4

I am having problems to get virtualbox5.1 working on ubuntu 16.10 with uefi secure boot enabled, this to start with my selfstudy of vagrant and further :). So I am hoping, someone can help me to pinpoint the problem or direct me in the right way.

I researched the web a lot, and came to this procedure, but it is not working for me, when I do a "sudo modinfo vboxdrv", i am missing the signature info.

I will show the output, I think is relevant. If you need more info, feel free to tell me:

uname -r
4.8.0-26-generic

dpkg -S sign-file
linux-headers-4.8.0-22-generic: /usr/src/linux-headers-4.8.0-22-generic/scripts/.sign-file.cmd
linux-headers-4.8.0-26-generic: /usr/src/linux-headers-4.8.0-26-generic/scripts/.sign-file.cmd
linux-headers-4.8.0-26: /usr/src/linux-headers-4.8.0-26/scripts/sign-file.c
linux-headers-4.8.0-22-generic: /usr/src/linux-headers-4.8.0-22-generic/scripts/sign-file
linux-headers-4.8.0-26-generic: /usr/src/linux-headers-4.8.0-26-generic/scripts/sign-file
linux-headers-4.8.0-22: /usr/src/linux-headers-4.8.0-22/scripts/sign-file.c
linux-headers-4.8.0-22-generic: /usr/src/linux-headers-4.8.0-22-generic/scripts/sign-file.c
linux-headers-4.8.0-26-generic: /usr/src/linux-headers-4.8.0-26-generic/scripts/sign-file.c

cd .ssh

openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -days 36500 -subj "/CN=computername.module.signing@gmail.com"

“enter my password twice”, since I omitted the -nodes (extra security ;])

chmod 600 MOK.priv

export KBUILD_SIGN_PIN=”p4$$w<>rD” (not the real password off-course:])

-rw-------  1 username username 1834 Okt 21 14:44 MOK.priv
-rw-r--r--  1 username username  837 Okt 21 14:44 MOK.der
-rwx------  1 username username 1113 Okt 21 15:20 signscript

for f in $(dirname $(modinfo -n vboxdrv))/*.ko; do echo "Signing $f"; sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der $f; done

Signing /lib/modules/4.8.0-26-generic/misc/vboxdrv.ko
At main.c:161:
- SSL error:0907B068:PEM routines:PEM_READ_BIO_PRIVATEKEY:bad password read: pem_pkey.c:117
sign-file: ./MOK.priv: Success
Signing /lib/modules/4.8.0-26-generic/misc/vboxnetadp.ko
At main.c:161:
- SSL error:0907B068:PEM routines:PEM_READ_BIO_PRIVATEKEY:bad password read: pem_pkey.c:117
sign-file: ./MOK.priv: Success
Signing /lib/modules/4.8.0-26-generic/misc/vboxnetflt.ko
At main.c:161:
- SSL error:0907B068:PEM routines:PEM_READ_BIO_PRIVATEKEY:bad password read: pem_pkey.c:117
sign-file: ./MOK.priv: Success
Signing /lib/modules/4.8.0-26-generic/misc/vboxpci.ko
At main.c:161:
- SSL error:0907B068:PEM routines:PEM_READ_BIO_PRIVATEKEY:bad password read: pem_pkey.c:117
sign-file: ./MOK.priv: Success

sudo mokutil --import MOK.der

I reboot the computer and succesfully enroll the certificate. When I verify if vboxdrv got signed:

sudo modinfo vboxdrv
    filename:       /lib/modules/4.8.0-26-generic/misc/vboxdrv.ko
    version:        5.1.8 r111374 (0x00280000)
    license:        GPL
    description:    Oracle VM VirtualBox Support Driver
    author:         Oracle Corporation
    srcversion:     0194E56703167BB8828186F
    depends:         jjjjjjjjjjjjjjjjj
    vermagic:       4.8.0-26-generic SMP mod_unload modversions 
    parm:           force_async_tsc:force the asynchronous TSC mode (int)

The module isn't signed as I am MISSING info from this output:

signer: something
sig_key: 11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11:11
sig_hashalgo: sha256

To make sure that I didn't make an error, I used this script: https://github.com/Majal/maj-scripts/blob/master/vboxsign

