Ubuntu 15.04 Secure Boot Problem

Question

I have a system with Ubuntu 15.04 and Windows 10 dual-boot. Everything worked fine with secure boot on. But now it suddenly stopped working and Ubuntu can't boot with secure boot turned on (through shimx64) and just redirects me to windows when I choose that option. I can however turn off secure boot and boot from my grubx64 boot option. There seems to be something wrong with shimx64 but I am not sure.

Here is my output from doing sudo efibootmgr -v:

BootCurrent: 000D
Timeout: 0 seconds
BootOrder: 0002,0003,000C,000D,0000,0001
Boot0000* P0: ST1000DM003-1ER162            BIOS(11,0,00)
Boot0001* P4: PLDS DVD+/-RW DH-16AES        BIOS(13,0,00)
Boot0002* ubuntu    HD(1,800,fa000,2c4c3f52-0207-45e5-bd9b-cc48a2e27dcf)File(\EFI\ubuntu\shimx64.efi)
Boot0003* Windows Boot Manager  HD(1,800,fa000,2c4c3f52-0207-45e5-bd9b-cc48a2e27dcf)File(\EFI\Microsoft\Boot\bootmgfw.efi)WINDOWS.........x...B.C.D.O.B.J.E.C.T.=.{.9.d.e.a.8.6.2.c.-.5.c.d.d.-.4.e.7.0.-.a.c.c.1.-.f.3.2.b.3.4.4.d.4.7.9.5.}...1...............
Boot000C* UEFI OS   HD(1,800,fa000,2c4c3f52-0207-45e5-bd9b-cc48a2e27dcf)File(\EFI\BOOT\BOOTX64.EFI)
Boot000D* ubuntu    HD(1,800,fa000,2c4c3f52-0207-45e5-bd9b-cc48a2e27dcf)File(\EFI\Ubuntu\grubx64.efi)

I notice that one of them is \EFI\Ubuntu\grubx64.efi and the other one is \EFI\ubuntu\shimx64.efi so there is capital "Ubuntu" for grubx64.efi and lower-case "ubuntu" for shimx64.efi. I'm not sure if this might be causing a problem. So here is what I did:

$ cd /boot/efi/EFI/
$ ls
Boot  Microsoft  ubuntu
$ cd ubuntu
$ ls
grub.cfg  grubx64.efi  MokManager.efi  shimx64.efi

So I saw that there was only one "ubuntu" directory and no "Ubuntu" directory. The "ubuntu" directory looks like it has shimx64.efi and grubx64.efi and everything else it needs to boot.

Finally I did sudo boot-repair and chose "Create Boot Info Summary" and here is the link: http://paste.ubuntu.com/12300679/. I noticed that /EFI/ubuntu/shimx64.efi was not listed under "Boot files" for sda1. I am not sure what caused it to stop working but it may have been because of an update. Any help is appreciated.

Answer 1

My hunch is that you're running into problems with the signature on your copy of Shim. This is a problem I've encountered before with some EFIs; they're sometimes finicky and don't like signed binaries that are just fine on other computers. Specifically, I've seen this problem with an ASUS P8H77-I motherboard -- but other brands and models may be subject to the same problem, as well.

If I'm right, you have basically two options:

• Disable Secure Boot.
• Find another (possibly older) Shim program and use it.

The first option is pretty self-explanatory and you've obviously discovered it already. For the second, there are probably at least a dozen Shim binaries floating around with Microsoft signatures. One that's never given me troubles, but that's old, is Matthew Garrett's signed Shim 0.2. To use it, you should overwrite the shimx64.efi and MokManager.efi binaries in /boot/efi/EFI/ubuntu with the ones from the archive you find. When you reboot, you'll probably be greeted by an ugly text-mode file selector (MokManager) that makes an Apple II's user interface look sophisticated. Use it to select a Canonical certificate file. This file is available in some Ubuntu package or other, but I don't recall which one. For convenience, I've collected several together for my own rEFInd program; see here for the individual files. You need the canonical-uefi-ca.der file, and it should be stored on the ESP (under /boot/efi in Ubuntu) so that MokManager can read it. Once you enter the Canonical signature file and exit from MokManager, the system might hang, reboot, boot into Windows, or boot into GRUB. The next time you boot, though, everything should work normally.

Using an older Ubuntu Shim package is likely to be a little easier, since you won't have to use MokManager. You'll need to track down an appropriate package, install it, and possibly copy the grubx64.efi and MokManager.efi files, as just described. Be sure to keep copies of those files somewhere safe, though; if my hypothesis is correct, the package manager is likely to try to upgrade Shim and replace your files with the broken version.

It's unlikely that the case difference you've observed is important. The ESP (mounted at /boot/efi in Ubuntu) uses FAT, which is a case-retentive but case-insensitive filesystem. In other words, ubuntu and Ubuntu are identical to FAT. OTOH, maybe your firmware has a case-sensitivity bug that interacts with the Secure Boot setting. That seems a bit far-fetched, but stranger things have happened.