Kernel Modules – Fix ‘Required Key Not Available’ Error When Installing Kernel Modules

dkmskernelsecure-bootuefi

This issue happens only on UEFI systems with enabled Secure Boot.

When I try to install DKMS modules like VirtualBox, Nvidia, or Broadcom drivers, they do not install and I get Required key not available when I try to modprobe them.

VirtualBox complains that vboxdrv is not loaded.

Broadcom wl driver is shown in lspci -k as a kernel module but is not in use. sudo modprobe wl throws Required key not available.

Also this issue may happen when I install some kernel modules from git sources.

This issue may appear after a kernel update as disabled wireless adapter, black screen after a reboot, etc.

How can I fix it?

Best Answer

Since Ubuntu kernel 4.4.0-20 the EFI_SECURE_BOOT_SIG_ENFORCE kernel config has been enabled. That prevents from loading unsigned third party modules if UEFI Secure Boot is enabled.

The easiest way to fix this issue is to disable Secure Boot in UEFI (BIOS) settings.

In most cases you can get into UEFI settings using grub menu. Press ESC button on booting, get into grub menu and select System Setup. Secure Boot option should be in "Security" or "Boot" section of the UEFI.

You can get into UEFI directly, but it depends on your hardware. Read your computer manual to see how to get there. It may be Del, or F2 on boot, or something else.

An alternative way is to disable Secure Boot using mokutil.

Since Ubuntu kernel build 4.4.0-21.37 this can be fixed by running

sudo apt install mokutil
sudo mokutil --disable-validation

It will require to create a password. The password should be at least 8 characters long. After you reboot, UEFI will ask if you want to change security settings. Choose "Yes".

Then you will be asked to enter the previously created password. Some UEFI firmware asks not for the full password, but to enter some characters of it, like 1st, 3rd, etc. Be careful. Some people do not understand this. I did not get it from the first attempt either ;-)

Update: Now this kernel config is enabled in all supported Ubuntu kernels. Ubuntu 16.04, 15.10 and 14.04 are affected.

Related Solutions

Ubuntu – Virtualbox , Ubuntu 11.10 , linux-kernel 3: cannot start virtual machine

Have you tried to build the kernel module?. It should have been builded during the installation, but it looks like it failed. You can try:

sudo dkms install virtualbox/4.1.2

This should build the module.

Ubuntu – Could not load ‘vboxdrv’ after upgrade to Ubuntu 16.04 (and I want to keep secure boot)

Since kernel version 4.4.0-20, it was enforced that unsigned kernel modules will not be allowed to run with Secure Boot enabled. Because you want to keep Secure Boot, then the next logical step is to sign those modules.

So let's try it.

Create signing keys
```
openssl req -new -x509 -newkey rsa:2048 -keyout MOK.priv -outform DER -out MOK.der -nodes -days 36500 -subj "/CN=Descriptive common name/"
```
Option: for additional security, skip the -nodes switch, which will ask for a password. Then before moving on to the next step, make sure to export KBUILD_SIGN_PIN='yourpassword'
Sign the module (vboxdrv for this example, but repeat for other modules in ls $(dirname $(modinfo -n vboxdrv))/vbox*.ko) for full functionality)
```
sudo /usr/src/linux-headers-$(uname -r)/scripts/sign-file sha256 ./MOK.priv ./MOK.der $(modinfo -n vboxdrv)
```

Confirm the module is signed

tail $(modinfo -n vboxdrv) | grep "Module signature appended"

Register the keys to Secure Boot
```
sudo mokutil --import MOK.der
```
which will ask for a password to use to confirm the import in the next step.
Reboot and follow instructions to Enroll MOK (Machine Owner Key). Here's a sample with pictures. The system will reboot one more time.
Confirm the key is enrolled
```
mokutil --test-key MOK.der
```

If VirtualBox still does not load, it may be because the module didn't load (sudo modprobe vboxdrv will fix that) or that the key is not signed. Simply repeat that step and everything should work fine.

Resources: Detailed website article for Fedora and Ubuntu implementation of module signing. @zwets for additional security. @shasha_trn for mentioning all the modules.

Additional resource: I created a bash script for my own use every time virtualbox-dkms upgrades and thus overwrites the signed modules. Check out my vboxsign originally on GitHub.

Best Answer

Related Solutions

Ubuntu – Virtualbox , Ubuntu 11.10 , linux-kernel 3: cannot start virtual machine

Ubuntu – Could not load ‘vboxdrv’ after upgrade to Ubuntu 16.04 (and I want to keep secure boot)

Related Question