13

I have a dual boot laptop Windows 10 / Linux mint 20. Secure boot enabled and also hard disk encryption, but the latter is maybe not important for the question.

By the way, my question is very similar to this one: https://forums.linuxmint.com/viewtopic.php?t=274365

I installed Windows and after that - Linux Mint. After Mint installation, computer rebooted and I was asked to "Continue boot" or "Enroll MOK". I didn't know what to do and went to search online on the other laptop. While searching, the dialog apparently timed out and the computer just continued booting. Laptop is Dell Vostro 5581 updated to latest BIOS.

Later on the same day, I installed Virtualbox from Oracle's web site (not from repository). During the installation in text mode on the console it asked me to confirm that I want to enroll MOK upon the next reboot and enter a temporary password. I did and rebooted and enrolled the MOK. (Not knowing what I am doing, by the way)

So, here are my questions. All this secure boot thing is very new to me.

  1. What is the initial "Continue boot" or "Enroll MOK" dialog that appears when you install Mint and reboot for the first time? This appears before the OS even boots. I think it's a BIOS thing. And it seems to does not matter if you just continue boot or enroll the key. I did 2 Linux installations and in the 1-st one I chose to enroll the key, but on the 2-nd ignored it. There seemed to be no difference.

  2. If I had enrolled the MOK key, would Virtualbox have installed without asking me to do anything? What exactly does VirtualBox when it enrolls its own key?

  3. How can I do the "Enroll MOK" now after I have installed and configured my system and really don't want to re-install again? The other question on the forum (see link above) has an answer saying:

I had the same problem. In order to set a new MOK password I've used the command

sudo update-secureboot-policy --enroll-key

however, on my installation there is no such command update-secureboot-policy.

  1. Now I am afraid to install the proprietary NVidia drivers, because I didn't enroll MOK and am afraid that it won't work.

  2. And, generally, what does this "Enroll MOK" thing do after the 1-st reboot? I really don't understand it. Does it mean that it puts some Ubuntu keys in the BIOS? Does it mean that if I do it, then all future proprietary kernel modules that I install will happen smoothly without enrolling their own MOKs?

2 Answers 2

4

1. What is the initial "Continue boot" or "Enroll MOK" dialog that appears when you install Mint and reboot for the first time?

That is produced by shimx64.efi when it detects that there is a new MOK in a OS-accessible UEFI NVRAM variable, waiting to be installed.

2. If I had enrolled the MOK key, would Virtualbox have installed without asking me to do anything?

Most likely, yes.

2.5. What exactly does VirtualBox when it enrolls its own key?

It probably just triggers update-secureboot-policy --enroll-key if it's available.

3. How can I do the "Enroll MOK" now after I have installed and configured my system and really don't want to re-install again?

sudo apt install shim-signed
sudo update-secureboot-policy --enroll-key

4. Now I am afraid to install the proprietary NVidia drivers, because I didn't enroll MOK and am afraid that it won't work.

Technically not a question, but don't worry. If you install the NVidia driver through Ubuntu's/Mint's 3rd-party driver management tool, it will probably just do the steps listed in 3.) above for you if you haven't already done that.

If you use the installation package downloaded directly from NVidia, first install a dkms management tool for third-party modules, and then run the NVidia driver installer:

sudo apt install dkms

sudo ./NVIDIA-Linux-x86_64-<version number>.run --dkms \
    --module-signing-secret-key=/var/lib/shim-signed/mok/MOK.priv \
    --module-signing-public-key=/var/lib/shim-signed/mok/MOK.der

dkms automates the rebuilding of the 3rd-party kernel modules (like the NVidia driver's) so you won't have to do it manually whenever you receive a kernel security update.

5. And, generally, what does this "Enroll MOK" thing do after the 1-st reboot?

If you don't do the "Enroll MOK" on the next reboot right after running update-secureboot-policy --enroll-key, the enrollment procedure will be on hold, waiting for you to either complete it by selecting "Enroll MOK" on a subsequent boot, or to cancel it with sudo mokutil --revoke-import within Linux.

Once you've completed the MOK enrollment procedure, you should not see that prompt again unless you lose the old MOK and enroll a new one.

5.1. Does it mean that it puts some Ubuntu keys in the BIOS?

No, the enrollment procedure makes a key that is unique to your system and places it in /var/lib/shim-signed/mok/ accessible to root only, so the kernel module installation processes can use it, and enrolls a copy of the public part of the key to an UEFI NVRAM variable, so it can be used by shimx64.efi when booting.

5.2. Does it mean that if I do it, then all future proprietary kernel modules that I install will happen smoothly without enrolling their own MOKs?

That's the idea, yes. Unfortunately not all third-party kernel module source packages have not yet been updated to seamlessly detect the presence of MOK and automatically use it if necessary.

2

on my installation there is no such command update-secureboot-policy

On my Ubuntu system that command is in the shim-signed package.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .