Questions tagged [secure-boot]
Questions for UEFI Secure-Boot, Secure-Boot Key Signing and Management
124 questions
1
vote
1
answer
42
views
Installing Rocky Linux when secure booting in BIOS is disabled
My colleague created a Rocky Linux 10 USB drive to replace Windows 11. However, he can't boot from it because it only seems to accept UEFI 'secure' boot options. He had disabled secure booting in the ...
- 113
1
vote
0
answers
61
views
Why is my unsigned BOOTX64.EFI able to boot with Secure Boot enabled?
I am trying to understand Secure Boot and what it is doing on my system. I am using systemd-boot as my bootloader, not shim or GRUB, and Secure Boot is reported as enabled: running mokutil --sb-state ...
- 11
0
votes
0
answers
92
views
Cloning Linux installation to another drive
I've backed up a Fedora 42 installation using tar, and now I am trying to restore the backup to a different drive on the same system, basically cloning the original installation.
The original ...
- 1
0
votes
0
answers
191
views
How to secure boot raspberry pi4 with u-boot yocto image
The goal is to sign the mender yocto image and run it on secure boot enabled raspberry pi.
I have raspberrypi-4 and the yocto image from mender (open source OTA platform).
To give a quick try here is ...
- 1
1
vote
1
answer
59
views
Disabling Secure Boot on a Home Computer running Linux
How likely is it that disabling Secure Boot on a home computer running Linux would suffer from the advertised threat of
unauthorized code—such as bootkits and rootkits—from being executed
during the ...
- 539
0
votes
1
answer
92
views
Can DPDK Work With UEFI SecureBoot Enabled - Kernel Lockdown Mode?
Apologies in advance if I have incorrect assumptions in the post.
I'm still getting the hang of DPDK.
Basically, I am trying to utilize DPDK on a Generation 2 Hyper-V VM that has Secure Boot enabled.
...
- 1
2
votes
1
answer
1k
views
Secure Boot with grub and no third party keys
Two common ways to do Secure Boot are:
EFI -> shim -> grub -> kernel
EFI -> UKI
I want to keep grub, but discard all third party keys and use my own. One option would be to recompile ...
- 183
0
votes
1
answer
139
views
Debian FAI live system can't boot with secure boot enabled
I made a custom live system using the Debian FAI service. I can't boot it with secure boot as my laptop is not recognizing the signature somehow. But I can still boot my currently installed Debian ...
- 856
2
votes
0
answers
107
views
Is it possible to boot an unsigned kernel from a signed bootloader?
I am trying to build a tool to allow people to create network-bootable Linux environments. The primary use case is for mass deployment and configuration of end user devices. Most of these devices have ...
- 121
2
votes
1
answer
250
views
Shim boot loader: System is compromised when using certificate, but not with hash
I am trying to boot a Linux kernel with efi stub enabled using Red Hat's Shim https://github.com/rhboot/shim.
I can boot the system if I enroll the hash of my efi stub (selecting GRUBX64.EFI), but ...
- 131
1
vote
0
answers
637
views
Kerrnel Locked Down from EFI secure boot, secure boot disabled in bios
I wanted to ask about something happening on my Debian 12 machine.
When I run journalctl as root I get this message: "Kernel is locked down from EFI Secure Boot; see man kernel_lockdown.7"
I ...
- 11
1
vote
1
answer
2k
views
About Secure Boot, MOK and NVRAM
Good evening, after searching on google I didn't find the answer to my question.
When installing a distribution such as Ubuntu with secure boot activated, the installer creates a MOK key in the NVRAM ...
user611925
1
vote
1
answer
333
views
How to compare secure boot keys stored in motherboard’s firmware database with the signed .efi files?
It’s a piece of cake to enable secure boot in a virtual machine, but I’m struggling to do the same with OpenSUSE on my 2012 vintage computer which refuses to boot in secure boot mode even in the ...
- 219
0
votes
0
answers
114
views
Mass install linux by dd to drive directly?
I need to install an custom OS to many similar/identical laptops. Would it work to live boot a laptop and dd the disk from a template laptop to the new one? Is it possible to trigger secure boot key ...
- 61
0
votes
0
answers
311
views
How to disable kernel_lockdown (MSR) without BIOS or console access
I have a laptop with a damaged screen. I use it by connecting a screen via HDMI. I'm running some cryto mining software that requires MSR access to run efficiently.
I cannot access the BIOS to disable ...
