0

I am trying to get virtualbox working on my machine with the pci-passthrough extension. When trying to run a VM, I got this error message:

Kernel driver not installed (rc=-1908)
[message asking me to install the vboxdrv kernel driver
by executing /sbin/vboxconfig as root]

So I did so and got this:

vboxdrv.sh: Stopping VirtualBox services.
vboxdrv.sh: Starting VirtualBox services.
vboxdrv.sh: Building VirtualBox kernel modules.
vboxdrv.sh: failed: modprobe vboxdrv failed. Please use 'dmesg' to find out why.

There were problems setting up VirtualBox.  To re-start the set-up process, run
  /sbin/vboxconfig
as root.

Looking at dmesg, the installation added no new entries.

Looking at the log file, it failed at the last module:

Building the main VirtualBox module.
Building the net filter module.
Building the net adaptor module.
Building the PCI pass-through module.

meaning that this is the code that fails in /usr/lib/virtualbox/vboxdrv.sh, called from /sbin/vboxconfig:

log "Building the PCI pass-through module."
if ! myerr=`$BUILDINTMP \
    --use-module-symvers /tmp/vboxdrv-Module.symvers \
    --module-source "$MODULE_SRC/vboxpci" \
    --no-print-directory install 2>&1`; then
    log "Error building the module:"
    module_build_log "$myerr"
    failure "Look at $LOG to find out what went wrong"
fi

where $BUILDINTMP points to the runnable file /usr/share/virtualbox/src/vboxhost/build_in_tmp

This is how far I got in troubleshooting, I don't know what to do next.

Some info:

  • IOMMU / VT-D is enabled
  • kernel version is 4.10.0-38-generic
  • OS is Linux Mint 18.3
  • as far as I can tell, the kernel headers are installed, "as far as I can tell" meaning that the path /lib/modules/4.10.0-38-generic/build/include/linux exists and is full of .h files and other subdirectories
  • Virtualbox is version 5.2.20
  • when I installed the PCI passthrough extension to VBox, it indicated a successful installation
Improve this question
2
  • The gist of the error message was: vboxdrv.sh: failed: modprobe vboxdrv failed. So what happens if you try sudo modprobe vboxdrv manually? Commented Nov 13, 2018 at 20:07
  • @telcoM modprobe: ERROR: could not insert 'vboxdrv': Required key not available It probably needs me to first built the module before trying to load it via modprobe. Maybe the sh file fails there because it can't even build it? Commented Nov 13, 2018 at 21:13

1 Answer 1

Reset to default
0

From the question comments:

modprobe: ERROR: could not insert 'vboxdrv': Required key not available

This indicates the module is already built, but it has not been signed to satisfy Secure Boot requirements.

The simplest workaround would be to just disable Secure Boot. This is especially true with VirtualBox 5.2, because:

  • it uses its own module build system instead of DKMS, and
  • as far as I know, it has no facilities to add module signing commands to its module build procedure

(I would really hope that future releases of VirtualBox would move to using DKMS or at least would provide hooks to allow tying custom scripts into the VirtualBox module installation procedure.)

The "proper" fix to this problem would be to create your own Secure Boot key, and use it to either take full control of the Secure Boot in your system firmware, or enroll it as a Machine Owner Key (a bootloader-level extension to Secure Boot) if that is not possible or is too difficult.

This can never be fully automated as such automation would be considered a Secure Boot circumvention device and would be included in UEFI revocation list by the UEFI Forum. This list gets embedded to new UEFI firmware versions. Fortunately, the enrollment is an one-time process.

Once the key has been enrolled to Secure Boot, you could use that key to sign the modules to make them acceptable to the system. You would have to repeat the module signing each time either the kernel or VirtualBox is updated.

According to Ubuntu documentation, you should be able to create a suitable key with sudo update-secureboot-policy --new-key and then enroll it as a Machine Owner Key (MOK) with sudo update-secureboot-policy --enroll-key and rebooting. At reboot, the shim.efi should automatically start the MokManager program, which will require you to confirm the enrollment of the Machine Owner Key, as only at boot time it can verify for sure that the input comes from the user and nowhere else. This is done to ensure that any customization of Secure Boot keys happens with the explicit control of the system owner/administrator.

Reinstallation of the operating system will not remove the MOK from the UEFI firmware variables, but a UEFI firmware upgrade or resetting of all the UEFI firmware settings to defaults might do that. In that case, you would need to redo the enrollment procedure.

Once the MOK has been successfully enrolled, the key should be automatically passed on to the kernel by the firmware, and can be used to sign the modules. VirtualBox 5.2 installs its modules to /lib/modules/<kernel version number>/misc/ directory. To sign the modules in there, you would use the kmodsign command. For example, to sign the vboxdrv.ko module:

cd /lib/modules/$(uname -r)/misc
kmodsign sha512 /var/lib/shim-signed/mok/MOK.priv /var/lib/shim-signed/mok/MOK.der vboxdrv.ko

Repeat this for each module you'll find in this directory. There should be at least four of them: vboxdrv.ko, vboxnetadp.ko, vboxnetflt.ko and vboxpci.ko.

Improve this answer
2
  • As I'm not particularly in risk and don't have very important data I couldn't just wipe if there was a problem, I just disabled secure boot for now. When I do the key enrolling, when should I make the new key? After building the module but before modprobe? Commented Nov 14, 2018 at 11:33
  • You can do the key creation and enrollment at any time, even before installing VirtualBox. The important thing is to have the key enrolled and available before starting VirtualBox, so that you can sign the modules after /sbin/vboxconfig compiles but fails to load them. Since module signing cannot easily be integrated into VirtualBox automatic module compilation, if you enable Secure Boot, you would see a VirtualBox error message at boot after each kernel update until you sign the modules again. Disabling Secure Boot is the more user friendly option in the specific case of VirtualBox 5.2. Commented Nov 14, 2018 at 11:49

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.