After upgrade to F42, I cannot load VirtualBox drivers signed modules in the kernel (SecureBoot)

artu72 · April 18, 2025, 2:04pm

Hi, VirtualBox does not longer work after upgrade from F41 to F42 (and Secure Boot enabled). I have installed it from rpmfusion repository. In F41, at each kernel upgrade I had to sign again the modules (vboxdrv, vboxnetadp and vboxnetflt) using a private key enabled in EFI by means of mokutil tool, and the kernel was able to load modules.

In F42 instead the procedure does not work and the kernel (6.14.2) won’t load modules, even if they have been signed. I have also regenerated the key used to sign modules and installed in the EFI.

Any suggest? I attach here the script I have used to generate EFI key:

openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.d
er -nodes -days 36500 -subj "/CN=VirtualBox/"
chmod 600 MOK.priv
mokutil --import MOK.der

and I sign them by the following command

/usr/src/kernels/$(uname -r)/scripts/sign-file sha256 /root/module-sig
n/MOK.priv /root/module-sign/MOK.der vboxdrv.ko

graphizs · April 18, 2025, 2:23pm

If I read it correctly, you were able to sign your modules on F42 again with mokutil, right?

If no, then you may suffer from the same issue I have. Try mokutil --sb-state and see what it says. If it says This system doesn't support Secure Boot., then you won’t be able to sign your kernel modules via mokutil until further notice.

If yes, did upgraded RPMFusion’s repo to 42 too? As far as I know, they have repo’s for each specific version. Maybe this helps.

artu72 · April 18, 2025, 2:32pm

No, I was able to sign modules. The problem is that the kernel won’t load signed modules. Here is the output of a verbose modprobe command:

# modprobe -vv vboxdrv 
modprobe: INFO: libkmod/libkmod.c:391 kmod_set_log_fn() custom logging function 0x564add166cf0 registered
insmod /lib/modules/6.14.2-300.fc42.x86_64/extra/VirtualBox/vboxdrv.ko.xz 
modprobe: INFO: libkmod/libkmod-module.c:973 kmod_module_insert_module() Failed to insert module '/lib/modules/6.14.2-300.fc42.x86_64/extra/VirtualBox/vboxdrv.ko.xz': Invalid argument
modprobe: ERROR: could not insert 'vboxdrv': Invalid argument
modprobe: INFO: libkmod/libkmod.c:358 kmod_unref() context 0x564b11506560 released

Of course, I have upgraded RPM Fusion repository to release 42:

# dnf repolist
...
rpmfusion-free                    RPM Fusion for Fedora 42 - Free               
rpmfusion-free-tainted            RPM Fusion for Fedora 42 - Free tainted       
rpmfusion-free-updates            RPM Fusion for Fedora 42 - Free - Updates     
rpmfusion-nonfree                 RPM Fusion for Fedora 42 - Nonfree            
rpmfusion-nonfree-updates         RPM Fusion for Fedora 42 - Nonfree - Updates

I have Secure Boot still enabled:

# mokutil --sb-state
SecureBoot enabled

My issue is however different. You have Secure Boot set to disabled. In my system it is still enabled, but it won’t load signed drivers.

graphizs · April 18, 2025, 2:36pm

That’s the thing: I didn’t disabled it. When I was on F41, it was activated and worked as expected with kmodgenca and mokutil. And after the upgrade to F42, it got disabled automatically and I can’t turn it back on because it says “This system doesn't support Secure Boot”, which is weird and can’t be right. And Secure Boot is (still) activated in my UEFI settings.

artu72 · April 18, 2025, 2:57pm

That’s very odd. I wish you can find and solve the issue.

vekruse · April 18, 2025, 3:06pm

Did you sign all three modules? They are

vboxdrv
vboxnetadp
vboxnetflt

Normally the akmods procedure would take care of all that if you use the package from Rpmfusion.

