Skip to content

Instantly share code, notes, and snippets.

View Mark42XLII's full-sized avatar

Mark42XLII Mark42XLII

View GitHub Profile

Signing VirtualBox Kernel Modules

These are the steps I followed enable VirtualBox on my laptop without disabling UEFI Secure Boot. They're nearly identical to the process described on [Øyvind Stegard's blog][blog], save for a few key details. The images here are borrowed from the [Systemtap UEFI Secure Boot Wiki][systemtap].

  1. Install the VirtualBox package (this might be different for your platform).
    src='https://download.virtualbox.org/virtualbox/rpm/fedora/virtualbox.repo'
@Mark42XLII
Mark42XLII / dkms-kmod-auto-mok-signing.md
Created May 30, 2021 15:43 — forked from lijikun/dkms-kmod-auto-mok-signing.md
Automatic Signing of DKMS-Generated Kernel Modules for Secure Boot

Automatic Signing of DKMS-Generated Kernel Modules for Secure Boot (Nvidia Driver on CentOS 8 as Example)

First I thank Nvidia for sponsoring the video card.

Secure Boot isn't exactly easy to configure to work with Linux and disabling it isn't really a good idea. Many modern Linux distributions provide the Microsoft-signed shim EFI binary to interpose between Secure Boot and the grub2 bootloader, making booting Linux easy enough if you only ever use kernels and drivers from the official repos. Still, enabling Secure Boot prevents the loading of kernel or modules without a proper digital signature. For example, the propriatary Nvidia GPU driver won't work, unless your distro really went to great lengths to distribute a signed version of the kernel module.

To make Secure Boot play nicely with the driver (i.e. to work at all), we can generate and import a Machine Owner Key (MOK)