Problem, new in 16.04:

When I run the command sudo mokutil --disable-validation to disable secure boot validation within Ubuntu, I am asked to type a password twice and then get the message

Failed to request new MokSB state

Google reveals very little about this obscure error message!

Consequences:

I cannot install nvidia drivers as a result - when the system reboots after the driver install I can't log in, and have to bring up a terminal to purge the drivers and reboot. I have never seen the post-boot interface for disabling secure boot (which I expected to see and was asked to set a password for). This sequence of events (no disabling of secure boot and then failed login) happens whether I select to install third party drivers (and "disable secure boot") during Ubuntu installation, or install them from the Additional Drivers menu, or install nvidia-364 from the graphics drivers ppa. (From what I can tell, Ubuntu is actually offering to disable secure boot validation within Ubuntu and leave the motherboard's secure boot setting unchanged - the terminology isn't helpful.)

Background:

I have an ASUS Sabertooth Mark 2 desktop with Nvidia GTX 970 that I dual boot with Windows 10 (using the BIOS boot override to choose the OS). Secure boot is enabled in the BIOS and I want to keep it that way for Windows at least. Ubuntu (15.10 and earlier) worked fine as the Shim (and grub?) were signed for secure boot, but no checking was done later in the boot process (when the nvidia drivers come into play). Ubuntu 16.04 newly enables checking throughout the boot process, but it's tripping up when it gets to the nvidia drivers.

  • 1
    You may need to disable Secure Boot using the firmware's own user interface. Details on how to do this vary from one machine to another. For several examples, see this page of mine. – Rod Smith May 11 '16 at 12:26
  • Hi Rod, is it not possible just to disable the validation for ubuntu, whilst leaving secure boot on in the bios (to secure Windows 10)? I suspect that my motherboard is refusing to save the EFI variables needed to trigger the disabling of validation on the next reboot. Is it not possible to start mokmanager.efi manually from grub (without the mokutil command and password setting) and disable validation from there? – starmine Jul 2 '16 at 23:13

while I did have a slightly different problem (my Broadcom Wifi driver wasn't working), the symptoms seem to be the same. I too had to enter a password during installation which was never checked after boot.

I too got the strange error message

Failed to request new MokSB state

after executing mokutil --disable-validation

However: in my case, the problem was I didn't type sudo: sudo mokutil --disable-validation. After that reboot, Shim was starting and I was able to disable secure boot after shim without disabling secure boot in the BIOS (which is necessary for Windows dual boot).

  • Unfortunately this still didn't work for me - I have always been using sudo, and also checked that the efivars are mounted as read-write. The problem seems to be that the disable validation command is trying to write a variable to the EFI flash storage on the motherboard itself. My motherboard is refusing to do this - it's a shame mokutil doesn't give a more detailed error message - perhaps because this motherboard storage is a very sensitive part of the system. I have left Secure Boot on and am doing without nvidia drivers. Not great, even video acceleration and vsync are missing. – starmine Jun 19 '16 at 12:58
  • Same situation here. Having to use Nouveau till a solution is found. – timkofu Apr 4 '17 at 13:13

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.