In the past, to install VirtualBox on Debian/Ubuntu you needed to sign some kernel modules, otherwise it would not work. The process involved creating a key pair, importing the public key as a MOK (Machine Owner Key) in the firmware, signing the modules with your private key, etc. If you didn't want to do this, and repeat the signing process every time there was an update, you had to disable Secure Boot in the firmware.
Now VirtualBox can be installed without having to follow all those steps. Why? It looks like VirtualBox is able to sign modules automatically, but I couldn't find much information online, except this dicussion on virtualbox.org, especially comment #9 and some of the following ones.
I'll quote some interesting parts from that discussion
Part of the problem is that any automatic way to sign kernel modules is probably only marginally safer than disabling signing altogether. Of course, it is hard to say for sure, just as it is hard to say for sure how much security benefit signing modules even provides, particularly on a desktop system.
This is fixed for Ubuntu as of the current 6.0 and trunk test builds<1>. The reason it was possible to do it for Ubuntu is that they already provide a mechanism of their own for use with DKMS modules. The problems I mentioned in my last comment still apply, but since Ubuntu has decided to provide this themselves this was their decision not ours.
I then checked on an Ubuntu system (where VirtualBox is also installed) and there's actually a private key at /var/lib/shim-signed/mok/MOK.priv, readable by everyone (permissions 644). In the same directory there's also a MOK.der key, which can be confirmed to be enrolled in the firmware by checking with mokutil --list-enrolled. I don't know how the key was enrolled in the firmware, I suppose it had to be accepted and confirmed (in the firmware interface) during the installation of VirtualBox, or at least I hope so (I don't think it is possible to add MOKs automagically from the OS). Anyway, since the private key is available to everyone, apparently everyone can sign kernel modules in this situation.
What I'm asking is:
- What are the security implications of this process? Is Secure Boot invalidated or weakened in this scenario? Should users act in any way to fix this problem (like moving, removing, or encrypting that private key, etc.)?
- Whose fault is it, really? Is it really Ubuntu/Debian's fault, for providing a way to automatically sign modules? Or is it VirtualBox's fault, for using an insecure practice (and leaving the private key there without explicitly warning users of the possible security implications)?
