It has been difficult for me to figure out how to get virtualbox to work with Secure Boot. However, I have found a process that seems to work for me. I am documenting this process so that it might help other people. I am also documenting the process so that other people who are more knowledgeable than me can comment on what I did and provide suggestions on better ways to do this.
Host: Zorin OS 18.0
Requirements:
- Secure boot should be enabled.
- Virtualbox should already be installed and have Whonix Gateway/Workstations imported.
- You should have a USB stick which you are willing to wipe and keep safe for the sole purpose of managing the signing keys that you are going to create.
- You should have a password manager installed on your computer, such as KeePassXC,
Step 1: Create a USB stick.
- Enter the USB stick into a port on your ZorinOS 18 computer.
- Install USB Stick Formatter from the ZorinOS repositories (Note, this might not be strictly necessary, but it is what I did).
sudo apt install mintstick- Use USB Stick Formatter to make a new USB. Call it MOK-KEYS and format it in the ext4 filesystem.
Step 2: Encrypt the USB stick
- Open up the Disks program that comes pre-installed in ZorinOS 18.
- Select your external USB.
- Unmount the partition on the USB.
- Go to the gear icon (additional partition options), and click on format partition.
- Enter the volume name MOK-KEYS.
- Select the type as “Internal disk for use with Linux systems only (Ext4).”
- Underneath that, select the option to “Password protect volume (LUKS).”
- Select next, and password-protect the volume with a strong password generated by your password manager. Continue, and the program will format your USB stick to be encrypted and password-protected.
Step 3: Make your MOK keys.
Re-mount your encrypted USB. Open up a terminal. We are going to enter the following commands one at a time.
sudo mkdir -p /media/user/MOK-KEYS/mok/sudo openssl req -nodes -new -x509 -newkey rsa:4096 -outform DER -addext "extendedKeyUsage=codeSigning" -keyout /media/user/MOK-KEYS/mok/MOK.priv -out /media/user/MOK-KEYS/mok/MOK.derThere will be fields to enter, but you can leave some blank. Make something up that is memorable and will help you distinguish these keys from the other signing certificates on your system. Come up with a memorable organization name (for example, Wayne Enterprises).
Step 4: Enroll your MOK keys.
sudo mokutil --import /media/user/MOK-KEYS/mok/MOK.derThe software will ask you to create a password for importing the key later, during the boot process. As far as I am aware, this is a one-time password. But I could be wrong. Choose something, and write it down on a piece of paper.
Reboot the computer.
During the boot process, you’ll see the MOK manager screen. This will look different depending on your hardware, so these steps might vary.
- Select “Enroll MOK”.
- Choose “Continue”.
- Enter the password you set when importing the key.
- Select “Yes” to confirm enrolling the key.
Step 5: Sign the VirtualBox Modules
After rebooting and enrolling the MOK, sign the required VirtualBox kernel modules.
- First, plug in your encrypted USB and enter your password to unlock and mount it.
- Then, locate the Virtualbox kernel modules (usually in /lib/modules/$(uname -r)/).
cd /lib/modules/$(uname -r)/updates/dkmsThen uncompress the kernel modules
sudo zstd -d vboxdrv.ko.zst
sudo zstd -d vboxnetadp.ko.zst
sudo zstd -d vboxnetflt.ko.zstThen sign the modules.
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 /media/user/MOK-KEYS/mok/MOK.priv /media/user/MOK-KEYS/mok/MOK.der vboxdrv.ko
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 /media/user/MOK-KEYS/mok/MOK.priv /media/user/MOK-KEYS/mok/MOK.der vboxnetadp.ko
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 /media/user/MOK-KEYS/mok/MOK.priv /media/user/MOK-KEYS/mok/MOK.der vboxnetflt.koSee:
Now delete the original .zst files.
sudo rm vboxdrv.ko.zst vboxnetadp.ko.zst vboxnetflt.ko.zstThen recompress the modules that you signed.
sudo zstd vboxdrv.ko vboxnetadp.ko vboxnetflt.koFinally, load the signed modules:
sudo modprobe vboxdrv
sudo modprobe vboxnetflt
sudo modprobe vboxnetadpIf this does not work, you may need to reinstall virtualbox-dkms and go through step 5 again.
sudo apt install virtualbox-dkmsStep 6: Store your USB in a safe place
Store your USB in a safe place. You may or may not need to have it plugged in when you update your kernel. Otherwise, keep the USB unplugged from your computer. That way, if a hacker gets access to your system, they will not be able to use these keys in order to sign malicious modules. You may want to label the USB so that you remember which USB you stored the keys on.