For information about how this works, read /usr/share/doc/akmods/README.secureboot.

artu72 · April 18, 2025, 3:30pm

Yes, I have signed all three modules. I have enrolled also akmods keys as described in the file you have cited ( README.secureboot). I have also verified that, after having forced akmod to rebuild vboxdrv and other modules, they have been signed with proper key by means of kernel script extract-mod-sig.pl. But the kernel still refuses to load modules. It seems that there is a problem in the kernel loading process since enrolling and signing phases are fine.

artu72 · April 18, 2025, 4:49pm

/etc/pki/akmods/certs/public_key.der is already enrolled

serial=425D38178D0F0C395867EAA402138E484F7267DB

425D38178D0F0C395867EAA402138E484F7267DB
425D38178D0F0C395867EAA402138E484F7267DB
425D38178D0F0C395867EAA402138E484F7267DB

× vboxdrv.service - Linux kernel module init script
     Loaded: loaded (/usr/lib/systemd/system/vboxdrv.service; enabled; preset: enabled)
    Drop-In: /usr/lib/systemd/system/service.d
             └─10-timeout-abort.conf, 50-keep-warm.conf
     Active: failed (Result: exit-code) since Fri 2025-04-18 17:51:39 CEST; 57min ago
 Invocation: 52560866c7044d3b82ff7a16173119dc
    Process: 1407 ExecStart=/sbin/modprobe vboxdrv (code=exited, status=1/FAILURE)
   Main PID: 1407 (code=exited, status=1/FAILURE)
   Mem peak: 1.3M
        CPU: 5ms

apr 18 17:51:39 andymema systemd[1]: Starting vboxdrv.service - Linux kernel module init script...
apr 18 17:51:39 andymema modprobe[1407]: modprobe: ERROR: could not insert 'vboxdrv': Invalid argument
apr 18 17:51:39 andymema systemd[1]: vboxdrv.service: Main process exited, code=exited, status=1/FAILURE
apr 18 17:51:39 andymema systemd[1]: vboxdrv.service: Failed with result 'exit-code'.
apr 18 17:51:39 andymema systemd[1]: Failed to start vboxdrv.service - Linux kernel module init script.

artu72 · April 18, 2025, 5:02pm

Perhaps I have already set this, if this is equivalent to /etc/default/grub line


GRUB_CMDLINE_LINUX="rhgb quiet kvm.enable_virt_at_load=0"

cbr84 · April 19, 2025, 3:41pm

Hello everyone,

as a small hint with the change to Fedora 42 please note:

Only sha512 signed modules are accepted in the kernel config “/boot/config-6.14.2-300.fc42.x86_64”:

# CONFIG_MODULE_SIG_SHA256 is not set
CONFIG_MODULE_SIG_SHA512=y
CONFIG_MODULE_SIG_HASH="sha512”
CONFIG_MODULE_COMPRESS=y
CONFIG_MODULE_COMPRESS_XZ=y

Unfortunately, this does not fix the error “decompression failed with status 6” in dmesg, but it could be a step in the right direction.

The script for signing should be adapted as follows:

/usr/src/kernels/$(uname -r)/scripts/sign-file sha512 /root/module-sig
n/MOK.priv /root/module-sign/MOK.der vboxdrv.ko

Best regards

leigh123linux · April 19, 2025, 4:28pm

The decompression issue was fixed a while back in kmodtool, does dkms also compress the modules?

cbr84 · April 19, 2025, 8:00pm

Thanks a lot, that’s the solution.

Now i have modify this script ^[1] for Fedora 42 environment:

#!/bin/sh

#Until Fedora41:
#readonly hash_algo='sha256'
#Since Fedora42:
readonly hash_algo='sha512'
readonly key='/path/to/MOK.priv'
readonly x509='/path/to/MOK.der'

readonly name="$(basename $0)"
readonly esc='\\e'
readonly reset="${esc}[0m"

green() { local string="${1}"; echo "${esc}[32m${string}${reset}"; }
blue() { local string="${1}"; echo "${esc}[34m${string}${reset}"; }
log() { local string="${1}"; echo "[$(blue $name)] ${string}"; }

# The exact location of `sign-file` might vary depending on your platform.
alias sign-file="/usr/src/kernels/$(uname -r)/scripts/sign-file"

