I upgrade from Ubuntu 15.10 to 16.04 and since then VirtualBox 5.0.18 isn't starting my VMs anymore. It complains that 'vboxdrv' isn't loaded. So I try to load it and get the following error:

$ sudo modprobe vboxdrv
modprobe: ERROR: could not insert 'vboxdrv': Required key not available

I believe it is related to secure boot which I use and which I want to continue using. Actually with Ubuntu 15.10 secure boot and VirtualBox were working just fine.

Also I tried $ sudo apt-get --reinstall install virtualbox-dkms which built the kernel module successfully but didn't solve this issue.

Any idea how to get vboxdrv loaded while keeping secure boot enabled?

Update 2: Also I tried executing sudo mokutil --disable-validation. When executing this command, during the next boot I get prompted to disable secure boot, add a key or hash from disk. Since I don't want to disable secure boot, it seems that this doesn't solve my issue either. Also I want to keep UEFI activated for a parallel Windows installation.

Note: If you don't mind disabling secure boot, see Why do I get "Required key not available" when install 3rd party kernel modules or after a kernel upgrade? instead.

Since kernel version 4.4.0-20, it was enforced that unsigned kernel modules will not be allowed to run with Secure Boot enabled. Because you want to keep Secure Boot, then the next logical step is to sign those modules.

So let's try it.

  1. Create signing keys

    openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -nodes -days 36500 -subj "/CN=Descriptive common name/"
    

    Option: for additional security, skip the -nodes switch, which will ask for a password. Then before moving on to the next step, make sure to export KBUILD_SIGN_PIN='yourpassword'

  2. Sign the module (vboxdrv for this example, but repeat for other modules in ls $(dirname $(modinfo -n vboxdrv))/vbox*.ko) for full functionality)

    sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der $(modinfo -n vboxdrv)
    
  3. Confirm the module is signed

    tail $(modinfo -n vboxdrv) | grep "Module signature appended"
    
  4. Register the keys to Secure Boot

    sudo mokutil --import MOK.der
    

    which will ask for a password to use to confirm the import in the next step.

  5. Reboot and follow instructions to Enroll MOK (Machine Owner Key). Here's a sample with pictures. The system will reboot one more time.

  6. Confirm the key is enrolled

    mokutil --test-key MOK.der
    

If VirtualBox still does not load, it may be because the module didn't load (sudo modprobe vboxdrv will fix that) or that the key is not signed. Simply repeat that step and everything should work fine.

Resources: Detailed website article for Fedora and Ubuntu implementation of module signing. @zwets for additional security. @shasha_trn for mentioning all the modules.

Additional resource: I created a bash script for my own use every time virtualbox-dkms upgrades and thus overwrites the signed modules. Check out my vboxsign on GitHub.

  • 7
    I also signed vboxnetadp, vboxnetflt, vboxpci modules to have network and pass throw pci devices in virtual machines. – sasha_trn May 7 '16 at 19:40
  • 8
    One addition for the security-conscious: the private key MOK.priv generated by openssl -nodes as above is not protected by a password. Thus in principle, a rogue program could use it to sign a compromised module or even taint the bootloader, as your signing key now sits in hardware storage as a trusted key. A more secure solution is to omit the -nodes option. In step 1 openssl will then ask for a password to protect the private key. Before step 2, when signing, set the KBUILD_SIGN_PIN environment variable to the password you specified in step 1. – zwets May 9 '16 at 10:08
  • 3
    Extending @majal's answer, I had to execute sudo apt install --reinstall virtualbox-dkms before following the instructions provided. – TylersSN Jun 13 '16 at 20:28
  • 1
    @zwets could you possibly elaborate on how to properly set the KBUILD_SIGN_PIN environmental variable? export KBUILD_SIGN_PIN=password and export KBUILD_SIGN_PIN="password" before step 2 both resulted in SSL error:0907B068:PEM routines:PEM_READ_BIO_PRIVATEKEY:bad password read: pem_pkey.c:117 – adempewolff Jul 9 '16 at 6:32
  • 3
    @adempewolff If you password contains characters that your shell will interpret (e.g. '$' in a quoted string), you will need to enclose it in apostrophes ('). – zwets Jul 11 '16 at 8:54

On my system I did the following to make it work:

Run mokutil:

sudo mokutil --disable-validation

Then mokutil asked me to set a password for the MOK Manager. After rebooting the PC the BIOS showed a dialog to configure the MOK Manager. I disabled SecureBoot from this dialog, it asked for several characters from the password (ie. enter character (5), etc).

