Looking for a mokutil workaround to sign virtualbox kernel modules [closed]

Question

I've been having some problems managing the Secure Boot setup on my machine which has an Asus X99 motherboard.

I've successfully generated a MOK with openssl, and then used it to sign the kernel module for my WiFi card (bcmwl-kernel-source/wl.ko) and enrolled the key into shim (if I understand correctly?) using MokManager. I got MokManager to run by adding an EFI boot record for it, and then using the EFI to start it at boot time. I couldn't get mokutil to work though, and had to manually copy the key over to the /boot partition, reboot, and choose "Enroll Key From Disk" and do it like that. But once that was done, the kernel module for the wifi driver loads and works under Secure Boot without any problems.

So signing and verifying and loading kernel modules in Secure Boot mode does work.

It looks as though the failure of mokutil is to do with some sort of motherboard/firmware bug with the X99 (as well as some other models, according to the Fedora bug report):

mokutil - failing for almost all options

https://bugzilla.redhat.com/show_bug.cgi?id=1263992

Here's some example output from mokutil on my machine:

alex@alex-dev-desktop:~$ mokutil --sb-state
SecureBoot enabled
alex@alex-dev-desktop:~$ sudo mokutil --password
input password: 
input password again: 
Failed to write MokPW: Invalid argument
alex@alex-dev-desktop:~$ sudo mokutil --import MOK.der 
SKIP: MOK.der is already enrolled
alex@alex-dev-desktop:~$ sudo mokutil --list-enrolled |grep Issuer
    Issuer: C=GB, ST=London, L=London, O=ghostaldev, CN=Secure Boot Signing/emailAddress=<my email>
    Issuer: C=GB, ST=Isle of Man, L=Douglas, O=Canonical Ltd., CN=Canonical Ltd. Master Certificate Authority
alex@alex-dev-desktop:~$ sudo mokutil --import SOMENEWKEY.der
input password: 
input password again: 
Failed to enroll new keys
alex@alex-dev-desktop:~$ sudo mokutil --disable-validation
password length: 8~16
input password: 
input password again: 
Failed to request new MokSB state
alex@alex-dev-desktop:~$ 

As shown, the key I used to sign my wifi driver is in the enrolled keys list, alongside Canonicals, but using mokutil to enrol keys doesn't work. It seems that all commands that write any data for controlling MokManager fail.

What I'm trying to do: Sign Virtualbox kernel modules so they run under Secure Boot

When I do sudo apt-get install virtualbox-dkms, I get a terminal GUI prompt telling me I am in secure boot mode, that modules need to be signed and keys enrolled, and asking me to set a password. Under the hood, the package installation looks like it's attempting to use mokutil, and in the output I see the Failed to enroll new keys message. Using hexdump, it looks as though the vboxdrv.ko module has been signed by some sort of key:

alex@alex-dev-desktop:~$ hexdump -e "16 \"%_p\" \"\\n\"" /lib/modules/4.15.0-58-generic/updates/vboxdrv.ko |tail -n 27 |head -n 5
......1..q0..m..
.0H001.0,..U...%
mint Secure Boot
 Module Signatur
e key..W+.0.x..(
alex@alex-dev-desktop:~$ 

I'm not sure what key is being used for this, but obviously it's not a working solution because it's not enrolled.

I'm looking for a workaround to get these kernel modules signed and loading up under Secure Boot. These are my ideas for potential workarounds (and why I'm stuck):

• Enrol the key used to sign the virtualbox modules (I don't know where to find this)
• Sign them myself with the key I have that is already enrolled (I've tried this, but it doesn't seem to work - I'm not sure if it's possible to sign a kernel module with multiple keys)
• Disable kernel module validation in shim (my understanding is that this is what the mokutil --disable-validation command is for, but it doesn't work, and when I start MokManager, I don't see an option available for this - only "Continue boot", "Enroll Key From Disk" and "Enroll Hash From Disk", no "Change Secure Boot State" option, as shown on this page, for example).

Would really appreciate some help here! :)