Ticket #11577 (new defect)

Opened 6 years ago

Last modified 4 weeks ago

Secure Boot doesn't allow 'vboxdrv' module to load (now works for Ubuntu and Debian 10+ hosts)

Reported by: quickbooks Owned by:
Component: other Version: VirtualBox 4.2.8
Keywords: Cc:…
Guest type: all Host type: Linux


Host - Fedora 18 64 bit Bios has Secure Boot enabled.

When I try to start any machine it says:

Kernel driver not installed (rc=-1908)

The VirtualBox Linux kernel driver (vboxdrv) is either not loaded or there is a permission problem with /dev/vboxdrv. Please reinstall the kernel module by executing

'/etc/init.d/vboxdrv setup'

as root. If it is available in your distribution, you should install the DKMS package first. This package keeps track of Linux kernel changes and recompiles the vboxdrv kernel module if necessary.
[user@localhost ~]$ sudo /etc/init.d/vboxdrv setup
[sudo] password for user: 
Stopping VirtualBox kernel modules                         [  OK  ]
Uninstalling old VirtualBox DKMS kernel modules            [  OK  ]
Trying to register the VirtualBox kernel modules using DKMS[  OK  ]
Starting VirtualBox kernel modules                         [FAILED]
  (modprobe vboxdrv failed. Please use 'dmesg' to find out why)

[user@localhost ~]$ sudo modprobe vboxdrv
modprobe: ERROR: could not insert 'vboxdrv': Required key not available

Change History

comment:1 Changed 6 years ago by quickbooks

[user@localhost ~]$ sudo virtualbox
[sudo] password for user: 
WARNING: The vboxdrv kernel module is not loaded. Either there is no module
         available for the current kernel (3.8.2-206.fc18.x86_64) or it failed to
         load. Please recompile the kernel module and install it by

           sudo /etc/init.d/vboxdrv setup

         You will not be able to start VMs until this problem is fixed.

comment:2 Changed 6 years ago by frank

  • priority changed from blocker to major

This is not really a VirtualBox bug. Oracle cannot sign kernel modules using the Fedora key. See also the  Fedora FAQ in this regards.

comment:3 Changed 4 years ago by marcmerlin

If I build my own kernel with signed modules, I have the key, dkms builds the virtualbox modules on my laptop which has the kernel source and my signing key. Can you enhance the dkms script to use /usr/src/linux-xxx/signing_key.* and sign the modules if those files are present?


comment:4 Changed 4 years ago by bryanhundven

This is still an issue on Fedora 22, I cannot disable secure boot on my workstation. The change marcmerlin suggested would work.

comment:5 Changed 3 years ago by khatkarrohit

Still a major problem on Ubuntu 16.04.

Version 0, edited 3 years ago by khatkarrohit (next)

comment:6 Changed 3 years ago by Jdot

im having problems too on Ubuntu 16.04 using VirtualBox 5.1.6. when will this be sorted?

comment:7 Changed 14 months ago by equalitytech

Same problem today Ubuntu 17.10.

I can sign the libraries, but still the installer doesn't work.


for modfile in $(dirname $(modinfo -n vboxdrv))/*.ko; do
  echo "Signing $modfile"
  /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 \
                                /root/module-signing/MOK.priv \
                                /root/module-signing/MOK.der "$modfile"


Verifying archive integrity... All good.
Uncompressing VirtualBox for Linux installation.............
VirtualBox Version 5.2.13 r122773 (2018-05-24T09:58:29Z) installer
Removing previous installation of VirtualBox 5.2.13 r122773 from /opt/VirtualBox
Installing VirtualBox to /opt/VirtualBox
Python found: python, installing bindings...
Created symlink /etc/systemd/system/ → /lib/systemd/system/vboxdrv.service.                                    
Created symlink /etc/systemd/system/ → /lib/systemd/system/vboxballoonctrl-service.service.
Created symlink /etc/systemd/system/ → /lib/systemd/system/vboxautostart-service.service.
Created symlink /etc/systemd/system/ → /lib/systemd/system/vboxweb-service.service. failed: modprobe vboxdrv failed. Please use 'dmesg' to find out why.

There were problems setting up VirtualBox.  To re-start the set-up process, run
as root.

VirtualBox has been installed successfully.

You will find useful information about using VirtualBox in the user manual
and in the user FAQ

We hope that you enjoy using VirtualBox.

The installation log file is at /var/log/vbox-install.log.

tail /var/log/vbox-install.log

VirtualBox 5.2.13 r122773 installer, built 2018-05-24T09:58:29Z.

Testing system setup...
Removing previous installation of VirtualBox 5.2.13 r122773 from /opt/VirtualBox Stopping VirtualBox services. Building VirtualBox kernel modules. Starting VirtualBox services. Building VirtualBox kernel modules.

comment:8 Changed 12 months ago by DiegoRivera

I applied the following workaround for Ubuntu Bionic (18.04). I'm sure it'll also work for Artful (17.10) and Zesty (17.04). Possibly even further back in time. This is based on systemd's RequiredBy capability, shim and mokutils. Please note that you'll need to have MOK keys already created and enrolled, otherwise there won't be anything to sign the modules with.

First, create the following systemd unit as /etc/systemd/system/ensure-vboxdrv-signed.service:

Description=Ensure the VirtualBox Linux kernel modules are signed



The above unit is meant to be executed before vboxdrv.service (i.e. before the VirtualBox startup service is run), and be required by it (i.e. can't load the service if driver sigining fails).

Then, create the following script and store it as /usr/bin/ensure-vbox-signed:



if ! "${MOKUTIL}" --sb-state | grep -qi '[[:space:]]enabled$' ; then
	echo "WARNING: Secure Boot is not enabled, signing is not necessary"
	exit 0

# If secure boot is enabled, we try to find the signature keys
[ -f "${KEY}" ] || { echo "ERROR: Couldn't find the MOK private key at ${KEY}" ; exit 1 ; }
[ -f "${PUB}" ] || { echo "ERROR: Couldn't find the MOK public key at ${PUB}" ; exit 1 ; }

INFO="$("${MODINFO}" -n vboxdrv)"
if [ -z "${INFO}" ] ; then
	# If there's no such module, compile it
	/usr/lib/virtualbox/ setup
	INFO="$("${MODINFO}" -n vboxdrv)"
	if [ -z "${INFO}" ] ; then
		echo "ERROR: Module compilation failed (${MODPROBE} couldn't find it after was called)"
		exit 1

[ -z "${KVER}" ] && KVER="$(uname -r)"

DIR="$(dirname "${INFO}")"

for module in "${DIR}"/vbox*.ko ; do
	MOD="$(basename "${module}")"

	# Quick check - if the module loads, it needs no signing
	echo "Loading ${MOD}..."
	"${MODPROBE}" "${MOD}" && continue

	# The module didn't load, and it must have been built (above), so it needs signing
	echo "Signing ${MOD}..."
	if ! "${KDIR}/scripts/sign-file" sha256 "${KEY}" "${PUB}" "${module}" ; then
		echo -e "\tFailed to sign ${module} with ${KEY} and ${PUB} (rc=${?}, kernel=${KVER})"
		exit 1

	echo "Reloading the signed ${MOD}..."
	if ! "${MODPROBE}" "${MOD}" ; then
		echo -e "\tSigned ${MOD}, but failed to load it from ${module}"
		exit 1
	echo "Loaded the signed ${MOD}!"
exit 0

All that said, grafting a modified version of the above code into the '/usr/lib/virtualbox/' script to be executed during module installation (check to see if signed, if not then sign) and compilation (sign immediately after compiling) would also do the trick.

Another solution could be to port the entire thing to DKMS and leverage the existing infrastructure, but that's probably far too much work at this point (which is likely why it hasn't been done).

So, for now, you can use the above workaround. This should work fine in other Linux distributions that also use systemd and mokutil. Please note that the path that the service unit needs to be created in may change for different Linux distributions.

Good luck!


Last edited 12 months ago by DiegoRivera (previous) (diff)

comment:9 Changed 12 months ago by michael

Part of the problem is that any automatic way to sign kernel modules is probably only marginally safer than disabling signing altogether. Of course, it is hard to say for sure, just as it is hard to say for sure how much security benefit signing modules even provides, particularly on a desktop system.

comment:10 Changed 4 weeks ago by michael

This is fixed for Ubuntu as of the current 6.0 and trunk test builds<1>. The reason it was possible to do it for Ubuntu is that they already provide a mechanism of their own for use with DKMS modules. The problems I mentioned in my last comment still apply, but since Ubuntu has decided to provide this themselves this was their decision not ours.


Last edited 4 weeks ago by michael (previous) (diff)

comment:11 Changed 4 weeks ago by michael

  • Summary changed from Secure Boot doesn't allow 'vboxdrv' module to load - Required key not available to Secure Boot doesn't allow 'vboxdrv' module to load (now works for Ubuntu and Debian 10+ hosts)

Please note that I am not marking this as fixed, just mentioning that the special case of Ubuntu and Debian 10+ hosts now works.

comment:12 Changed 4 weeks ago by michael

A suggestion for anyone who wants this fixed for other host distributions: ask your distributions to provide a mechanism we can use. If the mechanism is compatible with Ubuntu's one then it will be automatically supported, as we only check for the mechanism, not the distribution.

comment:13 Changed 4 weeks ago by michael

If it helps anything, this is the change:

Note: See TracTickets for help on using tickets.
ContactPrivacy policyTerms of Use