I have recently bought a laptop with windows 8 (EFI) installed. I thought I'd be able to handle installing 12.04.2 relatively easily - how wrong could I be?

Using a live-usb I made using startup disk creator on ubuntu with a 64 bit .iso file...
*I First tried to install ubuntu in legacy mode without a boot partition which needless to say didn't work.
*I then reinstalled ubuntu with the boot partition, still using legacy. This time I managed to get the grub menu to show up but I only had the choice of booting into Ubuntu. (unless I told it to boot in EFI mode and then it only booted windows)
*I tried boot-repair both times and that didn't help things at all.

I now realise I can't boot ubuntu in legacy mode if windows is booting in EFI.
So I need to boot from the live-usb in EFI mode. But when I enable EFI mode and boot from USB FLASH DRIVE it says: FLASH DRIVE HAS BEEN BLOCKED BY THE CURRENT SECURITY POLICY. (or something to that effect)

Is there a problem with the way I made the live-usb?
How am I supposed to boot from the live-usb in EFI mode if I get the error message each time?

I realise lots of people are asking these sorts of questions at the moment, but I've been looking for a while and I haven't found any solutions that work. :/ Thanks for your help!


Go in your BIOS settings and disable secure boot. There must be an option somewhere.

| improve this answer | |
  • 1
    If Legacy is enabled, secure boot is by default disabled, but if EFI is enabled secure boot is by default enabled. I can't enable or disable secure boot independent of these settings. – Ricardinyo Apr 7 '13 at 21:10
  • There's almost certainly a way to disable Secure Boot while leaving EFI-mode booting enabled. If there isn't, it's a serious flaw in the design of the firmware, and maybe a violation of the vendor's contract with Microsoft. That's not to say that the setting will be obvious -- a lot of EFI interfaces have user interfaces that make the interface of an Apple II look like something wondrous and advanced! – Rod Smith Apr 8 '13 at 18:07
  • 3
    Haha! Ok, so at first I didn't really want to set a supervisor password, but once I did I could edit any of the settings. Then when I turned of secure boot it made everything work! Thanks! :) – Ricardinyo Apr 8 '13 at 21:52
  • Oh, one other question. Can I enable secure boot again or should I leave it as it is? – Ricardinyo Apr 8 '13 at 22:32
  • Leave it as it is ;-). To much work to make this work with ubuntu. – Thomas15v Apr 9 '13 at 16:55

In my case after setting the admin password I had to clear the EFI image on the USB pendrive for boot (I had an entry on a different BIOS page that let me do that).

BTW, after installing, I had to do the same with the shim64.efi image that the installer put on the HD and then I had to change the boot priority of the "ubuntu" boot image over the windows 8 one.

| improve this answer | |

The Ubuntu 12.04.2 64 bit or the Ubuntu 12.10 64 bit should both be capable of being booted on a machine with secure boot turned on. If there are problems, it may be the fault of the machine -- this is a new area and the vendors are still working things out. For instance, Toshiba's got a firmware update (6.60) to straighten out a key/database problem in Jan 2013. Check your vendor for the latest firmware. There may be other problems with getting the install to work, usually a result of getting the EFI directory files messed up. The first thing you should do after successfully booting the live media is to back up the files in /boot/efi (this set will boot Windows). After the install, back them up again to another location (this set should boot Ubuntu). Boot-repair may fix problems with these files, but some problems are not fixable. For instance, grub may successfully boot Ubuntu, but fail to boot windows, even with all the correct commands. You will need to ensure first you even have the correct commands since you did the MBR change. For non-fixable problems, fall back to a second boot device with it's own copy of the EFI partition and files. That way, you can boot Windows off one set, and Ubuntu off the other.

| improve this answer | |

I wanted to be able to use Grub2 personally. I run Linux mint but it's similar enough in this respect that it should work regardless, I've even applied the same principles to install red hat as well so I could study for the RHCSA and RHCE exams (wish me luck).

  • Disable secure boot and enable both legacy and efi booting
  • burn a normal x64 Ubuntu/Linux iso to a flash drive or DVD
  • boot into the DVD and perform a normal legacy installation, including installing grub2 to the root of /dev/sda, and make sure the live system is connected to the internet
  • once installation is complete and you're on your live DVD, take a deep breath and open a terminal
  • Live CD's don't let you use the root account and insist on using sudo but I have not seen any benefit to using sudo on the live disk vs simply becoming the root user and doing what you need to do. You of course want to be extremely careful but on the other hand we won't be rm'ing anything or overwriting anything, just installing and uninstalling packages.
  • type the commands:

    $ sudo -s
    # passwd
    Enter new UNIX password:
    Reenter new UNIX password:
    Password successfully changed...
    # exit
    $ su
  • You will now be the root user, our next task is to mount our newly installed system, You need to know the partition layout and the drive layout but I'm going to assume this:

    • /dev/sda (only internal hard drive)
    • /dev/sda1 (EFI system Partition)
    • /dev/sda2 (Windows System)
    • /dev/sda3 (Recovery Image)
    • /dev/sda4 (Recovery Program)
    • /dev/sda5 (diagnostic)
    • /dev/sda6 (your new /boot/ system)
    • /dev/sda7 (your new linux swap)
    • /dev/sda8 (your new / system)
    • /dev/sda9 (your new /home/ system)
  • If you need to figure this out, you can use the command sudo parted /dev/sda list

  • Now let's mount our system # mount /dev/sda8 /mnt/ # mount /dev/sda6 /mnt/boot/ # mount /dev/sda9 /mnt/home/ # mount /dev/sda1 /mnt/boot/efi/ # # this is optional here, you can mount the windows partition if you want # mount /dev/sda2 /mnt/mnt/ # # this below is also necessary, it mounts the virtual file systems # mount -o bind /dev/ /mnt/dev/ # mount -o bind /dev/pts/ /mnt/dev/pts/ # mount -o bind /sys/ /mnt/sys/ # mount -o bind /proc/ /mnt/proc/

  • Ok, at this point, your /mnt/ basically looks exactly and I mean exactly like that system would if you had booted into it, in fact the only thing that's different at this point besides differences in network configuration is that the root directory isn't the system's root and we're about to fix that. Before we do however, If something doesn't work after you issue the next command you'll need to use the exit command to get back and fix it before going back to the new root.

  • Change the root for the system to the newly installed system: # chroot /mnt/
  • Alright, you're in the new system and it's time to make some changes... #> apt-get update #> apt-get purge grub-pc
  • YUP, You're going to destroy grub and get rid of it for all eternity.... ok, you're just swapping it for grub-efi
  • now do this: #> apt-get install grub-efi
  • now we have the correct package for grub, now let's put things where they belong #> grub-install #> update-grub
  • This command might give you a warning but as long as the next set of commands gives you the listed results, you're good. Specifically it will complain about not having efi variables because "efivars" isn't loaded into the kernel (that's because you booted in legacy mode, but that doesn't matter for this part, it just means your live disc cannot bless the firmware which we're gonna take care of in a few steps.
  • and now let's make sure that things are where they should be... #> ls -R /boot/efi/EFI/* | grep grubx64.efi /boot/efi/EFI/ubuntu/grubx64.efi
  • If you see the output above then we're in good shape. remember that path...
  • and now that we're in good shape... #> exit # shutdown -r now

Ok... GRUB won't load.... I knew that was coming. Everything is set up, you just need to bless the firmware.... Well, mac calls it "bless", but we're going to do this in windows so we need to use bcdedit. We need to first bring up an admin command prompt. If you're in windows 7, it's in the start menu, if you're in windows 8, right click on the bottom left corner of the desktop and it will be right there in the menu. So issue this command...

C:\WINDOWS\system32> bcdedit /set {bootmgr} path \EFI\ubuntu\grubx64.efi`

Where \EFI\ubuntu\grubx64.efi is the path you recorded earlier without /boot/efi and switching the forward slashes for backslashes... type the /set {bootmgr} path exactly as written, type in the curly braces and the words you see. the only thing you're changing is the path at the end of the command.

and reboot.

You should now be looking at the grub menu and be able to select linux or windows. Enjoy!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.