they are all signed:

    $ grep "MyName" $(dirname $(modinfo -n vboxdrv))/vbox*.ko 
    Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxdrv.ko corrisponde
    Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxnetadp.ko corrisponde
    Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxnetflt.ko corrisponde
    Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxpci.ko corrisponde
  • In fact I can load the modules from command line, with no error messages: $ for modfile in $(dirname $(modinfo -n vboxdrv))/vbox*.ko; do modprobe $(basename -s .ko $modfile); done

  • Nevertheless, I can't find my certificate among those known at BIOS level: None of mokutil --pk , mokutil --kek, mokutil --db, includes "MyName" in the output (but some of them include "Canonical")

So, the questions:

  • Where is the enrolled MOK stored if not in the PK, DB, or KEK? (in fact the modules can be loaded). Which name should I search for in my BIOS utility?
  • What is the shim?
  • I have dkms package installed, and only recently installed also virtualbox-dkms. Are these packages needed or not? In which sequence should I install them? before or after the above procedure? Or should they rather do the whole of it, instead of leaving it to be done by me manually?
  • Should I rather try uninstalling virtualbox, dkms, virtualbox-dkms (etc?) and redo the procedure from scratch?
  • What of the above remains applicable fopr the rest of the modules in the /lib/modules/4.13.0-37-generic/updates/dkms directory (namely bbswitch and nvidia*)? In fact, from the System Settings menu, under System/Software & Updates I see that the Nvidia 384.111 proprietary driver is being used, but then I can neither see it by lsmod | grep nvidia nor modprobe it:

    $ modprobe nvidia_384
    modprobe: ERROR: could not insert 'nvidia_384': Required key not available

Is the situation inconsistent? Where to start from to fix it?


  • btw, I now discovered that sbin/vboxconfig makes modules and saves them in /var/lib/dkms/, while all instructions and code snippets will do the signing in /lib/modules/4.13.0-37-generic/updates/dkms/, and the two are not symlinked... Am I signing the right modules? – lurix66 Mar 19 at 16:33
  • ... and..., what should I check about consistency of version of packages, as I have virtualbox-5.2, dkms, virtualbox-dkms, etc? How to get back to a fresh install? – lurix66 Mar 19 at 16:36

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.