#!/bin/bash
# Sign and load VirtualBox modules
# Run as root
[ "`whoami`" = root ] || exec sudo "$0" "$@"
# Set working directory
dir=/home/username/.ssh
cd $dir
# (Optional) Setting env KBUILD_SIGN_PIN for encrypted keys
printf "Please enter key passphrase (leave blank if not needed): "; read -s
export KBUILD_SIGN_PIN="$REPLY"
# (Optional) Decrypt private key. To initially encrypt, run `gpg -c MOK.priv` then shred MOK.priv
#gpg -d --batch --passphrase-file /owned/by/root/.pass MOK.priv.gpg > MOK.priv
echo
# Sign and load modules
for module in vboxdrv vboxnetflt vboxnetadp vboxpci; do
 [ "`hexdump -e '"%_p"' $(modinfo -n $module) | tail | grep signature`" ] && echo -e "\e[93mModule $module is already signed. Skipping.\e[0m" || /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der $(modinfo -n $module)
 printf "$module: "
 echo `hexdump -e '"%_p"' $(modinfo -n $module) | tail | grep signature`
 modprobe $module && echo -e "\e[92m$module successfully loaded\e[0m" || echo -e "\e[91mFailed to load $module\e[0m"
 done
# (Optional) Shred private key
echo
#shred -vfuz MOK.priv

unfortunately without success, I even get SSL errors, but the sign-file script tells me it was signed succesfully "sign-file: ./MOK.priv: Success"

At main.c:161:
- SSL error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt: evp_enc.c:529
- SSL error:23077074:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 cipherfinal error: p12_decr.c:108
- SSL error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error: p12_decr.c:139
- SSL error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib: pem_pkey.c:141
sign-file: ./MOK.priv: Success
vboxpci: 
modprobe: ERROR: could not insert 'vboxpci': Required key not available
Failed to load vboxpci

when i do:

sudo /sbin/vboxconfig

Created symlink /etc/systemd/system/multi-user.target.wants/vboxdrv.service → /lib/systemd/system/vboxdrv.service.
Created symlink /etc/systemd/system/multi-user.target.wants/vboxballoonctrl-service.service → /lib/systemd/system/vboxballoonctrl-service.service.
Created symlink /etc/systemd/system/multi-user.target.wants/vboxautostart-service.service → /lib/systemd/system/vboxautostart-service.service.
Created symlink /etc/systemd/system/multi-user.target.wants/vboxweb-service.service → /lib/systemd/system/vboxweb-service.service.
vboxdrv.sh: Building VirtualBox kernel modules.
vboxdrv.sh: Starting VirtualBox services.
vboxdrv.sh: Building VirtualBox kernel modules.
vboxdrv.sh: failed: modprobe vboxdrv failed. Please use 'dmesg' to find out why.

There were problems setting up VirtualBox.  To re-start the set-up process, run
  /sbin/vboxconfig
as root.

"sudo dmesg | grep vbox" is empty, though

I know it is a lot of info, but I hope someone could help me, or point me in the right direction.

this is a clean install, so I can play around, if needed :)

2

Your provided output is shows a password error during the signing process of each module:

Signing /lib/modules/4.8.0-26-generic/misc/vboxdrv.ko
At main.c:161:
- SSL error:0907B068:PEM routines:PEM_READ_BIO_PRIVATEKEY:bad password read: pem_pkey.c:117

The problem is that the password is never reaching OpenSSL. You specify the password with an environment variable for the current user:

export KBUILD_SIGN_PIN=”p4$$w<>rD”

But then when you run the signing script a few lines down, you are using sudo to run it in the root environment instead of the user's environment:

sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der $f

The script is run as root, and the KBUILD_SIGN_PIN variable is not in the root environment, so the script cannot access KBUILD_SIGN_PIN.

One could fix this by putting the environment variable after sudo, to make sure it is set in the root environment:

sudo KBUILD_SIGN_PIN="p4$$w<>rD" /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der $f
  • Thank you for your explanation. I am running ubuntu server on this machine now, but your answer will provide to be useful for anyone in the future, trying to get this to work! (or even me, at some point again ;)) – Sybie Jul 6 '17 at 12:43
0

The easiest solution is to disable Secure Boot. It is possible to sign the kernel modules using your own key and then register that key, but I don't know the details of the process.

  • thanks for your input Rod, however, I prefer not to disable secureboot. The procedure to signing one's kernel, should be in the line of what I did, with the exception of me, most likely, overlooking something, causing it, not to work. – Sybie Oct 22 '16 at 7:20
0

When you add the MOK to shim

 mokutil --import MOK.der
  • Note the passphrase you give.
  • Reboot and following the menu, enroll the key with this passphrase

After key enrollment in rebooting, the MOK is valid for signing vbox modules.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.