3

I have a dual boot (UEFI) Windows 10 Pro and Ubuntu 16.04. During Ubuntu install IT asked me to turn off secure boot, so I did it, using the installer. When I finished installation, I turned secure boot on again in BIOS, but I keep getting this:

Booting in insecure mode_

Every time I start my PC, before entering GRUB. I checked it on Windows and it says that secure boot is enabled, same as my BIOS. I am attaching a photo of my BIOS config:

Obviously sorry for quality :-D

How can I turn secure boot back on so Ubuntu will see it as enabled? Is there any way to get rid of this annoying message? Thanks in advance ;-)

  • grubx64.efi will boot either a signed or unsigned kernel. Are you booting the signed kernel (kernel name ends in .signed if it is the signed one)? If not, you might get the message. – ubfan1 Apr 26 '16 at 4:14
  • How do I check IT? – ikurek Apr 26 '16 at 9:29
1

I know that Dell ships their Linux systems with a variable set that disables validation: https://bugzilla.redhat.com/show_bug.cgi?id=1544794

The solution is to enable validation in that case. Perhaps this is what you're seeing? Try running:

mokutil --enable-validation

|improve this answer|||||
0

That message is normally displayed by Shim when the system is configured with Secure Boot disabled. I seem to recall it being displayed in error on at least one system, but I don't recall the details. If this is what's happening, you won't get rid of the message, so you should simply learn to live with it -- at least, unless and until an updated Shim binary is released that fixes the problem.

You may want to check your Secure Boot mode in Ubuntu, though. You can do so as follows:

$ hexdump /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c
0000000 0016 0000 0001                         
0000005

The first line of output shows the value of the EFI's SecureBoot variable. In this case, it ends in 0001, which indicates Secure Boot is active. If it reads 0000 instead, that means it's inactive. If you get a No such file or directory error, that means that the system doesn't support Secure Boot at all (or maybe that it's supported but has never been active), which is effectively the same as it being inactive.

If the firmware's own UI says that Secure Boot is active but it's inactive in Ubuntu, then that suggests a problem somewhere. I know some recent versions of Shim have a way of effectively bypassing Secure Boot if they're configured in a certain way, so that might be what's going on; but I'd need to dig a little deeper to figure out what that feature is or how to check or reconfigure it.

|improve this answer|||||
  • I got this: 0000000 0006 0000 0001 / 0000005 – ikurek Apr 26 '16 at 19:50
  • In that case, it looks like your system is booted with Secure Boot active, and the message to the contrary at boot time is in error. At least, I'd say that's about 90% likely to be the case; it could also be you've got some other exotic bug that's causing Secure Boot to appear to be active in the firmware and in two OSes when in fact it's not active. You could always try testing it by attempting to boot something that's not signed; you should get an error message or possibly just a failover into the next boot option. – Rod Smith Apr 26 '16 at 22:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.