29

I have just installed Ubuntu 15.10, after having been with 16.04 LTS for some time to try it out. While I was using 16.04, I tried to install Nvidia Drivers and got told that I needed to disable SecureBoot for that, so I provided a password and on the next reboot some software asked for it. However, my BIOS settings still showed SecureBoot to be enabled, and I could still see how if I tried to boot from anything that wasn't signed, it would refuse to do so.

However, when I reinstalled Ubuntu 15.10 (completely deleting everything related to 16.04, including grub in the EFI partition), every time I boot I get a Booting in insecure mode message.

I have checked everything, and both: Windows and the BIOS setting report SecureBoot to be enabled

  • I've run into something similar with an HP EliteDesk 705, but I haven't yet investigated it fully. What make and model computer do you have, and what brand of EFI is it? (Typing dmesg | grep -i efi should produce output with EFI information. One of the first lines should identify the EFI's manufacturer, as in efi: EFI v2.31 by American Megatrends.) – Rod Smith Jan 27 '16 at 14:08
  • This is an MSI GS60 laptop, and the EFI is also by American Megatrends too. I find it strange how that happens even with Secure boot enabled – vagaerg Jan 27 '16 at 16:12
37

If you want get rid of the message about Insecure Boot you need to enable secure boot. To do this you need turn on validation in module MOK (Machine Owner Key):

sudo mokutil --enable-validation

You will be asked to enter twice temporary password and than after reboot get a possibility to change validation state.

If validation is enabled than no more message about insecure boot appears. But remember, you will not be able to run any unsigned drivers: nVidia drivers and VirtualBox will not be working.

To disable validation type:

sudo mokutil --disable-validation

and then reboot.

If you disable validation and have in BIOS Secure Boot switched ON, still you will not be able to boot anything that wasn't signed. Even though your ubuntu has validation disable but "is seen" by BIOS (UEFI) as signed because of shim-signed package. Shim package while your ubuntu is booting checks what is the MOK state and if validation is disabled shows message "Booting in insecure mode".

  • 1
    @Peter I can now run the nvidia proprietary driver with validation disabled AND Secure Boot switched ON in the UEFI. – sawablo Jan 4 '17 at 16:35
  • Virtualbox works here with validation activated. – omisson May 23 '18 at 18:02
  • You can run any proprietary or self-compiled kernel module with validation enabled if you sign it yourself and enroll your signing key as the MOK. See askubuntu.com/a/797442/12049 – ssice Feb 13 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.