I read that there is another way than using shim and signed GRUB binaries for Secure Boot by using the Linux Foundation's PreLoader or Linux Foundation's Secure Boot System, but how do I use it?
moved from https://askubuntu.com/a/520351/40581
I read that there is another way than using shim and signed GRUB binaries for Secure Boot by using the Linux Foundation's PreLoader or Linux Foundation's Secure Boot System, but how do I use it?
moved from https://askubuntu.com/a/520351/40581
/boot/efi/
and at least contains a folder named EFI
. From the platform perspective (your computer) this folder is \EFI\
during the boot stage. ( /media/my_efi_system_partition/EFI
= \EFI\
)\EFI\BOOT\loader.efi
. Some loaders like gummiboot need to be configured properly.\EFI\BOOT\bootx64.efi
and HashTool.efi
to the same directory.You can find more detailed explanations over at Rod Smith's site.
If you followed the instructions carefully and have Secure Boot enabled, you should be greeted by the following screens upon next boot, which guide you through enrolling the hash of the unsigned loader that would otherwise break the chain of trust.
┌──────────────────────────────────────────────────────────────────────────────┐
│ Failed to start loader │
│ │
│ It should be called loader.efi (in the current directory) │
│ Please enrol its hash and try again │
│ │
│ I will now execute HashTool for you to do this │
│ │
│ │
│ ┌────┐ │
│ │ OK │ │
│ └────┘ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
└──────────────────────────────────────────────────────────────────────────────┘
┌──────────────────────────────────────────────────────────────────────────────┐
│ Select Binary │
│ │
│ The Selected Binary will have its hash Enrolled │
│ This means it will Subsequently Boot with no prompting │
│ Remember to make sure it is a genuine binary before Enroling its hash │
│ │
│ │
│ ┌─────────────────────┐ │
│ │ Enroll Hash │ │
│ │ Reboot to UEFI Menu │ │
│ │ Reboot System │ │
│ │ Exit │ │
│ └─────────────────────┘ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
└──────────────────────────────────────────────────────────────────────────────┘
┌──────────────────────────────────────────────────────────────────────────────┐
│ Select Binary │
│ │
│ The Selected Binary will have its hash Enrolled │
│ This means it will Subsequently Boot with no prompting │
│ Remember to make sure it is a genuine binary before Enroling its hash │
│ │
│ │
│ ┌──────────────┐ │
│ │ ../ │ │
│ │ loader.efi │ │
│ │ HashTool.efi │ │
│ │ bootx64.efi │ │
│ └──────────────┘ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
└──────────────────────────────────────────────────────────────────────────────┘
┌──────────────────────────────────────────────────────────────────────────────┐
│ Enroll this hash into MOK database? │
│ │
│ File: \loader.efi │
│ Hash: 8D1B74227CB2EE6B23B829595B761BAA34D171337F70D44ABF542D5318BDBA08 │
│ │
│ │
│ │
│ │
│ ┌─────┐ │
│ │ No │ │
│ │ Yes │ │
│ └─────┘ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
│ │
└──────────────────────────────────────────────────────────────────────────────┘
No configuration file found.
is a hint that preloader was able to chainload Syslinux, but Syslinux wasn't able to find it's configuration file, so it's not an issue with preloader. wiki.archlinux.org/index.php/Syslinux#UEFI_Systems
Dec 12, 2015 at 15:51