6

So i am on a debian buster 10 system and i installed virtualbox and i encountered an error which tells me to load some kernel modules manually.

sudo ./vboxconfig 
[sudo] password for user:
vboxdrv.sh: Stopping VirtualBox services.
vboxdrv.sh: Starting VirtualBox services.
vboxdrv.sh: You must sign these kernel modules before using VirtualBox:
 vboxdrv vboxnetflt vboxnetadp
See the documenatation for your Linux distribution..
vboxdrv.sh: Building VirtualBox kernel modules

So i just need some help to load the vboxdrv, vboxnetflt and vboxnetadp kernel modules to complete my virtual box installation and i am not too sure how this is done. I am using a UEFI system which has secure boot enabled.

1 Answer 1

8

There are three steps involved in signing modules:

The first two steps only need to be done once, the last will need to be redone every time the modules are built.

To create a MOK:

openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -days 36500 -subj "/CN=My Name/" -nodes

replacing My Name with something appropriate. (The following instructions assume you run this as root, in root’s home directory, /root.)

To enroll it:

mokutil --import MOK.der

This will prompt for a password, which is a temporary password used on the next boot only. Reboot your system, and you will enter the UEFI MOK management tool; see this handy guide with screenshots and follow the instructions to enroll your key.

This will reboot again, and you will then be able to check that your key is loaded:

dmesg | grep cert

To sign modules with your key, go to the directory containing the modules, and run

/usr/lib/linux-kbuild-4.19/scripts/sign-file sha256 /root/MOK.priv /root/MOK.der vboxdrv.ko

replacing “4.19” and vboxdrv.ko as appropriate.

10
  • Hi thanks for the help but what did you mean when you said "The first two steps only need to be done once, the last will need to be redone every time the modules are built."
    – programmer
    Commented Jan 9, 2020 at 21:27
  • You only need to enrol your key once, but you need to sign your modules whenever they change: when a new kernel is installed, or when a new version of VirtualBox is installed. Commented Jan 9, 2020 at 21:49
  • I have enrolled the keys successfully and I have also signed the modules to the keys and followed your steps, but it still does not allow me to start virtualbox, I only got it to start when I manually loaded the kernel modules with insmod *.ko Any ideas why?
    – programmer
    Commented Jan 9, 2020 at 21:52
  • Did you run vboxconfig after signing the modules? Commented Jan 10, 2020 at 10:27
  • 1
    @Shawn have you tried stripping before signing? Commented Mar 9, 2022 at 18:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .