Questions tagged [secure-boot]
Questions for UEFI Secure-Boot, Secure-Boot Key Signing and Management
107
questions
0
votes
1
answer
77
views
Bricked my PC trying to setup secure-boot
I have dualboot (windows & arch), i was trying to setup secure boot in arch using sbctl. But i think i ran the wrong command and bricked my keys. Now when i startup computer, it get stuck in blank ...
0
votes
0
answers
24
views
Signing Nvidia drivers for Secure Boot - Nvidia module location
I want to sign my nvidia driver so I can use it with Secure Boot.
I'm trying to follow these instructions for nvidia driver:
https://wiki.debian.org/SecureBoot#Using_your_key_to_sign_modules_....
- 33
1
vote
0
answers
48
views
Verifying a signature of an EFI binary
I'm exploring UEFI secure boot and want to verify the certificates of the signed binaries.
The code below shows there are indeed some signatures present:
sbverify --list $BOOT/EFI/BOOT/BOOTX64.EFI
...
- 5,765
0
votes
0
answers
73
views
Debian SecureBoot with shim on MSI difficulty
I'm having a difficult time getting Debian 12 to boot UEFI with secureboot.
This is on an MSI Meg Z490 Unify motherboard. GPU is an AMD WX3200.
Secure Boot is enabled with standard mode and default ...
user432564
1
vote
1
answer
355
views
MOK signed NVIDIA drivers are not loading after some time
From time to time my NVIDIA drivers (signed with MOK) are not being loaded on my dual boot machine (Ubuntu 22.04 and Windows 11). I'm resolving the issue by reinstalling the same drivers with the same ...
- 13
0
votes
0
answers
98
views
Why do I never need to use the Secure Boot Password? (No MOK Management Screen)
Recently I've been trying out Ubuntu and Zorin OS and in both cases I was asked to create a secure boot password during the installation that you would be promted to enter when starting up the system ...
- 1
1
vote
1
answer
487
views
How can Linux hibernation be enabled under UEFI Secure Boot with kernel lockdown on select current distributions (or main line kernel)?
When running under UEFI Secure Boot with a current Linux distribution, "kernel lockdown" will be instated. Multiple kernel messages along the lines of
Lockdown: swapper/0: hibernation is ...
- 21
0
votes
0
answers
73
views
TinyCore with GRUB2 and secure boot out of the box
I’m trying to put manually GRUB instead of Windows boot loader (without chainloading) over a UEFI with secure boot enabled computer.
I tried to put shimx64.efi and mmx64.efi at the ESP alongside ...
- 1
0
votes
1
answer
174
views
How to configure Secure Boot with own keys and import Microsoft KEK and DB certificates?
I am in the process of configuring Secure Boot with my own keys (PK, KEK and DB). And so far I have done everything:
Building Unified Kernel Image (UKI)
Making standalone GRUB binary
Generating own ...
- 13
1
vote
0
answers
60
views
Help with Understanding MoK/Secureboot
I'm trying to understand How MoK shim64 works exactly.
What I understand it as is:
Securenboot has a list with Whitelisted Kernerl-hashes belonging to
Windows, Ubuntu, Fedora, OpenSuse and others.
...
- 31
0
votes
0
answers
51
views
Update kernel with MOK enrolled and secure boot activated
I've enrolled some MOKs to sign several modules (they only print in the systemd log).
The keys are visible in /proc/keys so they are kernel dependent.
I'll update the kernel via apt and I'm not sure ...
- 1
2
votes
1
answer
72
views
With Unified Kernel Images, how are custom initrd scenarios (such as multipath boot) addressed?
I was looking at the Fedora change set for 38 and saw this which seems like a neat idea but I was wondering how this affects systems that need custom files to be present in the initrd. One example is ...
- 16.7k
0
votes
0
answers
351
views
Debian Stable , just updated, Nvidia drivers didn't get built/brought to current kernel via dkms. How to build/activate after update?
Debian Stable , just updated, Nvidia drivers didn't get built/brought to current kernel via dkms. How to build/activate after update?
I have a Debian 11 stable install, (Secure Boot is enabled) that ...
- 1
0
votes
0
answers
171
views
Cant Load NVIDIA Driver Though Mok Util says it is loaded
I have made a post before with questions about how to load Nvidia drivers while using Secure Boot. There I mentioned mokutil, however I did not have it properly installed and was using the out of date ...
0
votes
1
answer
168
views
Puppy Linux secure boot key
I want to sometimes use Linux, sometimes windows.
I found out that, Puppy Linux is small, I can install it on a USB. But the problem is, if I click on my USB in the boot menu, I have to disable secure ...
0
votes
0
answers
183
views
Secure Boot Password not working on Ubuntu (Dell)
I've been trying to disable Secure Boot on my Dell laptop but it's not working. Every part of the process till the blue screen seems to work fine. But once I enter my password it does not work. It ...
0
votes
0
answers
681
views
Grub loads unsigned kernel with secure boot enabled
I am currently dual booting Gentoo and Windows (on two different disks). I boot on the linux drive with grub2, where I can choose either Gentoo or Windows (added by os-prober).
Recently, I updated ...
- 1
1
vote
0
answers
476
views
Ubuntu 20.04 USB failed SecureBoot
I am trying to install Ubuntu 20.04 with Windows 11. However when I select the USB to boot, it shows "Operating System Loader signature found in SecureBoot exclusion database("dbx"). ...
- 11
0
votes
1
answer
170
views
Is there a downside to a signed kernel?
Mostly a general linux question, but where it needs to be specific I am referencing Debian 12 Bookworm amd64 UEFI booting through grub(not direct kernel stub).
I have secure boot disabled in firmware ...
- 229
0
votes
2
answers
197
views
Secure Boot & admin password
I have a PC with a mechanical interrupt in order to enable different hdds and use different OS.
Windows has bee installed with bios legacy. I want to install in the other HDD archlinux.
When I try ...
- 31
1
vote
1
answer
636
views
What is this update exactly designed for? (new BIOS?)
I own a rather older piece of server, Dell PowerEdge T20, with the latest BIOS version A20, link to Dell updates, screen of the update in case link goes dead in time:
This morning, when SSH'd into ...
- 27.8k
0
votes
0
answers
707
views
Are MOK (Machine Owner Key) deleted after OS reinstall or Secure Erase (Data Wipe) on BIOS/UEFI level?
Some time ago I have installed Ubuntu 22.04 and installed proprietary nvidia drivers on it. That triggered creation of the new MOK (Machine Owner Key). In a meantime I have decided to reinstall the ...
- 1
0
votes
0
answers
575
views
USB Bootable gparted supporting Secure Boot
I want to be able to move and resize partitions on my systems, so I wanted to make a live GParted USB, thing is, it doesn't support Secure Boot, Ubuntu is overkill and takes long to boot (and ...
- 1,811
2
votes
1
answer
3k
views
Operating System Loader signature found in SecureBoot exclusion database ('dbx'). All bootable devices failed Secure Boot verification
I just downloaded Pop!_OS 22.04 LTS (NVIDIA) from the official website, verified the checksum, flashed to a pen drive, and attempted to boot from it.
I forgot to disable Secure Boot as advised on the ...
- 4,457
0
votes
0
answers
595
views
Pop OS Latest Nvidia Driver Update Does Not Work with Secure Boot
I have secure boot enabled on my machine, I used this to do it, I updated my system and noticed nvidia-smi is now giving me:
NVIDIA-SMI has failed because it couldn't communicate with the NVIDIA
...
1
vote
1
answer
2k
views
Arch Linux and secure boot issues
I want to install arch linux on my laptop, but I want to be able to play my games that require secure boot on windows 10. I found a tutorial to make it secure boot compatible:
Flash the ISO on the usb ...
- 11
0
votes
1
answer
2k
views
GRUB2 Multi-Linux Dual Boot (Secure Boot & shimx64.efi)
I am attempting to create an ultimate USB Stick that will contain 2 Linux Distros, Windows and a Plethora of ISOs.
So far I have installed Windows, Ubuntu and Fedora Silverblue to a disk (I've been ...
0
votes
0
answers
1k
views
Can't install Pop!_OS because secure boot won't disable
I'm trying to install Pop!_OS on my Windows 10 Acer Aspire E5-573G from a USB stick but I keep getting this message:
error: /casper_pop-os_22.04_amd64_nvidia_debug_125/vmlinuz.efi has invalid ...
1
vote
1
answer
1k
views
Editing grub menu with secure boot enabled Ubuntu/PartedMagic
I have laptop DELL latitude 5491 with preinstalled Windows 10 with secure boot enabled and EFI mode. After I purchased, I installed Ubuntu 20.04 next to Windows as a dualboot with still secure boot ...
- 11
1
vote
2
answers
4k
views
Reset my BIOS. Now how do I fix "Invalid signature detected. Check Secure Boot Policy in Setup."?
Follow up to Grub updated and now I can't get in to the BIOS, how can I fix it?. Short version: couldn't boot to a USB thumbdrive after updating grub. I reset the BIOS to factory default (with the ...
- 1,149
0
votes
0
answers
1k
views
Kernel doesn't seem to be signed for Secureboot. (linux-image-5.17.5-76051705-generic )
I've been trying to get secure boot enabled but don't manage to do it. I have installed shim and Grub correctly with
sudo apt install shim-signed && sudo grub-install
However, when I boot, I ...
- 101
0
votes
1
answer
23k
views
Can't load self-signed kernel with Secure Boot on: "bad shim signature"
I'm running ubuntu with Secure Boot on. Everything works fine when I use a kernel that comes packaged from cannonical. Still, I have issues running a self-signed kernel. I'm pretty sure my signature ...
- 23
1
vote
0
answers
280
views
external boot efi shell when secure boot is turned on
I don't have a built in uefi shell in my laptop and I have secure boot turned on.
I would be happy for a signed uefi shell that I can boot into (edk2, tianocore shell.efi files are not signed and I ...
- 11
4
votes
1
answer
413
views
How come Fedora ignores `module.sig_enforce` kernel parameter if SB is enabled but Arch does not?
I recently secure-booted Arch and Fedora on my RTX3050 equipped laptop.
As is the common knowledge, I had to sign my Nvidia modules on Fedora for the kernel to load them. However, I find that same is ...
- 73
2
votes
1
answer
3k
views
Linux Kernel signature error after signing
OS: Ubuntu 20.04
Machine: Dell XPS 13 9370
Attempting to upgrade from Linux kernel 5.13.0 to 5.16.14. Have verified that kernel 5.16.14 runs properly without secure boot. Followed instructions here ...
- 121
2
votes
2
answers
1k
views
Patching the kernel to allow hibernation with secure-boot enabled
My current config is Windows-11 (required for my job) and Ubuntu 21.10 dual-booting on an HP Probook G10. Since I have to have secure-boot to run Win-11, I have to live without hibernation on Linux (...
- 143
1
vote
1
answer
412
views
UEFI SHIM Error "verify_buffer() No signatures found"
Continuing from UEFI Self-Signed Kernel loading from a Microsoft Signed OS Loader I used https://github.com/rhboot/shim/releases/tag/15.4 and built on my local machine (Ubuntu 18.04 LTS)
openssl req -...
- 53
1
vote
2
answers
2k
views
UEFI Self-Signed Kernel loading from a Microsoft Signed OS Loader
I am writing my own OS loader (Boot Loader) in UEFI.
The OS Loader is Microsoft Signed so it can run under secure-boot.
The OS Loader will be able to load Windows or Linux Kernel based on User's ...
- 53
2
votes
0
answers
354
views
Virtualbox: WARNING! Diff between built and installed module
After I signed Virtualbox for secure-boot on Debian I typed dkms status.
I've got that message :WARNING! Diff between built and installed module.
Is that because I signed the module ?
- 21
1
vote
0
answers
221
views
Failed to delete secure boot state in Ubuntu - dual boot with Windows 11
I have dual booted Ubuntu with Windows 11 and the Wi-Fi adapters were not detected.
So I have done something and they were working but after 2-3 days again the same problem occurred but this time it ...
- 11
1
vote
2
answers
4k
views
GRUB loader won't start in secure boot
I have a dual boot setup. I am using Kali Linux and Windows 10. They were working fine until I forgot to shut down my system and Kali went into hibernation. After that PC shutdown-ed because of low ...
- 143
0
votes
1
answer
2k
views
Re-enable and Disabling secure boot on dual boot WIN 11 and Kali?
So, I am basically a Linux user and just hop onto Windows whenever I want to play games or anything stupid. Most of my games now actually run when secure boot is enabled but as I am using Kali already ...
- 1
2
votes
0
answers
480
views
Change Secure Boot Mode EFI Variable without entering the firmware setup GUI?
I am trying to figure out a way to change the secure boot setting from Windows, Linux, or an EFI shell. I assume this is impossible as that would defeat the whole purpose of secure boot, however I ...
- 21
0
votes
1
answer
1k
views
What does signing drivers / modules do and what is the significance?
Having recently installed a driver which required for the module to be signed manually it was confusing what signing that module was actually doing and why it had to be done.
There are other questions ...
- 735
4
votes
2
answers
3k
views
LUKS + TPM2 + PIN
I am currently aware of two recent methods to bind a LUKS encrypted root partition to a TPM2: systemd-cryptenroll and clevis. Both of them seem to release the encryption key after successfully ...
- 175
0
votes
0
answers
43
views
apt - run script after update using secure boot custom keys
If I replace Microsofts secure boot keys with my own via the UEFI facility to add your own keys, and configure everything properly, will I need to re sign shim/kernel/etc. every time my computer ...
- 746
0
votes
1
answer
1k
views
Invalid signature detected in secure boot, how to fix?
I'm getting "Invalid signature detected in secure boot".
All solutions that I've found says to disable secure boot in BIOS, which seem to be an insecure thing to want to do.
How can I have ...
- 1
11
votes
2
answers
15k
views
"Enroll MOK" dialog after the 1-st reboot when you install Linux Mint 20.1 - what is it for (secure boot)?
I have a dual boot laptop Windows 10 / Linux mint 20. Secure boot enabled and also hard disk encryption, but the latter is maybe not important for the question.
By the way, my question is very similar ...
- 417
4
votes
1
answer
4k
views
How to verify signed UEFI binaries?
I'm trying to understand why secure boot works on my machine. It is enabled in the UEFI config, everything boots just fine, and mokutil --sb-state says SecureBoot enabled. But I think it shouldn't. ...
- 5,384
2
votes
2
answers
1k
views
Custom signed Centos 7 PXE Secureboot with Shim and grub: invalid kernel signature
As the title suggests, I'm trying to set up a system that uses PXE boot to boot into CentOS7 with custom signing keys. This process is adapted from several guides but the gist of it is that I use grub ...
- 21