[ -z "${KBUILD_SIGN_PIN}" ] && read -p "Passphrase for ${key}: " KBUILD_SIGN_PIN
export KBUILD_SIGN_PIN

for module in $(dirname $(modinfo -n vboxdrv))/*.ko.xz; do
    if [[ $(basename "${module}" .xz) != "${module}" ]]; then
    log "decompress module ${module}"
    xz -d ${module}
    fi
    path=$(dirname "${module}")
    decompressed=$(basename "${module}" .xz)
    log "Signing $(green ${module})..."
    /usr/src/kernels/$(uname -r)/scripts/sign-file "${hash_algo}" "${key}" "${x509}" "${path}/${decompressed}"
    #sign-file "${hash_algo}" "${key}" "${x509}" "${path}/${decompressed}"
    if [[ $(basename "${module}" .xz) != "${module}" ]]; then
    log "recompress module ${module}"
    #Until Fedora41: 
    #xz "${path}"/"${decompressed}"
    #Since Fedora42:
    xz --compress --check=crc32 --lzma2=dict=1MiB "${path}"/"${decompressed}" 
    fi
done

It works for me. Good luck to everyone else.

Best regards

gist.github.com

https://gist.github.com/reillysiemens/ac6bea1e6c7684d62f544bd79b2182a4?permalink_comment_id=4286632#gistcomment-4286632

signing-vbox-kernel-modules.md

# Signing VirtualBox Kernel Modules

These are the steps I followed enable VirtualBox on my laptop **without
disabling UEFI Secure Boot**. They're nearly identical to the process described
on [Øyvind Stegard's blog][blog], save for a few _key_ details. The images here
are borrowed from the [Systemtap UEFI Secure Boot Wiki][systemtap].

1. Install the VirtualBox package (this might be different for your platform).
   ```bash
   src='https://download.virtualbox.org/virtualbox/rpm/fedora/virtualbox.repo'

Diese Datei wurde abgeschnitten. Original zeigen

↩︎

artu72 · April 20, 2025, 7:59am

Thank you very much! This is the correct solution:

replace sha256 with sha512
add flags --check=crc32 --lzma2=dict=1MiB to xz compress command.

I have simply modified following two lines in my script:

/usr/src/kernels/$(uname -r)/scripts/sign-file sha512 /root/module-sign/MOK.priv /root/module-sign/MOK.der  "${module_basename}"
          xz --compress --check=crc32 --lzma2=dict=1MiB -f ${module_basename}

and now it works like a charm!

I suppose that the RPM akmod-VirtualBox needs to be fixed in this way, correct? Pehaps the RPM akmods also?

leigh123linux · April 20, 2025, 8:10am

akmods uses kmodtool so were fixed by my commit.

artu72 · April 20, 2025, 8:13am

I suppose that only rpmfusion akmod-VirtualBox package has to be fixed then.

leigh123linux · April 20, 2025, 9:25am

No, it’s fixed by the kmodtool commit

artu72 · April 20, 2025, 6:03pm

So, why does inserting akmod generated module in kernel give error, even if akmod keys have been enrolled in EFI BIOS?

leigh123linux · April 22, 2025, 6:17am

Maybe you have been affected by this upgrade issue, did you use discovery or gnome-software or system-upgrade.

sudo depmod -ae

artu72 · April 22, 2025, 7:23am

Yes, I have used dnf system-upgrade to upgrade Fedora from 41 to 42 release.

After executing depmod -ae and rebuilding VirtualBox module (akmods --rebuild), now the vboxdrv module is loaded wihtout error. Thank you.

CONCLUSION

if using self-signed modules, the solution is to add proper flags to sign and compress the module, as suggested by Chris (post #13, my procedure is in post #14)
if using akmod generated modules after an upgrade, a depmod followed by rebuilding modules fixes the issue, as reported by Leigh (post #19).

Topic		Replies	Views
Problem using signed kernel module Ask Fedora f29	1	1430	May 10, 2019
Virtualbox not working Ask Fedora f38 , virtualization , virtualbox	30	7119	September 10, 2023
Trouble signing kernel modules for Virtualbox Ask Fedora f34	2	7017	September 15, 2021
Virtualbox vboxdrv kernel module not loaded Ask Fedora f34 , kernel	12	21494	March 15, 2022
VMware kernel module updater; fedora 36 Ask Fedora f36 , vmware	2	3918	April 27, 2022

After upgrade to F42, I cannot load VirtualBox drivers signed modules in the kernel (SecureBoot)

Related topics