3

I'm running a dual boot (Linux and Windows 7) on two separate disks, with grub2 as the bootloader.

I've spent many hours over the past few months trying to find a way to enrol keys and sign modules for Secure Boot using mokutil. I have a question open here where I've detailed the problem and all the ways I've tried that I can think of to solve it, but with little response I really feel like I've reached a dead end.

I've found many examples that seem to indicate that this is a common problem with ASUS boards:

In the first question above, @larrysb says:

It appears to be a UEFI bug in the motherboard. Some other UEFI/BIOS also fail to implement one of the methods required for mokutil to work. I also have an issue with an Asus X99-E USB3.1 mobo.

They suggest manually signing the module and enrolling the key, which I've tried to do but something is still not right, as it just doesn't seem to work - the module is still disallowed.

At this point, I'm feeling like it would just be easier to buy a new board that supports Secure Boot and mokutil, rebuild the machine, and rely on the auto-enrolment and signing of modules provided by the package installer. But I have no idea how to be sure a board implements the necessary firmware methods.

What motherboards fully support mokutil? Is there a list?

1
  • What OS/release are you running? The other page you mention contains a paste from a non-Ubuntu module, and we support Ubuntu and official flavors of Ubuntu - not generic Linux or Linux Mint askubuntu.com/help/on-topic (You'll also note shopping recommendations are to be avoided as off-topic) – guiverc Nov 22 '19 at 1:56
0

I can fully sympathise with the difficulties you have had, I spent months trying to find a complete guide to installing VirtualBox on a UEFI system with Secure Boot enabled and I wanted to keep Secure Boot enabled and of the few guides out there, I couldn't get any to work and mostly all of them advised to disable Secure Boot and I didn't want to an in any case its not possible to Disable Secure Boot on my system (Acer) and I believe the ASUS is the same int that you cant disable Secure Boot and you shouldn't have to. I also had some UEFI processor bug, it reported it at startup? once I removed Windows and installed Ubuntu, curious I thought since I never had any UEFI bug while Windows was installed and why should I it is a brand new laptop, I put it down to Microsoft and the manufacturer, trying to put people off migrating away from Windows, this so called bug didn't have any bearing on my Ubuntu or VirtualBox installation and never prevented my registering the MOK keys. I mean following other instructions I was never presented with any MOK screens after a reboot and at first thought it was the so called bug but it wasn't. If I recall I reinstalled Windows and I updated my BIOS firmware and that was only to ensure I had the latest firmware as a precaution, before migrating to Ubuntu and I am sure the firmware update didn't make any difference and I kept seeing the UEFI bug on startup, but this so called bug has magically disappeared after Kernel updates.

The only difference for me is that I never use dual boot and the whole point of installing VirtualBox was that if I need to use Windows, I would have it installed in a guest virtual machine. When I installed I was using VirtualBox 6.0 and my kernel version 4.18.0-25-generic and since I have upgraded up to 5.0.0-36-generic and Ubuntu 18.04.3 and I have also since upgraded VirtualBox to version 6.0.14 and I have never had to resign the modules, or had any issues, I think at some point possibly from v6.0.10 onwards I am told you don't have to sign the modules manually but I found it useful to know anyway. Here is what I did:

Installing Oracle Virtualbox 6.0 on UEFI System with Secure Boot enabled

Instructons for 64 bit debian based linux distributions only, in this particular case I am using ubuntu 18.04.02 (bionic).

1. Install Virtualbox from the Oracle repositories (The advantage of installing from Oracle repositories is that Virtualbox automatically updates along with system updates). Add the Oracle VirtualBox repository to your the list of repositories using this command:

sudo add-apt-repository "deb [arch=amd64] http://download.virtualbox.org/virtualbox/debian <dist> contrib"

replace <dist> in the above command with your distribution from the following:   
 bionic     (18.04) 
 artful     (17.10)   
 zesty      (17.04)   
 yakkety    (16.10  
 xenial     (16.04)   
 wily       (15.10)  
 vivid      (15.04)   
 utopic     (14.10)   

So if your system is bionic (18.04) the command is:

sudo add-apt-repository "deb [arch=amd64] http://download.virtualbox.org/virtualbox/debian bionic contrib"  

1.2 Download and register the OracleVirtualbox GPG keys by issuing the commands: (GPG keys allow you to verify and communicate with the VirtualBox repository)

wget –q https://www.virtualbox.org/download/oracle_vbox_2016.asc -O- | sudo apt-key add -
wget -q https://www.virtualbox.org/download/oracle_vbox.asc -O- | sudo apt-key add –

2. Signing the virtualbox modules and registering the MOK key

2.1. Create the public and private keys by first running the following command to create a directory (folder) in your home drive to store the keys:

mkdir ~/keys

2.2 Now run the following command to generate the public and private keys

openssl req -new -x509 -newkey rsa:2048 -keyout ~keys/MOK.priv -outform DER -out ~keys/MOK.der -nodes -days 36500 -subj "/CN=\Vbox"

NB: Mok keys using the above command are output to /keys/ run the command ls -al ~/keys/ to see the mok keys were generated successfully

2.3. Sign the virtualbox modules with the public and private keys (uname -r substututes your linux kernel version e.g. 4.18.0-25-generic) so you don't have to find it and add it into the command manually

sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ~/keys/MOK.priv ~/keys/MOK.der $(modinfo -n vboxdrv)
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ~/keys/MOK.priv ~/keys/MOK.der $(modinfo -n vboxnetflt)
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ~/keys/MOK.priv ~/keys/MOK.der $(modinfo -n vboxnetadp)
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ~/keys/MOK.priv ~/keys/MOK.der $(modinfo -n vboxpci)

2.4. Import the MOK’s (Machine Owner Keys) to Secure Boot. (Note: The MOK Util will ask for a password)

sudo mokutil --import MOK.der

2.5. Reboot and follow instructions to Enroll MOK.

enter image description here

enter image description here

enter image description here

enter image description here

enter image description here

2.6. Confirm the MOK is enrolled. Type the following command in a terminal

$ cd ~/keys
$ mokutil --test-key MOK.der
MOK.der is already enrolled

Not the answer you're looking for? Browse other questions tagged or ask your own question.