Questions tagged [secure-boot]

Questions for UEFI Secure-Boot, Secure-Boot Key Signing and Management

Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

Kernel doesn't seem to be signed for Secureboot. (linux-image-5.17.5-76051705-generic )

I've been trying to get secure boot enabled but don't manage to do it. I have installed shim and Grub correctly with sudo apt install shim-signed && sudo grub-install However, when I boot, I ...
user avatar
  • 1
0 votes
1 answer
130 views

Can't load self-signed kernel with Secure Boot on: "bad shim signature"

I'm running ubuntu with Secure Boot on. Everything works fine when I use a kernel that comes packaged from cannonical. Still, I have issues running a self-signed kernel. I'm pretty sure my signature ...
user avatar
  • 23
0 votes
0 answers
7 views

How to make rEFInd check the signatures of initrd.img and refind.conf (for use with Secure Boot)?

GRUB has an option to check the signatures of initrd.img and grub.cfg (see How can I secure the initrd and grub.cfg using secure boot?) to ensure a continuous chain of trust during boot. Can something ...
user avatar
1 vote
0 answers
17 views

external boot efi shell when secure boot is turned on

I don't have a built in uefi shell in my laptop and I have secure boot turned on. I would be happy for a signed uefi shell that I can boot into (edk2, tianocore shell.efi files are not signed and I ...
user avatar
  • 11
4 votes
1 answer
150 views

How come Fedora ignores `module.sig_enforce` kernel parameter if SB is enabled but Arch does not?

I recently secure-booted Arch and Fedora on my RTX3050 equipped laptop. As is the common knowledge, I had to sign my Nvidia modules on Fedora for the kernel to load them. However, I find that same is ...
user avatar
  • 43
2 votes
1 answer
410 views

Linux Kernel signature error after signing

OS: Ubuntu 20.04 Machine: Dell XPS 13 9370 Attempting to upgrade from Linux kernel 5.13.0 to 5.16.14. Have verified that kernel 5.16.14 runs properly without secure boot. Followed instructions here ...
user avatar
1 vote
0 answers
53 views

Patching the kernel to allow hibernation with secure-boot enabled

My current config is Windows-11 (required for my job) and Ubuntu 21.10 dual-booting on an HP Probook G10. Since I have to have secure-boot to run Win-11, I have to live without hibernation on Linux (...
user avatar
  • 131
0 votes
0 answers
41 views

UEFI SHIM (Compile from Source) with Built-In Certificate

I am looking for a working example of UEFI SHIM compiled from source code from https://github.com/rhboot/shim The SHIM should be using Built-In Certificate and not the MOK (Machine Owner Key) approach ...
user avatar
  • 53
1 vote
1 answer
50 views

UEFI SHIM Error "verify_buffer() No signatures found"

Continuing from UEFI Self-Signed Kernel loading from a Microsoft Signed OS Loader I used https://github.com/rhboot/shim/releases/tag/15.4 and built on my local machine (Ubuntu 18.04 LTS) openssl req -...
user avatar
  • 53
1 vote
2 answers
166 views

UEFI Self-Signed Kernel loading from a Microsoft Signed OS Loader

I am writing my own OS loader (Boot Loader) in UEFI. The OS Loader is Microsoft Signed so it can run under secure-boot. The OS Loader will be able to load Windows or Linux Kernel based on User's ...
user avatar
  • 53
0 votes
0 answers
23 views

How to list modules that are not signed by secure boot?

How to list all modules that are NOT signed by secure boot in Debian. I tried : find /lib/modules -name '*.ko' -exec grep -v -FL '~Debian Secure Boot CA~' {} \+ But is this enough to make sure the ...
user avatar
  • 23
1 vote
0 answers
90 views

Virtualbox: WARNING! Diff between built and installed module

After I signed Virtualbox for secure-boot on Debian I typed dkms status. I've got that message :WARNING! Diff between built and installed module. Is that because I signed the module ?
user avatar
  • 11
0 votes
0 answers
70 views

Failed to delete secure boot state in Ubuntu - dual boot with Windows 11

I have dual booted Ubuntu with Windows 11 and the Wi-Fi adapters were not detected. So I have done something and they were working but after 2-3 days again the same problem occurred but this time it ...
user avatar
0 votes
1 answer
298 views

GRUB loader won't start in secure boot

I have a dual boot setup. I am using Kali Linux and Windows 10. They were working fine until I forgot to shut down my system and Kali went into hibernation. After that PC shutdown-ed because of low ...
user avatar
0 votes
0 answers
55 views

Grub on external SD card for choosing the internal Os (With SecureBoot enabled and no possibilities to change boot order)

I) The aim I have a recent Lenovo laptop with UEFI where windows is installed on the ssd drive. I would like to install Linux Mint on the same drive. But I would like to use an external SD card to ...
user avatar
0 votes
1 answer
40 views

Re-enable and Disabling secure boot on dual boot WIN 11 and Kali?

So, I am basically a Linux user and just hop onto Windows whenever I want to play games or anything stupid. Most of my games now actually run when secure boot is enabled but as I am using Kali already ...
user avatar
1 vote
0 answers
117 views

Change Secure Boot Mode EFI Variable without entering the firmware setup GUI?

I am trying to figure out a way to change the secure boot setting from Windows, Linux, or an EFI shell. I assume this is impossible as that would defeat the whole purpose of secure boot, however I ...
user avatar
0 votes
1 answer
303 views

What does signing drivers / modules do and what is the significance?

Having recently installed a driver which required for the module to be signed manually it was confusing what signing that module was actually doing and why it had to be done. There are other questions ...
user avatar
  • 715
0 votes
0 answers
29 views

Does dkms in Ubuntu 18.04 and later sign modules/drivers automatically?

According to DisplayLink website: Since Ubuntu 18.04 signing modules is handled automatically by dkms package, remember to reboot to finalize However when secure boot was enabled in order for the ...
user avatar
  • 715
0 votes
0 answers
326 views

How to configure shim for a Kali and Windows Secure Boot system?

I have installed a new Kali partition alongside Windows from the latest Kali installer, and would ideally like to revert back to Secure Boot, which I had disabled for the sake of its installation ...
user avatar
  • 380
1 vote
1 answer
995 views

LUKS + TPM2 + PIN

I am currently aware of two recent methods to bind a LUKS encrypted root partition to a TPM2: systemd-cryptenroll and clevis. Both of them seem to release the encryption key after successfully ...
user avatar
  • 95
0 votes
0 answers
22 views

apt - run script after update using secure boot custom keys

If I replace Microsofts secure boot keys with my own via the UEFI facility to add your own keys, and configure everything properly, will I need to re sign shim/kernel/etc. every time my computer ...
user avatar
  • 486
0 votes
1 answer
341 views

Invalid signature detected in secure boot, how to fix?

I'm getting "Invalid signature detected in secure boot". All solutions that I've found says to disable secure boot in BIOS, which seem to be an insecure thing to want to do. How can I have ...
user avatar
  • 1
5 votes
1 answer
6k views

"Enroll MOK" dialog after the 1-st reboot when you install Linux Mint 20.1 - what is it for (secure boot)?

I have a dual boot laptop Windows 10 / Linux mint 20. Secure boot enabled and also hard disk encryption, but the latter is maybe not important for the question. By the way, my question is very similar ...
user avatar
3 votes
1 answer
1k views

How to verify signed UEFI binaries?

I'm trying to understand why secure boot works on my machine. It is enabled in the UEFI config, everything boots just fine, and mokutil --sb-state says SecureBoot enabled. But I think it shouldn't. ...
user avatar
  • 5,134
2 votes
1 answer
562 views

Custom signed Centos 7 PXE Secureboot with Shim and grub: invalid kernel signature

As the title suggests, I'm trying to set up a system that uses PXE boot to boot into CentOS7 with custom signing keys. This process is adapted from several guides but the gist of it is that I use grub ...
user avatar
0 votes
0 answers
122 views

How to transfer dual boot system to new SSD

My Toshiba Satellite L650-1PR laptop has been warning me for the past 4 days that its hard drive (750GB, SATA, 5400rpm HDD) is about to crash 'in less than 24 hours'. So I'm thinking of replacing it ...
user avatar
  • 43
0 votes
1 answer
62 views

Tell/verify properties of boot loader

Given that we have a USB stick with GRUB boot loader, how to tell (from Linux command line) whether it is UEFI? whether it is secure boot and verify it? As for research, there are guides for ...
user avatar
  • 103
3 votes
0 answers
752 views

Issues with booting a custom Kali Linux Live USB on computers with Secure Boot

As a project for a portable copy of my VM workspace and for later use in recovering dead drives (my main laptop is a 2015 model so data rescue is something to be concerned about), I’m trying to create ...
user avatar
2 votes
1 answer
463 views

Does secure boot + shim protect against evil maid?

I'm setting up my arch linux to dual boot with windows and secure boot enabled. As far as I have understood secure boot, the goal is to prevent an attacker from modifying the boot manager and/or ...
user avatar
  • 131
4 votes
1 answer
1k views

Signing grub for secureboot uefi: Secureboot forbids to load module (memdisk)/boot/grub/x86_64-efi/normal.mod

While trying to setup secureboot in custom Debian based system, grub is not loading if SB is on. I'm using shim (signed by MS) as first stage bootloader. Now I plan to use MOK to sign grub2 and ...
user avatar
0 votes
0 answers
313 views

Enable shim Debian for secureboot

In my Debian system, default efi bootloader is grubx64.efi. I need to use shimx64 for secureboot to work. My machine comes with microsoft keys, so it'll work. I installed the signed shim package and ...
user avatar
2 votes
2 answers
2k views

Keyboard does not work in MokManager during key enrollment

I am trying to enroll a MOK under Ubuntu 20.04.1 for supporting some third-party kernel modules while keeping Secure Boot enabled. The system boots fine with the stock kernel and modules, but I am ...
user avatar
  • 11.4k
0 votes
1 answer
528 views

Any way to restrict disabling of secure boot?

