2

When I installed Ubuntu 22.04.4 on a system of mine just now, with secure boot enabled, I opted to enable third party drivers, and left "Configure secure boot" ticked, and entered a password.

enter image description here (illustrative screenshot borrowed from another question about an earlier Ubuntu but the window contents are exactly the same even though the window borders are old style now)

After reboot, I did get a MokManager menu where the default option was to continue booting, and I wasn't prompted for the password I set there.

What I am unsure about is whether that password needs to be stored somewhere for future driver installations throughout the lifetime of this Ubuntu installation, or whether it's just a one-shot password that's used for the next boot and I'll be prompted for another one if something else needs it for a later kernel module installation.

Closest question and answer is this: https://askubuntu.com/a/815614/1242564 but it doesn't answer my precise question of whether the password needs to be remembered in the long term.

Also can someone suggest a package I might install from APT that would test this? e.g. would VirtualBox do it as IIRC it has a DKMS portion to it?

1 Answer 1

3

The Secure Boot password you created is persistently stored in the motherboard of the computer. Because the Secure Boot password is persistently stored in the computer's motherboard you need to save it in a safe place where it won't be lost if something bad happens to the operating system or if you decide to remove or reinstall Ubuntu.

The Secure Boot password is used to generate a key that interacts with the computer's UEFI firmware and is stored in a secure area on the motherboard. Since the key is tied to the UEFI firmware it is independent of whatever operating system that is running on the computer.


During the Ubuntu installation a UEFI Secure Boot window may appear with this message.

You have chosen to enable third-party software as part of your install, which for this system includes hardware drivers for graphics and/or wi-fi hardware. Your system also has UEFI Secure Boot enabled. UEFI Secure Boot is not compatible with the use of these third-party drivers.

After installation completes, Ubuntu will assist you in disabling UEFI Secure Boot. To ensure that this change is being made by you as an authorized user, and not by an attacker, you must choose a password now and then use the same password after reboot to confirm the change.

Warning: If you choose not to install these drivers, or if you proceed but do not confirm the password upon reboot, Ubuntu will still be able to boot on your system but these third-party drivers will not be available for your hardware.

The password you set during the Ububntu installation process persists on your motherboard's UEFI firmware, not within Ubuntu itself. It's independent of the operating system.

3
  • Thanks for answering this, though since reading that I found this which, while not directly contradicting that it's stored on the motherboard, it doesn't mention it (nor does the GUI) as being something that happens. It talks about the keys being enrolled in the firmware at one point, but only ever mentions password being asked for on the next boot. wiki.ubuntu.com/UEFI/SecureBoot Unfortunately nothing in the installer GUI or that document explicitly states how long the password needs to be remembered for, which would be very useful! Apr 24 at 9:48
  • A related answer (which I didn't find initially) also contradicts this and says it's temporary. askubuntu.com/a/868315/1242564 . I think the installer needs to be crystal clear about this because it's really important. I don't know which answer is correct! Where's the right place to file a bug? Apr 24 at 9:57
  • I added the text from the relevant window in the Ubuntu installer to my answer. If you decide to report a bug to Launchpad you can include this text in your bug report.
    – karel
    Apr 24 at 10:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .