0

I tried install Linux Mint with usb stick done by Ventoy and by (KDE) ISO Image Writer on Fedora. Mint latest version 21.3.Both times I get "Secure Boot Violation. Invalid signature detected. Check Secure Boot Policy in Setup."

I cannot disable Secure Boot in BIOS as it is grayed out. Laptop is Lenovo Thinkpad L14 (2023 model).

I found no working way to disable Secure Boot in bios and found no way to create an usb stick with Secure Boot capability.

3
  • 1
    Have you tried using the tools mentioned in the Mint docs? Commented Jan 30 at 13:00
  • 1
    @VlastimilBurián it's not unusual for firmware vendors to allow the owner of a mainboard to disable disabling of Secure Boot. That makes a lot of sense to me – what good is it that you can make sure that you can only boot signed operating systems if all it takes is going to the UEFI setup, and disabling Secure Boot? So, someone, on some other laptop from the same company, being able to disable Secure Boot is sadly irrelevant to the problem at hand. Commented Jan 30 at 13:59
  • 1
    Have you updated UEFI firmware? Looks like Lenovo T14 is update to ThinkPad T400, T410, T420, T490. series. So do you have this screen? Lenovo Locked UEFI/BIOS setting: reddit.com/… Lenovo Thinkpad T495 Boot Order Lock askubuntu.com/questions/1404259/…
    – oldfred
    Commented Jan 30 at 14:44

1 Answer 1

4

Secure Boot Violation. Invalid signature detected. Check Secure Boot Policy in Setup.

Says that your boot loader is signed, but not with a key that your machine accepts. This is exactly the purpose of Secure Boot: to make it impossible to execute an operating system not "OK'ed" by the owner of the machine.

Usually, the things that are OK involve things like boot loaders signed by Microsoft – after all, for laptops, Windows is the "default" operating system, and exactly what the user would want their machine from being hijacked by malware. So, mainboard vendors generally include Microsoft's public key in their trusted platform module (the chip storing the data used to verify software), and allows booting Microsoft-signed boot loaders.

And that's what the major Linux distributions did: get a Microsoft account, ask Microsoft to sign their bootloaders, and thus make them possible to boot on most mainboards.

As a mainboard owner (that is, you!) you can, from a running operating system (linux, Windows, Mac OS…) do things like disable keys, add new ones, relax the checking – that is, until you've gone ahead and locked down your machine.
This is usually – intentionally – a one-way street: If you, say, give someone traveling a laptop with confidential data on it, you don't want someone who's been left alone with the laptop for as long as the person is being held up somewhere to be able to disable Secure Boot, boot Linux, install a custom key in the trusted platform module, add a boot loader, signed by the new key, that incorporates a key logger to get the decryption key for the hard drive encryption, the VPN or whatever, then re-enable Secure Boot. Again, Secure Boot is actually a good idea that protects the rightful owner of a piece of hardware – if control has not been taken from him before.

The fact that you can't disable Secure Boot in your mainboard Setup (there's nothing BIOS about that…) might indicate that your system is locked down, uses a custom key that only allows, for example, Windows versions signed by a company's IT department, and Secure Boot simply cannot be disabled without help of that IT department, as they hold all the cryptographic keys.

So, unless your bootloader is actually unsigned and the error message is wrong (usually, it isn't), I think you simply aren't "boss" in the laptop you own :(.

Mint, however, is the last major distro to actually support Secure Boot (they're literally a decade later than Redhat, Fedora, SuSe and Ubuntu, 5 years later than debian,…). Maybe they haven't gotten all their ducks in a row yet and things are somehow broken? I'd honestly just go and try the Fedora installer USB image; if that works, you at least know it's not impossible!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .