[SOLVED] "Your system has UEFI Secure Boot enabled" after virtualbox stopped installation

[magnetor1000]

In the middle of trying to install VirtualBox I had a popup for setting up UEFI, but I had no idea what it was, so I stopped the installation in the middle of the process. Then forced shutdown my computer using the power button because the system would not let me.

Now after rebooting I am trying to get rid of VirtualBox, and it won't let me remove it before I finish the configuration for whatever that UEFI thing is.

This is what I see:

What is that thing, and how do I solve this?

Please help. Thanks!

[SMG]

In the middle of trying to install VirtualBox I had a popup for setting up UEFI, but I had no idea what it was, so I stopped the installation in the middle of the process. Then forced shutdown my computer using the power button because the system would not let me.

Now after rebooting I am trying to get rid of VirtualBox, and it won't let me remove it before I finish the configuration for whatever that UEFI thing is.

Secure Boot is a setting in your computer's BIOS/UEFI. What Is Secure Boot and How Does it Work?

VirtualBox is a third-party driver and by default is not trusted until you set up the MOK to let your computer know to trust it.

What is that thing, and how do I solve this?

Did you try following the onscreen instructions? It appears you need to click "Next".

[magnetor1000]

Did you try following the onscreen instructions? It appears you need to click "Next".

I just wanted to verify what it is I am doing before I clicked next. Will I be creating a password that I will need to reference a lot? What is it for?

Did I possibly mess anything up by interrupting the process and not doing that?

[SMG]

Did I possibly mess anything up by interrupting the process and not doing that?

I do not usually help with VirtualBox installation issues, so I do not know. Maybe someone else who is familiar with it can answer that question.

I am only familiar with Secure Boot and creating MOK with regards to Nvidia drivers. In the case of Nvidia, the driver files will install, but will not load at boot time if the key (stored in the BIOS/UEFI database) is not created. I do not know if that is also true for VirtualBox or even where in the VirtualBox installation process you stopped things.

I just wanted to verify what it is I am doing before I clicked next. Will I be creating a password that I will need to reference a lot? What is it for?

Check first answer to this question Security boot and mok password for an explanation.

Each manufacturer handles MOK differently, so I can not tell you the specifics for your computer.

[Cosmo.]

A hard shutdown (holding the power button) was surely the worst decision. Nobody is able to say, in which state you left the system, it is even possible, that you damaged the file system.

Most easy method to revert the incomplete installation is using the Timeshift snapshot before you tried to install VB.

Will I be creating a password that I will need to reference a lot? What is it for?

I cannot follow. The installation process for VB does not create or ask for a password, except at the start of the installation, where your user password is needed, just as in case of any other software, which you do install.

[SMG]

Will I be creating a password that I will need to reference a lot? What is it for?

I cannot follow. The installation process for VB does not create or ask for a password, except at the start of the installation, where your user password is needed, just as in case of any other software, which you do install.

I have seen messages in journalctl indicating that VB had tainted the kernel. That message usually happens for third-party drivers so I presume the VB driver falls into the category of being a proprietary driver. Third-party drivers do need MOK set up if one has Secure Boot enabled and MOK requires a password.

[AndyMH]

Simplest solution - disable secure boot?

[pbear]

That message usually happens for third-party drivers so I presume the VB driver falls into the category of being a proprietary driver.

My understanding is that this was true, in a sense, for VBox 6.0 and earlier, but no longer. No direct experience, as I always disable secure boot.

As for your question, magnetor1000, you probably can delete the MOK in the firmware. Exactly how depends on which firmware you have.

[magnetor1000]

Hello everyone, thank you all for your answers. I have a couple followup questions:

My understanding is that this was true, in a sense, for VBox 6.0 and earlier, but no longer. No direct experience, as I always disable secure boot.

What is "secure boot" though? What does one use it for? And is there any potential disadvantage in disabling it? Will there be any future issues by doing this? I have a dual boot system (Linux/Windows) if that matters. And also, how does one disable or enable it? Could this action be reversed (if so, how)?

As for your question, magnetor1000, you probably can delete the MOK in the firmware. Exactly how depends on which firmware you have.

What is MOK and how do I delete it in the firmware? Also same question here, any potential problems down the line by doing this? Any way to reverse it if I want it back again?

[SMG]

What is "secure boot" though? What does one use it for? And is there any potential disadvantage in disabling it? Will there be any future issues by doing this? I have a dual boot system (Linux/Windows) if that matters. And also, how does one disable or enable it? Could this action be reversed (if so, how)?

I think this article covers all your questions How Secure Boot Works on Windows 8 and 10, and What It Means for Linux.

It is a setting in the firmware (UEFI/BIOS) and can easily be enabled or disabled and reversed to its prior position.

What is MOK and how do I delete it in the firmware?

MOK are Machine-Owner Keys and are needed if Secure Boot remains enabled. They are "the key" to letting the driver load at boot time.

I've never helped anyone with deleting keys, but I did find this topic where the third answer describes deleting individual keys specifically related to Virtual Box Is it possible to delete an enrolled key using mokutil without the original .der file?.

There is a way enroll a key already created (such as what may have happened when you stopped the process). Ubuntu wiki: SecureBoot explains running the command in section 5 "How can I do non-automated signing of drivers?" to use the sudo update-secureboot-policy --enroll-key command in a terminal. You might have to use tab or arrow keys to progress through the program's screens, enter the password, and complete the program. I seem to recall the feedback indicating the process was a bit awkward and not necessarily intuitive, but it can be done. (Might be easier to manage if you know ahead of time it might look and feel a bit weird.)

However, it is possible your computer is forcing you to enroll that key considering the screenshot you posted, so you may not need to do anything in a terminal to enroll the key.

[pbear]

magnetor, you need to do some research and reading. Also, understand, there are no warranties for advice on a message board. It's on you to make sure it fits your circumstances. If the problem is beyond your skill, take the computer to a shop and pay someone to fix it for you.

[Reddog1]

I'm confused here. Why didn't you just click the 'next' box? You should get a wizard to allow you to add the mok secure code (requires a password). Use the password you normally use for system login--don't do anything special. After you've finished, the install should resume. Or did I miss somethin?

[pbear]

Now after rebooting I am trying to get rid of VirtualBox, and it won't let me remove it before I finish the configuration for whatever that UEFI thing is.

[Smacks self in forehead.]

Have you tried restoring the system to its state before the failed attempt to install VirtualBox?
In Windows, you would do that with System Restore. In Mint, you would use Timeshift.

[Cosmo.]

Have you tried restoring the system to its state before the failed attempt to install VirtualBox?
.... In Mint, you would use Timeshift.

It doesn't seem so. I advised that already 3 days ago: viewtopic.php?p=2189404#p2189404

[pbear]

Funny as it may sound, that makes me feel better. Don't mind forgetting you had already suggested system restore. I forget lots of things. But I noticed the advice the first time I read the thread and, of course, saw no need to repeat it.

One difference in my suggestion. I've a hunch this is actually a Windows problem. If so, the mention of Timeshift probably meant nothing to the OP.

[magnetor1000]

Now after rebooting I am trying to get rid of VirtualBox, and it won't let me remove it before I finish the configuration for whatever that UEFI thing is.

[Smacks self in forehead.]

Have you tried restoring the system to its state before the failed attempt to install VirtualBox?
In Windows, you would do that with System Restore. In Mint, you would use Timeshift.

This solved it for me! Thank you!!! I am now scheduling weekly Timeshift snapshots, as the only one I had was from a couple months ago.

So what alternative is there to VirtualBox now that we know it messes up the system?

[AndyMH]

So what alternative is there to VirtualBox now that we know it messes up the system?

Only for you, a lot of us have zero issues. Did you disable secure boot as suggested?

VMware is an alternative.

[pbear]

Or, if you want to keep secure boot, learn how MOKs work. SMG cited several good articles to get you started, e.g., Ubuntu wiki.
Now that you know Timeshift will get your system back if you make a mistake, it should be easier to relax about learning by doing.