Questions tagged [secure-boot]

Questions for UEFI Secure-Boot, Secure-Boot Key Signing and Management

Filter by
Sorted by
Tagged with
18
votes
2answers
2k views

The UEFI & SecureBoot impact, how severe?

I'm planning to buy a new laptop in the coming days, and I'm quite impressed with new, cool Ultrabooks. As a long-time GNU/Linux user, I'll of course install a distro of my choice on it. Chances are ...
16
votes
2answers
50k views

What exactly is MOK in Linux for?

Upon installing Nvidia drivers I was promoted to set up a MOK password or third party drivers may not work properly, so I created one. After reboot I was presented with a blue MOK management screen ...
10
votes
2answers
5k views

How can I secure the initrd and grub.cfg using secure boot?

I'm using the default ubuntu approach with shim and grub2, combined with my own platform key (self-signing shim with sbsign) and an encrypted root partition, to secure boot my ubuntu installation. But ...
7
votes
3answers
12k views

Is there a way to enable secure boot in Linux?

Just like Windows has secure boot that prevents any external OS Loader code from running at boot, does Linux have any similar option for itself? I have looked around, but when I search, the only ...
6
votes
1answer
3k views

Why does the kernel lockdown prevent hibernation?

In my systemd jounal (journalctl) I often see this message: hibernation is restricted; see man kernel_lockdown.7 This seems to stem from the kernel lockdown feature that (only?) is active when you ...
5
votes
2answers
3k views

Why I can't load signed VirtualBox kernel modules in Debian with SecureBoot enabled?

With Debian testing and SecureBoot enabled: I need to sign VirtualBox modules, as the output of the vboxconfig command says: vboxdrv.sh: Stopping VirtualBox services. vboxdrv.sh: Starting VirtualBox ...
5
votes
0answers
3k views

"Enroll MOK" dialog after the 1-st reboot when you install Linux Mint 20.1 - what is it for (secure boot)?

I have a dual boot laptop Windows 10 / Linux mint 20. Secure boot enabled and also hard disk encryption, but the latter is maybe not important for the question. By the way, my question is very similar ...
5
votes
0answers
1k views

How to hibernate Debian with Secure Boot enabled and fully encrypted disk?

I'd like to be able to hibernate another one of my Debian/KDE machines because it's practical and I'd like to save some energy. I can't hibernate another one which has a swapfile and Secure Boot ...
4
votes
1answer
904 views

Signing grub for secureboot uefi: Secureboot forbids to load module (memdisk)/boot/grub/x86_64-efi/normal.mod

While trying to setup secureboot in custom Debian based system, grub is not loading if SB is on. I'm using shim (signed by MS) as first stage bootloader. Now I plan to use MOK to sign grub2 and ...
4
votes
1answer
4k views

How do I use custom-signed shim for secure boot (Fedora)?

I'm not sure whether there's a guide for this but I'd like to know the detailed steps (step-by-step guide perhaps?) involved in achieving the following: Re-sign shim with a custom CA private key, but ...
3
votes
1answer
9k views

How to boot Arch Linux installation medium with Secure Boot enabled?

I've got a new laptop with a Samsung BIOS (version P08AFD) and Aptio Setup Utility. When I try to boot a USB stick with Arch Linux 2016.10.01 it says that the signature is invalid. The documentation ...
3
votes
1answer
458 views

UEFI Secure boot key restrictions?

Following the instructions here: Secure Boot - ArchWiki worked great last year (2016). However, any keys created since the start of 2017 are refused by my Dell Optiplex 7440's UEFI firmware. I can ...
3
votes
1answer
754 views

How to verify signed UEFI binaries?

I'm trying to understand why secure boot works on my machine. It is enabled in the UEFI config, everything boots just fine, and mokutil --sb-state says SecureBoot enabled. But I think it shouldn't. ...
3
votes
2answers
4k views

Disabling secure boot and third party drivers

Whilst installing linux mint 19.1 cinnamon i checked the "I want third party drivers box". However, upon checking that box i was prompted to create a password in order to disable secure boot. Thus, ...
3
votes
1answer
6k views

Can't load zfs kernel module on Fedora with Secure Boot - "Required key not available"

I'd like to use zfs with my Fedora 20 system. I've installed the ZFS on Linux Fedora repository and subsequently the kernel-devel and zfs package. As far as I can tell, everything was installed ...
3
votes
3answers
8k views

Possible to dual boot Linux Mint on any Windows 8 laptop?

