1

Follow up to Grub updated and now I can't get in to the BIOS, how can I fix it?. Short version: couldn't boot to a USB thumbdrive after updating grub. I reset the BIOS to factory default (with the jumper) and now I can't boot at all, it says "Invalid signature detected. Check Secure Boot Policy in Setup."

Worth reiterating that this system was working fine before I put in a new hard drive and migrated the old OS over to the new hard drive with Clonezilla. Got that all running fine but then when I went to increase the partition size with gparted I found that I couldn't boot from the USB stick.

The typical advice is to disable secure boot in the BIOS in the Security tab. Except I don't have that. I have options to set passwords and that's it. Nothing about it in the Boot options either. I flashed the BIOS to a current version last year, pretty sure that doesn't get reset if I bridge the CMOS jumper.

This is a linux machine, not a dual boot.

Screenshots (literally) here: https://i.sstatic.net/ntDF6.jpg

How do I fix this secure boot error without having the option to disable secure boot?

Improve this question
3
  • 1
    What does the "Windows 8/8.1 Configuration" submenu in the "Advanced" section contain? Secure Boot was introduced in Windows 8, and a system firmware with a copyright year of 2014 (=when Windows 8.1 was the newest Microsoft desktop OS) might well have the Secure Boot settings placed in there.
    – telcoM
    Commented May 30, 2022 at 22:58
  • Ah yeah that was it, make it an answer and I'll mark it.
    – jcollum
    Commented May 30, 2022 at 23:11
  • If you have a Linux distro which supports Secure Boot, e.g. Fedora/RHEL or Ubuntu you'd better leave the secure boot option on. Your BIOS might not contain the required MAC key but it's not that difficult to install it.
    – Artem S. Tashkinov
    Commented May 30, 2022 at 23:51

2 Answers 2

Reset to default
1

From the screenshots you posted, I see that the firmware copyright messages specify year 2014... and that the "Advanced" section has a submenu titled "Windows 8/8.1 Configuration".

Back in 2014, Windows 8.1 was still the newest version of Windows for desktops, and Secure Boot was introduced in Windows 8. It is very likely the "Windows 8/8.1 Configuration" submenu contains the Secure Boot settings, if they exist at all.

If you're lucky, you may find there a full set of controls for Secure Boot: not only an enable/disable switch, but a way to manipulate the Secure Boot keystores (PK, KEK, db and dbx) too. But if the only thing you'll find is a "Clear Secure Boot PK" or similar option, that might be enough: when the Secure Boot Primary Key (PK) is cleared, all the Secure Boot keystores should become freely modifiable with a suitable tool, like KeyTool.efi from James Bottomley's efitools package. Clearing the PK should also allow you to boot everything.

Since the Secure Boot keystores are essentially UEFI firmware NVRAM variables with special protection settings, they should in theory be modifiable from within a running OS. However, on 2014-era systems, I've had better luck with the bootable tools, whenever the BIOS menus have been insufficient. When trying to update Secure Boot keystores from within a running OS on systems this old, I've often encountered firmware bugs.

Improve this answer
0

I had the same problem, after changing heaps of settings the only thing that fixed it was downgrading my BIOS

Improve this answer
2
  • Your answer is a bit terse and could be improved by explaining the issue, i.e., the underlying cause of the problem, and why your solution correctly would resolve it for the user in the question.
    – Kusalananda ♦
    Commented Oct 26, 2022 at 12:40
  • Which version did you downgrade to?
    – John Militer
    Commented Oct 26, 2022 at 17:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .