As many others, I need to run a Windows instance from Virtualbox, don't want to disable Secure Boot, and therefore have problems in making Virtualbox work after kernel updates.
I have already run through the necessary steps, but something must have gone wrong. At present, Virtualbox runs if I disable secure boot, but freezes the whole system as soon as I try to run a VM (which at the moment is in an interrupted state) when secure boot is enabled.
I checked the following:
- I have generated a certificate (with
-subj "/CN=MyName/"). A
MOK.deris there, and I enrolled it (
mokutil --list-enrolledshows it with another from Canonical). In fact if I try another
mokutil -n import MOK.der, I get the output
SKIP: MOK.der is already enrolled
I am able to sign virtualbox modules by this script:
<!-- language: bash --> #!/bin/bash for modfile in $(dirname $(modinfo -n vboxdrv))/vbox*.ko; do echo "Signing $modfile" /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 \ /root/module-signing/MOK.priv \ /root/module-signing/MOK.der "$modfile" done
... and I can check that they are all signed:
$ grep "MyName" $(dirname $(modinfo -n vboxdrv))/vbox*.ko Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxdrv.ko corrisponde Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxnetadp.ko corrisponde Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxnetflt.ko corrisponde Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxpci.ko corrisponde
In fact I can load the modules from command line, with no error messages: $ for modfile in $(dirname $(modinfo -n vboxdrv))/vbox*.ko; do modprobe $(basename -s .ko $modfile); done
Nevertheless, I can't find my certificate among those known at BIOS level: None of
mokutil --db, includes "MyName" in the output (but some of them include "Canonical")
So, the questions:
- Where is the enrolled MOK stored if not in the PK, DB, or KEK? (in fact the modules can be loaded). Which name should I search for in my BIOS utility?
- What is the shim?
- I have
dkmspackage installed, and only recently installed also
virtualbox-dkms. Are these packages needed or not? In which sequence should I install them? before or after the above procedure? Or should they rather do the whole of it, instead of leaving it to be done by me manually?
- Should I rather try uninstalling
virtualbox-dkms(etc?) and redo the procedure from scratch?
What of the above remains applicable fopr the rest of the modules in the
nvidia*)? In fact, from the System Settings menu, under System/Software & Updates I see that the Nvidia 384.111 proprietary driver is being used, but then I can neither see it by
lsmod | grep nvidianor
$ modprobe nvidia_384 modprobe: ERROR: could not insert 'nvidia_384': Required key not available
Is the situation inconsistent? Where to start from to fix it?