3

I have a dual boot (UEFI) Windows 10 Pro and Ubuntu 16.04. During Ubuntu install IT asked me to turn off secure boot, so I did it, using the installer. When I finished installation, I turned secure boot on again in BIOS, but I keep getting this:

Booting in insecure mode_

Every time I start my PC, before entering GRUB. I checked it on Windows and it says that secure boot is enabled, same as my BIOS. I am attaching a photo of my BIOS config:

Obviously sorry for quality :-D

How can I turn secure boot back on so Ubuntu will see it as enabled? Is there any way to get rid of this annoying message? Thanks in advance ;-)

2
  • grubx64.efi will boot either a signed or unsigned kernel. Are you booting the signed kernel (kernel name ends in .signed if it is the signed one)? If not, you might get the message.
    – ubfan1
    Apr 26, 2016 at 4:14
  • How do I check IT?
    – ikurek
    Apr 26, 2016 at 9:29

3 Answers 3

2

I know that Dell ships their Linux systems with a variable set that disables validation: https://bugzilla.redhat.com/show_bug.cgi?id=1544794

The solution is to enable validation in that case. Perhaps this is what you're seeing? Try running:

mokutil --enable-validation
0

That message is normally displayed by Shim when the system is configured with Secure Boot disabled. I seem to recall it being displayed in error on at least one system, but I don't recall the details. If this is what's happening, you won't get rid of the message, so you should simply learn to live with it -- at least, unless and until an updated Shim binary is released that fixes the problem.

You may want to check your Secure Boot mode in Ubuntu, though. You can do so as follows:

$ hexdump /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c
0000000 0016 0000 0001                         
0000005

The first line of output shows the value of the EFI's SecureBoot variable. In this case, it ends in 0001, which indicates Secure Boot is active. If it reads 0000 instead, that means it's inactive. If you get a No such file or directory error, that means that the system doesn't support Secure Boot at all (or maybe that it's supported but has never been active), which is effectively the same as it being inactive.

If the firmware's own UI says that Secure Boot is active but it's inactive in Ubuntu, then that suggests a problem somewhere. I know some recent versions of Shim have a way of effectively bypassing Secure Boot if they're configured in a certain way, so that might be what's going on; but I'd need to dig a little deeper to figure out what that feature is or how to check or reconfigure it.

2
  • 1
    I got this: 0000000 0006 0000 0001 / 0000005
    – ikurek
    Apr 26, 2016 at 19:50
  • In that case, it looks like your system is booted with Secure Boot active, and the message to the contrary at boot time is in error. At least, I'd say that's about 90% likely to be the case; it could also be you've got some other exotic bug that's causing Secure Boot to appear to be active in the firmware and in two OSes when in fact it's not active. You could always try testing it by attempting to boot something that's not signed; you should get an error message or possibly just a failover into the next boot option.
    – Rod Smith
    Apr 26, 2016 at 22:44
0

You can check the status of Secure Boot by -

$ mokutil --sb-state

For you, the output might be -

SecureBoot enabled
SecureBoot validation is disabled in shim

You need to use the following command to re-enable Secure Boot validation, which will eventually not show the text "booting in insecure mode".

$ sudo mokutil --enable-validation

Here, the command will ask you to enter a password. This password is not your login password but just a temporary password. You need to set a password which will be asked in the following steps.

Now, restart and follow the instruction shown on Perform MOK management blue screen.
Select Change Secure Boot state.

Sources -
https://wiki.debian.org/SecureBoot
https://wiki.ubuntu.com/UEFI/SecureBoot

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .