5

With Debian testing and SecureBoot enabled:

I need to sign VirtualBox modules, as the output of the vboxconfig command says:

vboxdrv.sh: Stopping VirtualBox services.
vboxdrv.sh: Starting VirtualBox services.
vboxdrv.sh: You must sign these kernel modules before using VirtualBox:
  vboxdrv vboxnetflt vboxnetadp
See the documenatation for your Linux distribution..
vboxdrv.sh: Building VirtualBox kernel modules.
vboxdrv.sh: failed: modprobe vboxdrv failed. Please use 'dmesg' to find out why.

There were problems setting up VirtualBox.  To re-start the set-up process, run
  /sbin/vboxconfig
as root.  If your system is using EFI Secure Boot you may need to sign the
kernel modules (vboxdrv, vboxnetflt, vboxnetadp, vboxpci) before you can load
them. Please see your Linux system's documentation for more information.

Following the Debian Wiki about SecureBoot I did:

# openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -days 36500 -subj "/CN=My Name/" -nodes

# mokutil --import MOK.der // prompts for one-time password

# mokutil --list-new // recheck your key will be prompted on next boot

<rebooting machine then enters MOK manager EFI utility: enroll MOK, continue, confirm, enter password, reboot>

# dmesg | grep cert // verify your key is loaded

and signed the modules:

# /usr/src/linux-headers-5.7.0-1-amd64/scripts/sign-file sha256 /root/MOK.priv /root/MOK.der /lib/modules/5.7.0-1-amd64/misc/vboxdrv.ko

# /usr/src/linux-headers-5.7.0-1-amd64/scripts/sign-file sha256 /root/MOK.priv /root/MOK.der /lib/modules/5.7.0-1-amd64/misc/vboxnetflt.ko

# /usr/src/linux-headers-5.7.0-1-amd64/scripts/sign-file sha256 /root/MOK.priv /root/MOK.der /lib/modules/5.7.0-1-amd64/misc/vboxnetadp.ko

Note: I didn't signed the module vboxpci becuse with sudo modinfo -n vboxpci it can't be finded:

modinfo: ERROR: Module vboxpci not found.

After that if I try to execute again vboxconfig (as root too) I have the same result, as it can't be loads modules:

vboxdrv.sh: Stopping VirtualBox services.
vboxdrv.sh: Starting VirtualBox services.
vboxdrv.sh: You must sign these kernel modules before using VirtualBox:
  vboxdrv vboxnetflt vboxnetadp
See the documenatation for your Linux distribution..
vboxdrv.sh: Building VirtualBox kernel modules.
vboxdrv.sh: failed: modprobe vboxdrv failed. Please use 'dmesg' to find out why.

There were problems setting up VirtualBox.  To re-start the set-up process, run
  /sbin/vboxconfig
as root.  If your system is using EFI Secure Boot you may need to sign the
kernel modules (vboxdrv, vboxnetflt, vboxnetadp, vboxpci) before you can load
them. Please see your Linux system's documentation for more information.

NOTE: If I try to load module myself with sudo modprobe vboxdrv I have an error too that says:

modprobe: ERROR: could not insert 'vboxdrv': Operation not permitted

And dmesg command says that the modules aren't signed:

[   35.668028] Lockdown: modprobe: unsigned module loading is restricted; see https://wiki.debian.org/SecureBoot
[   59.965757] Lockdown: modprobe: unsigned module loading is restricted; see https://wiki.debian.org/SecureBoot
[  247.249605] Lockdown: modprobe: unsigned module loading is restricted; see https://wiki.debian.org/SecureBoot

How can I do??? Without disable SecureBoot?

Improve this question

2 Answers 2

Reset to default
4

I had the same issue following the same procedure and couldn't figure out why it wasn't working, then i realized that the issue was running again vboxconfig after signing the modules since it would trigger the kernel modules rebuild: " vboxdrv.sh: Building VirtualBox kernel modules."

At that point i just signed the modules and loaded them using modprobe and they got loaded with no problem.

Don't worry you don't need to manually load the modules every time since the first time you ran vboxconfig took care of setting thing s up already, just reboot and be fine ( at least that worked for me ) Cheers

Improve this answer
1
  • What steps did you use?
    – Chaim Eliyah
    Commented Apr 7, 2021 at 5:54
1

With Fedora 34 and VirtualBox 6.1.22 the steps are as follows:

  1. Build VirtualBox modules sudo /sbin/vboxconfig

  2. Install openssl sudo dnf install openssl

  3. Create key and enroll it

openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -days 36500 -subj "/CN=My Name/" -nodes

sudo mokutil --import MOK.der

echo "Please reboot the machine"

  1. Reboot and make sure to enroll the key in the BIOS. You will need the password chosen at step (3)

  2. Sign VirtualBox kernel modules

sudo /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der /lib/modules/$(uname -r)/misc/vboxdrv.ko
sudo /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der /lib/modules/$(uname -r)/misc/vboxnetadp.ko
sudo /usr/src/kernels/$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der /lib/modules/$(uname -r)/misc/vboxnetflt.ko
  1. Load VirtualBox kernel modules
sudo modprobe vboxdrv
sudo modprobe vboxnetadp
sudo modprobe vboxnetflt

Start VirtualBox and it should work.

Improve this answer
3
  • sudo modprobe vboxdrv modprobe: ERROR: could not insert 'vboxdrv': Key was rejected by service
    – Edward Williams
    Commented Jul 19, 2021 at 5:58
  • Is mokutil supposed to ask for a passcode?
    – Edward Williams
    Commented Jul 19, 2021 at 5:59
  • I think openssl asks for a passcode in step (3)
    – robertspierre
    Commented Jul 19, 2021 at 10:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .