I'm not sure if the Virtualbox version from the repository of my Linux distribution is already signed and works right away, but since it's not up-to-date I'm installing Virtualbox from the official repository of Virtualbox itself (virtualbox.org). This version does not work if I leave secure boot enabled, and apparently it's because the vboxdrv module is not signed. The question is: is there a correct way to sign it that doesn't compromise the security of the system?

The procedure explained here for example involves generating a pair of keys that will be used to sign the module: https://stegard.net/2016/10/virtualbox-secure-boot-ubuntu-fail/

I noticed at least two aspects that might be questionable:

  • By signing the module myself, I would basically be trusting it automatically at once and that's it. Maybe I should actually follow some other steps before signing it, to make sure I'm actually signing something that I have good reason to trust.
  • It sounds like the module will have to be signed again every time there's a kernel update, and that method uses a very simple script for convenience. However, that script relies on the fact that the private key is stored on the machine (in that example, at /root/module-signing/MOK.priv). Malware or an attacker with elevated privileges would be able to sign their own modules with my key. I guess the private key used for signing should not be stored on the machine, right?

I would like to avoid pitfalls and solve this problem in the correct way.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.