3

I read that there is another way than using shim and signed GRUB binaries for Secure Boot by using the Linux Foundation's PreLoader or Linux Foundation's Secure Boot System, but how do I use it?

moved from https://askubuntu.com/a/520351/40581

1 Answer 1

7

Setting up PreLoader

  • Find and mount your EFI system partition and backup its contents. Some files may be manufacturer specific and cannot be restored by reinstalling Windows.
    • In a working UEFI Ubuntu installation it is mounted as /boot/efi/ and at least contains a folder named EFI. From the platform perspective (your computer) this folder is \EFI\ during the boot stage. ( /media/my_efi_system_partition/EFI = \EFI\ )
  • Copy or rename which ever EFI loader you want to use to \EFI\BOOT\loader.efi. Some loaders like gummiboot need to be configured properly.
  • Copy PreLoader.efi to \EFI\BOOT\bootx64.efi and HashTool.efi to the same directory.

You can find more detailed explanations over at Rod Smith's site.

Using HashTool

If you followed the instructions carefully and have Secure Boot enabled, you should be greeted by the following screens upon next boot, which guide you through enrolling the hash of the unsigned loader that would otherwise break the chain of trust.

┌──────────────────────────────────────────────────────────────────────────────┐
│                            Failed to start loader                            │
│                                                                              │
│          It should be called loader.efi (in the current directory)           │
│                     Please enrol its hash and try again                      │
│                                                                              │
│                I will now execute HashTool for you to do this                │
│                                                                              │
│                                                                              │
│                                     ┌────┐                                   │
│                                     │ OK │                                   │
│                                     └────┘                                   │  
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
└──────────────────────────────────────────────────────────────────────────────┘

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Select Binary                                 │
│                                                                              │
│               The Selected Binary will have its hash Enrolled                │
│            This means it will Subsequently Boot with no prompting            │
│    Remember to make sure it is a genuine binary before Enroling its hash     │
│                                                                              │
│                                                                              │
│                            ┌─────────────────────┐                           │
│                            │     Enroll Hash     │                           │
│                            │ Reboot to UEFI Menu │                           │
│                            │    Reboot System    │                           │
│                            │        Exit         │                           │
│                            └─────────────────────┘                           │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
└──────────────────────────────────────────────────────────────────────────────┘

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Select Binary                                 │
│                                                                              │
│               The Selected Binary will have its hash Enrolled                │
│            This means it will Subsequently Boot with no prompting            │
│    Remember to make sure it is a genuine binary before Enroling its hash     │
│                                                                              │
│                                                                              │
│                                ┌──────────────┐                              │
│                                │     ../      │                              │
│                                │  loader.efi  │                              │
│                                │ HashTool.efi │                              │
│                                │ bootx64.efi  │                              │
│                                └──────────────┘                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
└──────────────────────────────────────────────────────────────────────────────┘

┌──────────────────────────────────────────────────────────────────────────────┐
│                      Enroll this hash into MOK database?                     │
│                                                                              │
│                               File: \loader.efi                              │
│     Hash: 8D1B74227CB2EE6B23B829595B761BAA34D171337F70D44ABF542D5318BDBA08   │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                     ┌─────┐                                  │
│                                     │ No  │                                  │
│                                     │ Yes │                                  │
│                                     └─────┘                                  │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
│                                                                              │
└──────────────────────────────────────────────────────────────────────────────┘
7
  • I have exactly the same error "Failed to start loader" on a blue screen while booting Knoppix 7.6 from a USB stick (copied with Rufus). I followed exactly the same steps as you painted here with the consequence that the USB stick does not even get to that blue screen anymore afterwards. Now I get a black screen saying: "WARNING: No configuration file found." I have no idea what to do now.
    – Elmue
    Dec 12, 2015 at 15:09
  • Sorry I'm not familiar with Knoppix. I found this mail from Mr. Knopper that doesn't look like they are going to support Secure Boot like Ubuntu and Fedora do by signing kernels. I just downloaded 7.6 EN DVD ISO and found hashtool.efi and even keytool.efi. loader.efi belongs to Syslinux and No configuration file found. is a hint that preloader was able to chainload Syslinux, but Syslinux wasn't able to find it's configuration file, so it's not an issue with preloader. wiki.archlinux.org/index.php/Syslinux#UEFI_Systems
    – LiveWireBT
    Dec 12, 2015 at 15:51
  • Thanks for your answer. I already turned off secure boot in BIOS and still get the same error.
    – Elmue
    Dec 12, 2015 at 16:10
  • I tried to loop mount the iso, like I usually do but it exceeds the FAT filesize limit. Trying to launch it as a new VirtualBox EFI guest results in a Guru Meditation error.
    – LiveWireBT
    Dec 12, 2015 at 16:40
  • I'm not surprised. VirtualBox is a very crappy and buggy software. I used it once and I saw hundreds of "Guru errors" which happened randomly sometimes, and sometimes not. Don't worry: That is normal! After installing the operating system directly on harddisk on the same computer it worked. The best you can do with VirtualBox is uninstall it. It is not the same as installing an operating system into a real partition.
    – Elmue
    Dec 12, 2015 at 21:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .