I've been having some problems managing the Secure Boot setup on my machine which has an Asus X99 motherboard.
I've successfully generated a MOK with
openssl, and then used it to sign the kernel module for my WiFi card (
wl.ko) and enrolled the key into
shim (if I understand correctly?) using MokManager. I got MokManager to run by adding an EFI boot record for it, and then using the EFI to start it at boot time. I couldn't get
mokutil to work though, and had to manually copy the key over to the
/boot partition, reboot, and choose "Enroll Key From Disk" and do it like that. But once that was done, the kernel module for the wifi driver loads and works under Secure Boot without any problems.
So signing and verifying and loading kernel modules in Secure Boot mode does work.
It looks as though the failure of
mokutil is to do with some sort of motherboard/firmware bug with the X99 (as well as some other models, according to the Fedora bug report):
Here's some example output from
mokutil on my machine:
alex@alex-dev-desktop:~$ mokutil --sb-state SecureBoot enabled alex@alex-dev-desktop:~$ sudo mokutil --password input password: input password again: Failed to write MokPW: Invalid argument alex@alex-dev-desktop:~$ sudo mokutil --import MOK.der SKIP: MOK.der is already enrolled alex@alex-dev-desktop:~$ sudo mokutil --list-enrolled |grep Issuer Issuer: C=GB, ST=London, L=London, O=ghostaldev, CN=Secure Boot Signing/emailAddress=<my email> Issuer: C=GB, ST=Isle of Man, L=Douglas, O=Canonical Ltd., CN=Canonical Ltd. Master Certificate Authority alex@alex-dev-desktop:~$ sudo mokutil --import SOMENEWKEY.der input password: input password again: Failed to enroll new keys alex@alex-dev-desktop:~$ sudo mokutil --disable-validation password length: 8~16 input password: input password again: Failed to request new MokSB state alex@alex-dev-desktop:~$
As shown, the key I used to sign my wifi driver is in the enrolled keys list, alongside Canonicals, but using
mokutil to enrol keys doesn't work. It seems that all commands that write any data for controlling MokManager fail.
What I'm trying to do: Sign Virtualbox kernel modules so they run under Secure Boot
When I do
sudo apt-get install virtualbox-dkms, I get a terminal GUI prompt telling me I am in secure boot mode, that modules need to be signed and keys enrolled, and asking me to set a password. Under the hood, the package installation looks like it's attempting to use
mokutil, and in the output I see the
Failed to enroll new keys message. Using
hexdump, it looks as though the
vboxdrv.ko module has been signed by some sort of key:
alex@alex-dev-desktop:~$ hexdump -e "16 \"%_p\" \"\\n\"" /lib/modules/4.15.0-58-generic/updates/vboxdrv.ko |tail -n 27 |head -n 5 ......1..q0..m.. .0H001.0,..U...% mint Secure Boot Module Signatur e key..W+.0.x..( alex@alex-dev-desktop:~$
I'm not sure what key is being used for this, but obviously it's not a working solution because it's not enrolled.
I'm looking for a workaround to get these kernel modules signed and loading up under Secure Boot. These are my ideas for potential workarounds (and why I'm stuck):
- Enrol the key used to sign the virtualbox modules (I don't know where to find this)
- Sign them myself with the key I have that is already enrolled (I've tried this, but it doesn't seem to work - I'm not sure if it's possible to sign a kernel module with multiple keys)
- Disable kernel module validation in
shim(my understanding is that this is what the
mokutil --disable-validationcommand is for, but it doesn't work, and when I start MokManager, I don't see an option available for this - only "Continue boot", "Enroll Key From Disk" and "Enroll Hash From Disk", no "Change Secure Boot State" option, as shown on this page, for example).
Would really appreciate some help here! :)