1

Just bought a Toshiba Tecra R950 laptop, which comes with Secure Boot enabled by default, and Win8 preinstalled.

I wrote an Ubuntu 12.04 amd64 iso on an USB using Linux Live Usb Creator - LiLi (I use this on all Ubuntu installs), installed the OS alongside Windows8-64 and the system continued to boot in Windows 8 without any boot prompt.

I wiped Win8 (actually dd if=/dev/zero of=/dev/sda) and reinstalled, and the bootloader went for PXE boot (didn't recognize the grubx64.efi file in the EFI partition).

I tried the same with Ubuntu 12.10 and 13.04 with no success. I tried reinstalling grub-uefi-amd64-signed, running grub-install --uefi-secure-boot, copying grubx64.efi to /EFI/Ubuntu/ and adding the bootloader entry using efibootmgr, with no success. The bootloader just loads Windows (or PXE if no Windows is installed).

I tried changing the BootOrder via efibootmgr to make the Ubuntu entry the only option, with no success. Also tried setting the entry name to "Windows Boot Manager", didn't have any effect.

A trip to the BIOS Setup didn't help much. I can disable SecureBoot but I want to keep Windows8 setup in UEFI mode, and apparently I can't have Ubuntu installed alongside it. Also I don't see any section in the BIOS for adding additional UEFI bootloader keys.

Has anyone had any success booting Linux with Secure Boot enabled on this device ? Or on a similar Toshiba (Tecra) model ?

Improve this question

2 Answers 2

Reset to default
1

I've experienced dual-booting with dual-boot and UEFI. Here's what I did:

  1. Disable Secure Boot from BIOS (Keep it disabled, as it prevents booting once installed)
  2. Install Ubuntu normally

  3. Open up a Terminal from the live CD and run:

    sudo apt-get install boot-repair
sudo boot-repair
  4. Choose the recommended option and follow the instructions it gives you
  5. Reboot
  6. Your computer should boot straight into GRUB, with Ubuntu as the main option
Improve this answer
5
  • Thanks but I expressly need SecureBoot (i.e. the checking of bootloader certificates based on BIOS keys).
    – patraulea
    Jun 28, 2013 at 12:49
  • 1
    There is a good chance that Ubuntu will work with secure boot, but that is not true on all computers.
    – Dillmo
    Jun 28, 2013 at 12:51
  • I'm trying to figure out why it's not working on this Tecra (missing keys, installer bug, bios doesn't suport anything besides windows, ...)
    – patraulea
    Jun 28, 2013 at 15:23
  • Did you run boot-repair?
    – Dillmo
    Jun 28, 2013 at 15:56
  • Dillmo: I did. It made the existing win8 install unbootable. Anyway, this is a test laptop, I can wipe and reinstall as many times as needed, and I loathe SecureBoot as much as everyone, but it's for work and I need to test something against it (secureboot that is). It just seems that the UEFI firmware on this Toshiba model doesn't like anything except windows.
    – patraulea
    Jun 28, 2013 at 19:10
0

You do not need Secure Boot to boot Windows. If you're insistent on keeping Secure Boot because you (or your employer) want its benefits, you can almost certainly get it working; but if you're insistent on this point because you think disabling Secure Boot will prevent you from booting Windows, you needn't worry. Thus, I recommend you disable Secure Boot. Even if you want to keep it enabled in the long run, disabling it in the short term is a useful diagnostic tool because it will help you zero in on the cause of your problem. Even if it doesn't seem to help at the moment, keep it disabled until you can successfully boot Linux, then try re-enabling it. If you disable it, find it doesn't help, and immediately re-enable it, a subsequent attempt that should have worked might fail because of Secure Boot and you'd be none the wiser.

If you can boot with Secure Boot disabled but not with it enabled, you'll need to replace Ubuntu's outdated shim 0.1 with either shim 0.2 or PreLoader. These tools are all described on my Web page on Secure Boot. You might also want to consult my rEFInd Secure Boot documentation, which is more focused on rEFInd but might still be useful even if you're not using rEFInd.

In brief, Linux Secure Boot solutions involve running a Secure Boot program (shim or PreLoader), which add a new type of Secure Boot authentication to the system. These programs then launch the "real" boot loader (typically GRUB, but you can launch rEFInd or some other boot manager or boot loader, too). The boot loader checks back with shim or PreLoader to verify the authenticity of the kernel (or can choose not to do so, depending on the software involved), thus providing a link in the chain of trust. The trouble is that getting this all installed and set up can be tricky, since the relevant cryptographic keys or binary hashes have to be stored somewhere -- in the shim binary or in NVRAM. If you go with a non-Ubuntu solution, you'll need to store at least one key or hash (Ubuntu's) in NVRAM, and getting it in there requires a bit of juggling, as described on my Web pages. This isn't all that hard to do, but it requires some user interaction; if it didn't, it would be too easy for malware to install itself in a similar manner.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .