Skip to main content

Questions tagged [secure-boot]

Questions for UEFI Secure-Boot, Secure-Boot Key Signing and Management

Filter by
Sorted by
Tagged with
1 vote
1 answer
21 views

Shim boot loader: System is compromised when using certificate, but not with hash

I am trying to boot a Linux kernel with efi stub enabled using Red Hat's Shim https://github.com/rhboot/shim. I can boot the system if I enroll the hash of my efi stub (selecting GRUBX64.EFI), but ...
Jan Sommer's user avatar
0 votes
0 answers
8 views

Rebooting directly into MOK

I'd like to enroll a new key in a GCP VM. I'm using the mok --import command, and rebooting form the serial console. The problem is that, when the splash screen appears, the serial console does not ...
Razvan Sodoleanu's user avatar
1 vote
0 answers
48 views

Kerrnel Locked Down from EFI secure boot, secure boot disabled in bios

I wanted to ask about something happening on my Debian 12 machine. When I run journalctl as root I get this message: "Kernel is locked down from EFI Secure Boot; see man kernel_lockdown.7" I ...
user615860's user avatar
1 vote
1 answer
132 views

About Secure Boot, MOK and NVRAM

Good evening, after searching on google I didn't find the answer to my question. When installing a distribution such as Ubuntu with secure boot activated, the installer creates a MOK key in the NVRAM ...
user avatar
1 vote
1 answer
47 views

How to compare secure boot keys stored in motherboard’s firmware database with the signed .efi files?

It’s a piece of cake to enable secure boot in a virtual machine, but I’m struggling to do the same with OpenSUSE on my 2012 vintage computer which refuses to boot in secure boot mode even in the ...
Bogey Jammer's user avatar
0 votes
0 answers
22 views

EDK2: Sign startup.nsh EUFI script

When the BIOS loads the EDK2 UEFI shell it checks it's signature. Then I've configured EDK2 to verify all EUFI modules (i.e. Ext4Pkg), but the startup.nsh script is unsigned. How can I sign/verify the ...
Bayou's user avatar
  • 175
0 votes
0 answers
43 views

Mass install linux by dd to drive directly?

I need to install an custom OS to many similar/identical laptops. Would it work to live boot a laptop and dd the disk from a template laptop to the new one? Is it possible to trigger secure boot key ...
johndue's user avatar
  • 41
0 votes
0 answers
52 views

How to disable kernel_lockdown (MSR) without BIOS or console access

I have a laptop with a damaged screen. I use it by connecting a screen via HDMI. I'm running some cryto mining software that requires MSR access to run efficiently. I cannot access the BIOS to disable ...
Nadim Ghaznavi's user avatar
0 votes
2 answers
285 views

How and when is `/sys/kernel/security/tpm0/binary_bios_measurements` exposed?

Currently, I try to understand how a measured boot is working and what components log what in which pcr of a tpm2. I have a test-setup with uefi-secure boot enabled and a tpm2 attached in a kvm ...
user3046582's user avatar
0 votes
0 answers
192 views

How to add a key to the secureboot db EFI signature list?

I currently have two machines running Arch Linux with a unified kernel image (UKI), full disk encryption (FDE), and secure boot/TPM2 based unlocking. I would like to create a portable USB stick ...
StrongBad's user avatar
  • 5,311
0 votes
1 answer
286 views

How do I enable UEFI secure boot for a linux build made with yocto?

I'm producing a yocto build, and want to enable UEFI Secure Boot on the intel machine I'm using. This is a pretty basic yocto build, using core-image-minimal and meta-intel. The artifacts it ...
Dave's user avatar
  • 23
0 votes
1 answer
620 views

MOKutil: Enroll key of already installed driver

I installed the proprietary NVIDIA drivers on my PC using the option my distribution (Zorin OS) gave me upon first installation. Unfortunately, the signature of the driver was not enrolled to MOK, ...
mags0ft's user avatar
0 votes
0 answers
42 views

Create, update, modify, and delete UEFI authenticated variables from userspace in Linux

I've been searching for, but cannot find any information or utilities for creating, deleting, modifying, and updating arbitrary authenticated variables in Linux from userspace. Sure, there are tools ...
Melab's user avatar
  • 4,158
0 votes
1 answer
414 views

Update NVRAM so that shimx64.efi is run instead of grubx64.efi on Debian system for secure boot

I want to configure my Debian to boot with secure boot enabled but it doesn't and here is why... OS specific boot loaders are stored on the ESP partition which is mounted in /boot/efi Debian system ...
metablaster's user avatar
0 votes
1 answer
584 views

How do I install Linux when I cannot disable Secure Boot?

I tried install Linux Mint with usb stick done by Ventoy and by (KDE) ISO Image Writer on Fedora. Mint latest version 21.3.Both times I get "Secure Boot Violation. Invalid signature detected. ...
Ohto Nordberg's user avatar
0 votes
1 answer
369 views

"error: /boot/vmlinuz-6.6.9-amd64 has invalid signature" with secure boot on in Kali Linux

When I try to run my Kali Linux system with secure boot on, GRUB returns error: /boot/vmlinuz-6.6.9-amd64 has invalid signature. I don't want to turn off secure boot. I have followed the directions ...
horsey_guy's user avatar
0 votes
0 answers
400 views

Modules have been signed but still prompt "insmod: ERROR: could not insert module ptusys.ko: Key was rejected by service"

My test environment: --OS: RHEL 9.2 I sign the kernel 6.2.0 what i build, it can be boot with secure boot enable. Then I try to sign a mod for secure boot, it apply fail. [root@localhost ptusys]# ...
Sec Bot's user avatar
1 vote
0 answers
456 views

Change font in GRUB with SecureBoot

I have a dual-boot system using Grub. Setting GRUB_FONT seems to be broken by SecureBoot. You can even try the loadfont command in Grub's console: it will return an error complaining about SecureBoot. ...
fffred's user avatar
  • 121
1 vote
0 answers
25 views

How to sset up your own secure boot keys to be used

Im trying to get the benefits of secure boot but i dont trust MS to sign stuff. Is there a easy way to both set up secure boot and have new kernel (i think kernel is updated via apt) get auto-signed? (...
Downvoter's user avatar
0 votes
0 answers
232 views

How can Linux hibernation be enabled under UEFI Secure Boot on RHEL / RockyLinux / AlmaLinux?

When running under UEFI Secure Boot with a current Linux distribution, "kernel lockdown" will be instated. Multiple kernel messages along the lines of Lockdown: swapper/0: hibernation is ...
AlexK973's user avatar
  • 151
0 votes
1 answer
430 views

Bricked my PC trying to setup secure-boot

I have dualboot (windows & arch), i was trying to setup secure boot in arch using sbctl. But i think i ran the wrong command and bricked my keys. Now when i startup computer, it get stuck in blank ...
Igor UnderPlayer's user avatar
0 votes
1 answer
982 views

Signing Nvidia drivers for Secure Boot - Nvidia module location

I want to sign my nvidia driver so I can use it with Secure Boot. I'm trying to follow these instructions for nvidia driver: https://wiki.debian.org/SecureBoot#Using_your_key_to_sign_modules_....
user3565923's user avatar
2 votes
1 answer
427 views

Verifying a signature of an EFI binary

I'm exploring UEFI secure boot and want to verify the certificates of the signed binaries. The code below shows there are indeed some signatures present: sbverify --list $BOOT/EFI/BOOT/BOOTX64.EFI ...
TheMeaningfulEngineer's user avatar
1 vote
0 answers
612 views

Debian SecureBoot with shim on MSI difficulty

I'm having a difficult time getting Debian 12 to boot UEFI with secureboot. This is on an MSI Meg Z490 Unify motherboard. GPU is an AMD WX3200. Secure Boot is enabled with standard mode and default ...
user avatar
1 vote
1 answer
1k views

MOK signed NVIDIA drivers are not loading after some time

From time to time my NVIDIA drivers (signed with MOK) are not being loaded on my dual boot machine (Ubuntu 22.04 and Windows 11). I'm resolving the issue by reinstalling the same drivers with the same ...
mputkowski's user avatar
4 votes
1 answer
3k views

How can Linux hibernation be enabled under UEFI Secure Boot with kernel lockdown on OpenSuSE?

(The question was originally asking about all distributions, however I have achieved a result for one distribution, only) When running under UEFI Secure Boot with a current Linux distribution, "...
AlexK973's user avatar
  • 151
0 votes
1 answer
817 views

How to configure Secure Boot with own keys and import Microsoft KEK and DB certificates?

I am in the process of configuring Secure Boot with my own keys (PK, KEK and DB). And so far I have done everything: Building Unified Kernel Image (UKI) Making standalone GRUB binary Generating own ...
error_man's user avatar
2 votes
0 answers
129 views

Help with Understanding MoK/Secureboot

I'm trying to understand How MoK shim64 works exactly. What I understand it as is: Securenboot has a list with Whitelisted Kernerl-hashes belonging to Windows, Ubuntu, Fedora, OpenSuse and others. ...
Hazmat's user avatar
  • 51
2 votes
1 answer
155 views

With Unified Kernel Images, how are custom initrd scenarios (such as multipath boot) addressed?

I was looking at the Fedora change set for 38 and saw this which seems like a neat idea but I was wondering how this affects systems that need custom files to be present in the initrd. One example is ...
Bratchley's user avatar
  • 16.9k
0 votes
0 answers
653 views

Debian Stable , just updated, Nvidia drivers didn't get built/brought to current kernel via dkms. How to build/activate after update?

Debian Stable , just updated, Nvidia drivers didn't get built/brought to current kernel via dkms. How to build/activate after update? I have a Debian 11 stable install, (Secure Boot is enabled) that ...
Zapon's user avatar
  • 1
0 votes
1 answer
407 views

Puppy Linux secure boot key

I want to sometimes use Linux, sometimes windows. I found out that, Puppy Linux is small, I can install it on a USB. But the problem is, if I click on my USB in the boot menu, I have to disable secure ...
slavekrouta's user avatar
0 votes
0 answers
313 views

Secure Boot Password not working on Ubuntu (Dell)

I've been trying to disable Secure Boot on my Dell laptop but it's not working. Every part of the process till the blue screen seems to work fine. But once I enter my password it does not work. It ...
user555819's user avatar
0 votes
0 answers
1k views

Grub loads unsigned kernel with secure boot enabled

I am currently dual booting Gentoo and Windows (on two different disks). I boot on the linux drive with grub2, where I can choose either Gentoo or Windows (added by os-prober). Recently, I updated ...
nect's user avatar
  • 1
1 vote
0 answers
619 views

Ubuntu 20.04 USB failed SecureBoot

I am trying to install Ubuntu 20.04 with Windows 11. However when I select the USB to boot, it shows "Operating System Loader signature found in SecureBoot exclusion database("dbx"). ...
user6819's user avatar
0 votes
1 answer
446 views

Is there a downside to a signed kernel?

Mostly a general linux question, but where it needs to be specific I am referencing Debian 12 Bookworm amd64 UEFI booting through grub(not direct kernel stub). I have secure boot disabled in firmware ...
Max Power's user avatar
  • 264
0 votes
2 answers
305 views

Secure Boot & admin password

I have a PC with a mechanical interrupt in order to enable different hdds and use different OS. Windows has bee installed with bios legacy. I want to install in the other HDD archlinux. When I try ...
eugenio b's user avatar
2 votes
1 answer
884 views

What is this update exactly designed for? (new BIOS?)

I own a rather older piece of server, Dell PowerEdge T20, with the latest BIOS version A20, link to Dell updates, screen of the update in case link goes dead in time: This morning, when SSH'd into ...
Vlastimil Burián's user avatar
0 votes
0 answers
1k views

Are MOK (Machine Owner Key) deleted after OS reinstall or Secure Erase (Data Wipe) on BIOS/UEFI level?

Some time ago I have installed Ubuntu 22.04 and installed proprietary nvidia drivers on it. That triggered creation of the new MOK (Machine Owner Key). In a meantime I have decided to reinstall the ...
MTP's user avatar
  • 1
0 votes
0 answers
1k views

USB Bootable gparted supporting Secure Boot

I want to be able to move and resize partitions on my systems, so I wanted to make a live GParted USB, thing is, it doesn't support Secure Boot, Ubuntu is overkill and takes long to boot (and ...
Didi Kohen's user avatar
  • 1,851
2 votes
1 answer
5k views

Operating System Loader signature found in SecureBoot exclusion database ('dbx'). All bootable devices failed Secure Boot verification

I just downloaded Pop!_OS 22.04 LTS (NVIDIA) from the official website, verified the checksum, flashed to a pen drive, and attempted to boot from it. I forgot to disable Secure Boot as advised on the ...
BenMorel's user avatar
  • 4,647
2 votes
1 answer
3k views

Arch Linux and secure boot issues

I want to install arch linux on my laptop, but I want to be able to play my games that require secure boot on windows 10. I found a tutorial to make it secure boot compatible: Flash the ISO on the usb ...
Regex's user avatar
  • 21
0 votes
1 answer
4k views

GRUB2 Multi-Linux Dual Boot (Secure Boot & shimx64.efi)

I am attempting to create an ultimate USB Stick that will contain 2 Linux Distros, Windows and a Plethora of ISOs. So far I have installed Windows, Ubuntu and Fedora Silverblue to a disk (I've been ...
Lime Parallelogram's user avatar
0 votes
0 answers
1k views

Can't install Pop!_OS because secure boot won't disable

I'm trying to install Pop!_OS on my Windows 10 Acer Aspire E5-573G from a USB stick but I keep getting this message: error: /casper_pop-os_22.04_amd64_nvidia_debug_125/vmlinuz.efi has invalid ...
Francesco 'oH pongwIj'e''s user avatar
1 vote
1 answer
2k views

Editing grub menu with secure boot enabled Ubuntu/PartedMagic

I have laptop DELL latitude 5491 with preinstalled Windows 10 with secure boot enabled and EFI mode. After I purchased, I installed Ubuntu 20.04 next to Windows as a dualboot with still secure boot ...
Pablo's user avatar
  • 11
1 vote
2 answers
6k views

Reset my BIOS. Now how do I fix "Invalid signature detected. Check Secure Boot Policy in Setup."?

Follow up to Grub updated and now I can't get in to the BIOS, how can I fix it?. Short version: couldn't boot to a USB thumbdrive after updating grub. I reset the BIOS to factory default (with the ...
jcollum's user avatar
  • 1,209
0 votes
0 answers
2k views

Kernel doesn't seem to be signed for Secureboot. (linux-image-5.17.5-76051705-generic )

I've been trying to get secure boot enabled but don't manage to do it. I have installed shim and Grub correctly with sudo apt install shim-signed && sudo grub-install However, when I boot, I ...
Sid's user avatar
  • 101
0 votes
1 answer
26k views

Can't load self-signed kernel with Secure Boot on: "bad shim signature"

I'm running ubuntu with Secure Boot on. Everything works fine when I use a kernel that comes packaged from cannonical. Still, I have issues running a self-signed kernel. I'm pretty sure my signature ...
piontec's user avatar
  • 23
1 vote
0 answers
354 views

external boot efi shell when secure boot is turned on

I don't have a built in uefi shell in my laptop and I have secure boot turned on. I would be happy for a signed uefi shell that I can boot into (edk2, tianocore shell.efi files are not signed and I ...
antwerp's user avatar
  • 11
4 votes
1 answer
662 views

How come Fedora ignores `module.sig_enforce` kernel parameter if SB is enabled but Arch does not?

I recently secure-booted Arch and Fedora on my RTX3050 equipped laptop. As is the common knowledge, I had to sign my Nvidia modules on Fedora for the kernel to load them. However, I find that same is ...
cryptic's user avatar
  • 93
2 votes
1 answer
3k views

Linux Kernel signature error after signing

OS: Ubuntu 20.04 Machine: Dell XPS 13 9370 Attempting to upgrade from Linux kernel 5.13.0 to 5.16.14. Have verified that kernel 5.16.14 runs properly without secure boot. Followed instructions here ...
user2864874's user avatar