3

I've been having some problems managing the Secure Boot setup on my machine which has an Asus X99 motherboard.

I've successfully generated a MOK with openssl, and then used it to sign the kernel module for my WiFi card (bcmwl-kernel-source/wl.ko) and enrolled the key into shim (if I understand correctly?) using MokManager. I got MokManager to run by adding an EFI boot record for it, and then using the EFI to start it at boot time. I couldn't get mokutil to work though, and had to manually copy the key over to the /boot partition, reboot, and choose "Enroll Key From Disk" and do it like that. But once that was done, the kernel module for the wifi driver loads and works under Secure Boot without any problems.

So signing and verifying and loading kernel modules in Secure Boot mode does work.

It looks as though the failure of mokutil is to do with some sort of motherboard/firmware bug with the X99 (as well as some other models, according to the Fedora bug report):

mokutil - failing for almost all options

https://bugzilla.redhat.com/show_bug.cgi?id=1263992

Here's some example output from mokutil on my machine:

alex@alex-dev-desktop:~$ mokutil --sb-state
SecureBoot enabled
alex@alex-dev-desktop:~$ sudo mokutil --password
input password: 
input password again: 
Failed to write MokPW: Invalid argument
alex@alex-dev-desktop:~$ sudo mokutil --import MOK.der 
SKIP: MOK.der is already enrolled
alex@alex-dev-desktop:~$ sudo mokutil --list-enrolled |grep Issuer
    Issuer: C=GB, ST=London, L=London, O=ghostaldev, CN=Secure Boot Signing/emailAddress=<my email>
    Issuer: C=GB, ST=Isle of Man, L=Douglas, O=Canonical Ltd., CN=Canonical Ltd. Master Certificate Authority
alex@alex-dev-desktop:~$ sudo mokutil --import SOMENEWKEY.der
input password: 
input password again: 
Failed to enroll new keys
alex@alex-dev-desktop:~$ sudo mokutil --disable-validation
password length: 8~16
input password: 
input password again: 
Failed to request new MokSB state
alex@alex-dev-desktop:~$ 

As shown, the key I used to sign my wifi driver is in the enrolled keys list, alongside Canonicals, but using mokutil to enrol keys doesn't work. It seems that all commands that write any data for controlling MokManager fail.

What I'm trying to do: Sign Virtualbox kernel modules so they run under Secure Boot

When I do sudo apt-get install virtualbox-dkms, I get a terminal GUI prompt telling me I am in secure boot mode, that modules need to be signed and keys enrolled, and asking me to set a password. Under the hood, the package installation looks like it's attempting to use mokutil, and in the output I see the Failed to enroll new keys message. Using hexdump, it looks as though the vboxdrv.ko module has been signed by some sort of key:

alex@alex-dev-desktop:~$ hexdump -e "16 \"%_p\" \"\\n\"" /lib/modules/4.15.0-58-generic/updates/vboxdrv.ko |tail -n 27 |head -n 5
......1..q0..m..
.0H001.0,..U...%
mint Secure Boot
 Module Signatur
e key..W+.0.x..(
alex@alex-dev-desktop:~$ 

I'm not sure what key is being used for this, but obviously it's not a working solution because it's not enrolled.

I'm looking for a workaround to get these kernel modules signed and loading up under Secure Boot. These are my ideas for potential workarounds (and why I'm stuck):

  • Enrol the key used to sign the virtualbox modules (I don't know where to find this)
  • Sign them myself with the key I have that is already enrolled (I've tried this, but it doesn't seem to work - I'm not sure if it's possible to sign a kernel module with multiple keys)
  • Disable kernel module validation in shim (my understanding is that this is what the mokutil --disable-validation command is for, but it doesn't work, and when I start MokManager, I don't see an option available for this - only "Continue boot", "Enroll Key From Disk" and "Enroll Hash From Disk", no "Change Secure Boot State" option, as shown on this page, for example).

Would really appreciate some help here! :)

5
  • What version of Virtualbox are you running? According to this page - linuxuprising.com/2019/07/… - you don't need to manually sign the modules anymore (as of v6.0.10). – ajgringo619 Sep 15 '19 at 23:23
  • I'm using 6.x. But, as described in that link, "The reason it was possible to do it for Ubuntu is that they already provide a mechanism of their own for use with DKMS modules." I assume he's referring to mokutil, but this isn't working for me. – Alex Sep 19 '19 at 12:43
  • 1
    askubuntu.com/questions/949033/… I have Asus Sabertooth 990FX R2 and had same problem. Follow last post explaining how to add the mokmanager to the boot process : grub-install --uefi-secure-boot Just be sure to disable CSR i your firmware first, I had that problem too. – Steen Heile Christensen Oct 8 '19 at 8:28
  • Thanks for your comment @SteenHeileChristensen - but what is CSR? And why would it cause a problem? I couldn't find anything in my UEFI/BIOS control panel named anything like that. Might it be called something different in the X99 control panel? – Alex Nov 22 '19 at 1:35
  • What OS/release are you running? I see mention of "mint', but no reference to Ubuntu or official flavors of Ubuntu. askubuntu.com/help/on-topic (my own Ubuntu derived vboxdrv.ko does not contain any mention of Mint! as it has Ubuntu in it's place) – guiverc Nov 22 '19 at 1:55