I'm not sure if the Virtualbox version from the repository of my Linux distribution is already signed and works right away, but since it's not up-to-date I'm installing Virtualbox from the official repository of Virtualbox itself (virtualbox.org). This version does not work if I leave secure boot enabled, and apparently it's because the vboxdrv module is not signed. The question is: is there a correct way to sign it that doesn't compromise the security of the system?
The procedure explained here for example involves generating a pair of keys that will be used to sign the module: https://stegard.net/2016/10/virtualbox-secure-boot-ubuntu-fail/
I noticed at least two aspects that might be questionable:
- By signing the module myself, I would basically be trusting it automatically at once and that's it. Maybe I should actually follow some other steps before signing it, to make sure I'm actually signing something that I have good reason to trust.
- It sounds like the module will have to be signed again every time there's a kernel update, and that method uses a very simple script for convenience. However, that script relies on the fact that the private key is stored on the machine (in that example, at /root/module-signing/MOK.priv). Malware or an attacker with elevated privileges would be able to sign their own modules with my key. I guess the private key used for signing should not be stored on the machine, right?
I would like to avoid pitfalls and solve this problem in the correct way.