Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So, the last time I used my Ubuntu installation was last night. Today, as I booted it up, it told me that booting grubx64.efi is not allowed. Easy enough. I know how to re-enable it from my BIOS.

After re-enabling it, I try booting again and get the following error:

error: Secure Boot forbids loading module from (hd0, gpt7)/boot/grub/normal.mod

And then there's this some kind of 'grub resuce' CL prompt below that error. Never figured it out except that ls is a valid command. Using ls displays various (hdx , *) files/directories/drives.

Note that, as I never got to load Windows 8 from GRUB despite various tutorials, I use rEFInd to switch between loading GRUB (which, in turn, I use to load Ubuntu) and Windows 8.

How do I re-enable GRUB (and get to Ubuntu) and does anyone know what just caused this problem? I remember installing Ubuntu updates last night but I can't remember if there was anything that might relate to something UEFI-specific.

share|improve this question
up vote 3 down vote accepted

I haven't figured out an exact solution for this but I managed to get back to Ubuntu by a more "general" (for lack of a better term) solution.

I was having a look around at my BIOS when I noticed an option to turn off Secure Boot (wonder why I never noticed it before when I was having trouble dual booting Win8 and Precise). I turned this off and voila, GRUB loads. What's more is that I can now load Windows 8 from GRUB; I no longer need rEFInd as an intermediary. Choosing Win8 from GRUB shows some error tho (which I can bypass with just a press of any key). I'll look into this some other time, unless I figure it's something really risky.

share|improve this answer

As you've discovered, disabling Secure Boot fixes the problem. My hunch is that you either had it disabled before and somehow accidentally enabled it or you were using a Secure Boot-enabled version of GRUB before and a software update installed an unsigned GRUB or changed the boot path in a way that bypassed the shim program (which is what Ubuntu uses to support Secure Boot).

Another option is to add Secure Boot support more generally. If your first boot loader is rEFInd, you can read rEFInd's Secure Boot documentation for details of how to get it to work with Secure Boot. Unfortunately, Ubuntu doesn't yet ship with a MOK-enabled version of shim, so you'll need to install another version of shim and add Ubuntu's public key to your MOK list. This is possible, and it's not even all that hard, but it involves using several command-line tools and following instructions pretty precisely. Note that Ubuntu added Secure Boot support with version 12.10. I noticed a 12.04 tag on your question, so if you're using 12.04, your kernels are almost certainly not signed, which will complicate this fuller use of Secure Boot. Overall, it's probably best to leave Secure Boot disabled; I mention this alternative in case you have reason to enable it.

share|improve this answer

the problem you are facing could be due to the fact of some mandatory (arm) based and not so mandatory (intel) processors bearing the windows 8 logo.. Which in majority is secure boot, which "With Secure Boot active, the firmware checks for the presence of a cryptographic signature on any EFI program that it executes". To get around this, you most likely will need to disable secure boot. Take a look into this article for some history and what you need to know to get the job done:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.