Gfilui

As many others, I need to run a Windows instance from Virtualbox, don't want to disable Secure Boot, and therefore have problems in making Virtualbox work after kernel updates.

I have already run through the necessary steps, but something must have gone wrong. At present, Virtualbox runs if I disable secure boot, but freezes the whole system as soon as I try to run a VM (which at the moment is in an interrupted state) when secure boot is enabled.

I checked the following:

• I have generated a certificate (with -subj "/CN=MyName/"). A MOK.der is there, and I enrolled it (mokutil --list-enrolled shows it with another from Canonical). In fact if I try another mokutil -n import MOK.der, I get the output SKIP: MOK.der is already enrolled
  


• 
  

  I am able to sign virtualbox modules by this script:

  
  
  

  <!-- language: bash -->
  #!/bin/bash
  for modfile in $(dirname $(modinfo -n vboxdrv))/vbox*.ko; do
   echo "Signing $modfile"
   /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 
   /root/module-signing/MOK.priv 
   /root/module-signing/MOK.der "$modfile"
  done
  

  
  


• 
  

  ... and I can check that they are all signed:

  
  
  

  $ grep "MyName" $(dirname $(modinfo -n vboxdrv))/vbox*.ko 
  Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxdrv.ko corrisponde
  Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxnetadp.ko corrisponde
  Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxnetflt.ko corrisponde
  Il file binario /lib/modules/4.13.0-37-generic/updates/dkms/vboxpci.ko corrisponde
  

  
  



• In fact I can load the modules from command line, with no error messages:
  $ for modfile in $(dirname $(modinfo -n vboxdrv))/vbox*.ko; do modprobe $(basename -s .ko $modfile); done




• Nevertheless, I can't find my certificate among those known at BIOS level: None of mokutil --pk , mokutil --kek, mokutil --db, includes "MyName" in the output (but some of them include "Canonical")

So, the questions:

• Where is the enrolled MOK stored if not in the PK, DB, or KEK? (in fact the modules can be loaded). Which name should I search for in my BIOS utility?


• What is the shim?


• I have dkms package installed, and only recently installed also virtualbox-dkms. Are these packages needed or not? In which sequence should I install them? before or after the above procedure? Or should they rather do the whole of it, instead of leaving it to be done by me manually?


• Should I rather try uninstalling virtualbox, dkms, virtualbox-dkms (etc?) and redo the procedure from scratch?


• 
  

  What of the above remains applicable fopr the rest of the modules in the /lib/modules/4.13.0-37-generic/updates/dkms directory (namely bbswitch and nvidia*)? In fact, from the System Settings menu, under System/Software & Updates I see that the Nvidia 384.111 proprietary driver is being used, but then I can neither see it by lsmod | grep nvidia nor modprobe it:

  
  
  

  $ modprobe nvidia_384
  modprobe: ERROR: could not insert 'nvidia_384': Required key not available
  

  
  

Is the situation inconsistent? Where to start from to fix it?

Thanks