After booting up the vboxdrv modules loaded correctly.

lsmod | grep vboxdrv
vboxdrv               454656  3 vboxnetadp,vboxnetflt,vboxpci

Curiously, mokutil still shows SecureBoot is enabled:

sudo mokutil --sb-state
SecureBoot enabled
  • 3
    As stated in my question, I want to continue using secure boot. So disabling secure boot doesn't solve the issue. – jans Apr 26 '16 at 18:30
  • Didn't want to disable secure boot but in the end had to do this since nothing else would work - don't want to start signing things manually every time a kernel update comes.. Pity this is the only easy solution forward. Btw, UEFI still says secure boot is enabled. ¯_(ツ)_/¯ – jaywink May 18 '16 at 8:42

You can disable the validation check by

sudo apt install mokutil
sudo mokutil --disable-validation

After that DKMS packages should install.

  • 2
    Also I tried executing sudo mokutil --disable-validation. When executing this command, during the next boot I get prompted to disable secure boot, add a key or hash from disk. Since I don't want to disable secure boot, it seems that this doesn't solve my issue either. Please let me know in case I misunderstood this command. – jans Apr 26 '16 at 18:28
  • 2
    Try to disable secure boot. You can enable it back, if that does not help. – Pilot6 Apr 26 '16 at 22:02
  • I tried to disable secure boot - but it is still enabled :( (ubuntu 18.04) – xhudik Oct 2 at 9:45

I got error about vboxdrv after upgrade too. But there was problem with old version (5.0.14) of Oracle VM VirtualBox Extension Pack. I downloaded and installed newer version (5.0.18) of this pack and problem disappeared.

  • Hey, could you please elaborate? Where did you download it from? PPA or deb file? – Karthik Nishanth Apr 23 '16 at 4:34
  • 1
    I downloaded Extension pack from downloads on VirtualBox site, link is "VirtualBox 5.0.18 Oracle VM VirtualBox Extension Pack -> All supported platforms". Then I opened File > Preferences on Oracle VM Virtual Box Manager, selected "Extensions", and added downloaded file to list. It replaced old version of "Oracle VM VirtualBox Extension Pack" (was 5.0.14rxxxxxx). – Reling Apr 24 '16 at 7:11
  • Extension pack doesnt rectify the error. The error is about signing the module – Karthik Nishanth Apr 25 '16 at 15:43
  • This doesn't apply to my problem. – jans Apr 26 '16 at 18:24
  • 1
    This is unrelated to the problem of the OP. The error message "Required key not available" indicates that the issue is due to an unsigned kernel module on a Secure Boot enabled platform. No VirtualBox update can fix this unless it includes a module signed using a key trusted by the kernel. I.e. either Canonical must sign it, or Oracle must sign it and its public key must be added to the kernel's (or your platform's) trusted keys. – zwets May 9 '16 at 8:04

Alright so after a bit of testing I'm pretty sure this is a secure boot issue.

As in if it's enabled then this is thrown:

WARNING: The vboxdrv kernel module is not loaded. Either there is no module available for the current kernel (4.4.0-21-generic) or it failed to load. Please recompile the kernel module and install it by sudo /sbin/rcvboxdrv setup

However if secure boot is disabled then virtualbox loads just fine with no errors.

I still have my bios set as UEFI.

  • 3
    As stated in my question, I want to continue using secure boot. So disabling secure boot doesn't solve the issue. – jans Apr 26 '16 at 18:25

I had the same issue today, I had Windows 10 and Ubuntu 15.10 on a dual boot with uefi enabled on Bios (I didn't disable it so I can run the pre-installed Windows).

After upgrading to Ubuntu 16.04 VirtualBox stopped loading my VMs with the same error message:

modprobe: ERROR: could not insert 'vboxdrv': Required key not available

I suspected UEFI issue because while upgrading the installer asked me if I want to disable it, to which I responded No (Because Yes may make my Windows unusable).

What I did is going to Bios and enable support for legacy BIOS boot WITHOUT disabling secure boot.

Virtualbox works fine now.

Update: As @zwets rightly pointed in the comment, enabling legacy modules causes secure boot to be disabled.

  • 2
    Actually I also need UEFI to boot a parallel Windows installation. So disabling it isn't an option for me either. I updated my question accordingly. – jans Apr 26 '16 at 18:26
  • Have you enabled Support for legacy BIOS modules? This is another option in UEFI bios, different than secure boot. – Zeine77 Apr 26 '16 at 18:50
  • 1
    @Zeine77 can you verify that your BIOS allows enabling "legacy modules" while Secure Boot remains enabled? This is highly unlikely, as the first option allows untrusted code to run in kernel space, which defeats the purpose of the second. – zwets May 9 '16 at 8:11
  • @zwets you are right, I just checked my bios settings; and enabling legacy modules caused secure boot to be disabled. I assumed, as explained in the response, that disabling secure boot would cause Windows 10 boot to fail, this isn't the case. When I first installed 15.10 (Months ago) I took care to not disable secure boot as this would damage Win 10 installation. Does this mean that the pre installed Win 10 works fine with secure mode disabled ? – Zeine77 May 10 '16 at 2:22

protected by Community Jul 24 '16 at 13:17

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.