I'm searching for a new laptop, and I'm currently considering getting an ASUS N56VZRH71. Everything spec-wise looks good (except for the absence of an SSD), but I want to know if I'll be able to dual ...
3
votes
3answers
690 views

Linux Mint 14.1 not bootable because of "secure boot"

I'm trying to install Linux Mint 14.1 on my Lenovo B570, but when I try to boot the thumb drive, it displays a message: "Secure boot is not enabled" and then goes black screen. I read lots of posts on ...
3
votes
0answers
521 views

Issues with booting a custom Kali Linux Live USB on computers with Secure Boot

As a project for a portable copy of my VM workspace and for later use in recovering dead drives (my main laptop is a 2015 model so data rescue is something to be concerned about), I’m trying to create ...
3
votes
0answers
174 views

Secure Boot - how does Linux revoke/blacklist vulnerable boot loaders/boot managers/kernel/modules signed with shim's built-in key?

Background Shim can have a certificate built into it during compilation (see "Shim keys" paragraph here). The corresponding private key can then be used to sign the boot loader/manager and ...
3
votes
1answer
1k views

Signing a compressed kernel module for use with Secure Boot

I'm having a little trouble signing my zfs module in Fedora 27 using UEFI/Secure Boot and I hoped someone here might be able to help. As a quick explanation for how I would normally do this, I sign ...
3
votes
0answers
7k views

Sign GRUB2 bootloader to enable UEFI secure boot

Following preliminaries: Linux 4.2.3-gentoo GRUB2 UEFI, Secure Boot off Now, I want to mess with the secure boot so I'm able to turn it on. More or less following this guide, I have: backed up the ...
3
votes
1answer
885 views

Protecting file system contents with TPM and Encrypted File System

I have been assured that this is possible, but have so far not found any reference that will clue me as to how to do it. I need to deploy an "appliance" with software and data that the user is ...
2
votes
1answer
879 views

Latest Ubuntu and Secure Boot

Can anyone tell me whether it is necessary, or even recommended to disable Secure Boot in UEFI before doing a fresh Ubuntu installation? Ditto for CSM or Legacy Boot(BIOS) mode. I leave both ...
2
votes
2answers
534 views

Can I safely resize my partition from its beginning?

Currently dual booting Windows 8 and Linux Mint 14, sooner or later I will give more space to my Linux system. Is resizing my Linux partition from the beginning a safe operation ? If yes, could you ...
2
votes
1answer
336 views

Does secure boot + shim protect against evil maid?

I'm setting up my arch linux to dual boot with windows and secure boot enabled. As far as I have understood secure boot, the goal is to prevent an attacker from modifying the boot manager and/or ...
2
votes
2answers
1k views

Keyboard does not work in MokManager during key enrollment

I am trying to enroll a MOK under Ubuntu 20.04.1 for supporting some third-party kernel modules while keeping Secure Boot enabled. The system boots fine with the stock kernel and modules, but I am ...
2
votes
1answer
20 views

Can I require binary X to be booted only by a bootloader signed with key Y?

If I include Microsoft's keys in my secure boot setup, then any malware which has a Microsoft key can boot my Linux binary. Can I restrict my Linux binary to be booted only by a bootloader signed with ...
2
votes
1answer
1k views

Signing a key via mokutil

After successfully installing Linux Mint 19.1 Cinnamon for the first time, I went through the recommended steps to take after the installation. Here I also upgraded my system (after checking for and ...
2
votes
1answer
427 views

Verify integrity of EFI file before chainloading

Can I, in GRUB, configure it to verify if the EFI file it is going to chainload being signed (using the Secure Boot database) and refuse to boot if not signed? I had to disable secure boot for GRUB to ...
2
votes
0answers
546 views

Can't boot Ubuntu 19.04 or Ubuntu19.04 LiveUSB after enrolling MOK [closed]

(I've asked this question on AskUbuntu with no response after 4 days.) Before showing GRUB, it shows Unable to trigger tcg2 final events table: Invalid Parameter Something has gone seriously ...
1
vote
2answers
26 views

UEFI Self-Signed Kernel loading from a Microsoft Signed OS Loader

I am writing my own OS loader (Boot Loader) in UEFI. The OS Loader is Microsoft Signed so it can run under secure-boot. The OS Loader will be able to load Windows or Linux Kernel based on User's ...
1
vote
2answers
3k views

Should I disable secure boot to install arch linux

I have copied arch linux iso image in a usb using rufus. I want to install arch linux on my laptop But should I disable Secure Boot in BIOS settings? Many OS Installations need it to be disabled. Is ...
1
vote
1answer
1k views

how do I scan the windows partition for malware?

Hopefully, not too broad of a question. For Windows 10, I was considering dual booting at least for the purposes of malware detection and removal. While AVG, and probably others, offer live rescue ...
1
vote
1answer
477 views

How can i secure boot any Linux grub loader?

To secure boot an Ubuntu installation i use shimx64.efi loader. Trie to copy-paste it to the boot directory of my Kali Linux (whose GRUB loader i am currently using), but it doesn't seem to work. How ...
1
vote
1answer
121 views

Manually enrolling Debian KEK

I dual booted Ubuntu on my spare disk (next to main Ubuntu disk) to check if I am going to convert the main instance away from Ubuntu. One of the reasons I chose Debian is because it supports ...
1
vote
1answer
2k views

Neon installation - Secure Boot vs third party drivers

I try to install KDE Neon 18.04 on my Dell Laptop (from USB drive). The installer asks me if I want to use third party software/drivers. Yes, I want to use them (when available). Directly below that ...
1
vote
1answer
1k views

Build Archiso with proper UEFI SecureBoot signing

I'm building an Archiso live USB. My goal is to make it SecureBoot compatible (users with SecureBoot enabled should be able to boot it). It seems like this has been asked before (How to boot Arch ...
1
vote
1answer
364 views

adding grub to secure boot signature bricked my pc

I have a bought a new pc with a ryzen 7 1700 from MEDION. The PC works well under Windows and Linux with Secure Boot disabled. But the problem came when I wanted to enable grub with secure boot. As I ...
1
vote
1answer
129 views

How can I replace the (unsigned) bootloader in Debian with the one from Ubuntu to make it bootable one a Secure Boot-enabled device?

Ubuntu 16.04 boots fine on my UEFI pc with secure boot turned ON Debian 8.6 doesn't because its bootloader isn't signed How can I replace the bootloader that is present in Debian with the one found ...
1
vote
1answer
131 views

How could this happen: Secure boot on my UEFI seems to work for Ubuntu but not Fedora or Debian?

I re-enabled secure boot on an existing system. It then refused to boot the installed Debian 7, or my boot disc for Fedora 20 Live. I'm sure Fedora Live passed secure boot on this system before. ...
1
vote
1answer
781 views

Why am I getting "no boot disk has been detected" after installing Linux?

After installing a Linux distro (Fedora 19, to be exact) on a Windows 8 machine I got the message: No boot disk has been detected or the disk has failed. What did I do wrong?
1
vote
0answers
25 views

Virtualbox: WARNING! Diff between built and installed module

After I signed Virtualbox for secure-boot on Debian I typed dkms status. I've got that message :WARNING! Diff between built and installed module. Is that because I signed the module ?
1
vote
0answers
73 views

Change Secure Boot Mode EFI Variable without entering the firmware setup GUI?

I am trying to figure out a way to change the secure boot setting from Windows, Linux, or an EFI shell. I assume this is impossible as that would defeat the whole purpose of secure boot, however I ...
1
vote
1answer
691 views

LUKS + TPM2 + PIN

I am currently aware of two recent methods to bind a LUKS encrypted root partition to a TPM2: systemd-cryptenroll and clevis. Both of them seem to release the encryption key after successfully ...
1
vote
1answer
424 views

Custom signed Centos 7 PXE Secureboot with Shim and grub: invalid kernel signature

As the title suggests, I'm trying to set up a system that uses PXE boot to boot into CentOS7 with custom signing keys. This process is adapted from several guides but the gist of it is that I use grub ...
1
vote
1answer
696 views

GRUB2 problem with secure boot?

I want to boot the Win10 installer with grub chainloading. So I copied the contents of the Win10 iso to an exfat partition (also tried ntfs) on my USB storage device and typed chainloader (hd0,gpt3)/...
1
vote
1answer
584 views

Load rootfs from fit image and signature verification

I am new to fit image and secure boot. I created fit image using mkimage command and added kernel dtb and rootfs into it. Goals: Need to boot up from fit image kernel rootfs and dtb. I am able ...
1
vote
1answer
702 views

Shim only works in non-Secure Boot mode

I'm trying to get my dual boot (Arch+Win10) to work with Secure Boot. I followed the Arch Wiki, with the following steps. sudo mount /dev/sda1 /boot/efi sudo mv /boot/efi/EFI/Boot/bootx64.efi /boot/...
1
vote
0answers
178 views

Cannot find UEFI secure boot option

I have a Lenovo Ideapad y510p. I have been trying to install CUDA for GPU computing, but I've been unsuccessful so far. One common instruction is to disable the UEFI secure boot. The option simply ...
1
vote
0answers
2k views

building a uefi-secure boot debian-USB

Target: Debian with secure boot on USB Some Links I base my progress on rodsbooks efi-bootloaders installation rodsbooks efi-bootloaders secureboot https://wiki.ubuntu.com/SecurityTeam/SecureBoot ...