Virtual Box on Fedora 19 fails to start a VM

edit

With the pending EOL status of Fedora 19, I decided to give this problem another go.

I ended up creating my own public/private key pair and adding the public key to the MOK (Machine-Owner-Key)-chain of shim.

The kernel loads these keys at boot time.

Finally, by signing the kenel module files of virtual box with my private key, I can launch VirtualBox on my EFI system.

1. List currently loaded keys:

$ sudo keyctl list %:.system_keyring
5 keys in keyring:
87094    8     9: ---lswrv  0 0 asymmetric: Fedora kernel signing key: 9a0182fa6694d373f36bde1c99594e0e42ac8f9f
10640     6     48: ---lswrv 0 0 asymmetric: Fedora Secure Boot CA: fde32599c2d61db1bf5807335d7b20e4cd963b42
23     9    543: ---lswrv 0 0 asymmetric: Acer: c4f0474ae6b5e67a509d99132f49a4ec13f7ac68
3152    52    312: ---lswrv 0 0 asymmetric: Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4
43107    9    814: ---lswrv 0 0 asymmetric: Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53

These were loaded at kernel boot time:

$ dmesg | grep 'EFI: Loaded cert'
[    0.719111] EFI: Loaded cert 'Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53' linked to '.system_keyring'
[    0.719120] EFI: Loaded cert 'Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4' linked to '.system_keyring'
[    0.719149] EFI: Loaded cert 'Acer: c4f0474ae6b5e67a509d99132f49a4ec13f7ac68' linked to '.system_keyring'
[    0.730021] EFI: Loaded cert 'Fedora Secure Boot CA: fde32599c2d61db1bf5807335d7b20e4cd963b42' linked to '.system_keyring'

2. Create private/public key pair from a configuration file:

a. Create the folder where to put the keys (can be anywhere).

mkdir ~/x509; cd ~/x509

b. Create the configuration file (don't forget to personalize):

$ cat << EOF > configuration_file.config
[ req ]
days = 36500
default_bits = 4096
#specify the section defining the requested distinguished name
distinguished_name = maarten
prompt = no
string_mask = utf8only
#Specify the section that defines extensions to add to a self-signed certificate.
x509_extensions = myexts
encrypt_key = no

[ maarten ]
countryName = be
organizationName = Maarten Inc
commonName = Maarten
emailAddress = maarten@xxx.com

[ myexts ]
basicConstraints=critical,CA:FALSE
keyUsage=digitalSignature
subjectKeyIdentifier=hash
authorityKeyIdentifier=keyid
EOF

c. Generate the private/public key (store them somewhere safely !!!):

$ openssl req -x509 -new -utf8 -sha256 -batch -config configuration_file.config -outform DER -out public_key.der -keyout private_key.priv

3. In the previous step, you have generated your private/public key pair. We will now add them to the mok list. You will be asked a password. Remember it, as it will be used to confirm the MOK request.

$ sudo mokutil --import my_signing_key_pub.der

4. Reboot the machine

 $ sudo shutdown -r now

5. At boot time, shim.efi will notice the newly added key and will launch MokManager.efi.

MokManager.efi will request to enter your previously entered password.

6. Once booted, your key pair has been succesfully added to the key ring of the kernel.

$ sudo keyctl list %:.system_keyring

6 keys in keyring:
870942879: ---lswrv     0     0 asymmetric: Fedora kernel signing key: 9a0182fa6694d373f36bde1c99594e0e42ac8f9f
1064026748: ---lswrv     0     0 asymmetric: Fedora Secure Boot CA: fde32599c2d61db1bf5807335d7b20e4cd963b42
6557317: ---lswrv     0     0 asymmetric: maarten: Organization signing key: e121670995ff9ea405426aa201e651eee7242316
2399543: ---lswrv     0     0 asymmetric: Acer: c4f0474ae6b5e67a509d99132f49a4ec13f7ac68
315252312: ---lswrv     0     0 asymmetric: Microsoft Corporation UEFI CA 2011: 13adbf4309bd82709c8cd54f316ed522988a1bd4
431079814: ---lswrv     0     0 asymmetric: Microsoft Windows Production PCA 2011: a92902398e16c49778cd90f99e4f9ae17c55af53

7. I ended up signing the ... (more)