I have secure boot enabled and require signing of kernel modules before loading. The key used for signing is on an external drive to reduce chances of the key being compromised and being used to sign ...
user avatar
  • 486
0 votes
1 answer
91 views

How to blacklist Microsoft Keys in secureboot

I recently managed to get secure boot working on my system with Arch Linux. I am using custom keys over preloader/shim I would like to blacklist Microsoft's key. Is this possible. If so how?
user avatar
  • 3
5 votes
2 answers
4k views

Why I can't load signed VirtualBox kernel modules in Debian with SecureBoot enabled?

With Debian testing and SecureBoot enabled: I need to sign VirtualBox modules, as the output of the vboxconfig command says: vboxdrv.sh: Stopping VirtualBox services. vboxdrv.sh: Starting VirtualBox ...
user avatar
  • 61
1 vote
1 answer
944 views

GRUB2 problem with secure boot?

I want to boot the Win10 installer with grub chainloading. So I copied the contents of the Win10 iso to an exfat partition (also tried ntfs) on my USB storage device and typed chainloader (hd0,gpt3)/...
user avatar
-3 votes
1 answer
151 views

Unable to install kali linux dual boot on windows 7 32 bits

sorry for english grammar mistake. I know that for dual boot secure boot must be disable to install other OS. My pc have not secure boot option so i unable to install kali os . when we want to install ...
user avatar
3 votes
0 answers
202 views

Secure Boot - how does Linux revoke/blacklist vulnerable boot loaders/boot managers/kernel/modules signed with shim's built-in key?

Background Shim can have a certificate built into it during compilation (see "Shim keys" paragraph here). The corresponding private key can then be used to sign the boot loader/manager and ...
user avatar
  • 31
0 votes
1 answer
3k views

When I run mokutil, I get Failed to enroll new keys

When I run mokutil --import MOK.der, I get ❯ mokutil --import MOK.der input password: password should be 1~256 characters input password: Failed to enroll new keys
user avatar
  • 22.4k
6 votes
1 answer
4k views

Why does the kernel lockdown prevent hibernation?

In my systemd jounal (journalctl) I often see this message: hibernation is restricted; see man kernel_lockdown.7 This seems to stem from the kernel lockdown feature that (only?) is active when you ...
user avatar
  • 2,126
2 votes
1 answer
24 views

Can I require binary X to be booted only by a bootloader signed with key Y?

If I include Microsoft's keys in my secure boot setup, then any malware which has a Microsoft key can boot my Linux binary. Can I restrict my Linux binary to be booted only by a bootloader signed with ...
user avatar
  • 129
1 vote
1 answer
164 views

Manually enrolling Debian KEK

I dual booted Ubuntu on my spare disk (next to main Ubuntu disk) to check if I am going to convert the main instance away from Ubuntu. One of the reasons I chose Debian is because it supports ...
user avatar
  • 111
1 vote
2 answers
4k views

Should I disable secure boot to install arch linux

I have copied arch linux iso image in a usb using rufus. I want to install arch linux on my laptop But should I disable Secure Boot in BIOS settings? Many OS Installations need it to be disabled. Is ...
user avatar
  • 135
21 votes
2 answers
62k views

What exactly is MOK in Linux for?

Upon installing Nvidia drivers I was promoted to set up a MOK password or third party drivers may not work properly, so I created one. After reboot I was presented with a blue MOK management screen ...
user avatar
  • 313
6 votes
0 answers
1k views

How to hibernate Debian with Secure Boot enabled and fully encrypted disk?

I'd like to be able to hibernate another one of my Debian/KDE machines because it's practical and I'd like to save some energy. I can't hibernate another one which has a swapfile and Secure Boot ...
user avatar
  • 3,420
0 votes
1 answer
605 views

Required key not available when running nslookup, dig

I upgraded my system recently, and now I am seeing a really bizarre error, any ideas on what I can do to fix this issue?: nslookup 8.8.8.8 ../../../../lib/isc/unix/socket.c:2135: internal_send: 192....
user avatar
  • 3,746
1 vote
1 answer
669 views

Load rootfs from fit image and signature verification

I am new to fit image and secure boot. I created fit image using mkimage command and added kernel dtb and rootfs into it. Goals: Need to boot up from fit image kernel rootfs and dtb. I am able ...
user avatar
0 votes
0 answers
714 views

Can't boot Manjaro from Live USB

I'm currently running Ubuntu 18.04 on Surface Pro 3 and I'm trying to install Manjaro on my machine through a live USB that I've created with this command: sudo dd bs=4M if=/path/to/manjaro.iso of=/...
user avatar
2 votes
0 answers
570 views

Can't boot Ubuntu 19.04 or Ubuntu19.04 LiveUSB after enrolling MOK [closed]

(I've asked this question on AskUbuntu with no response after 4 days.) Before showing GRUB, it shows Unable to trigger tcg2 final events table: Invalid Parameter Something has gone seriously ...
user avatar
  • 121