216
votes
Could not load 'vboxdrv' after upgrade to Ubuntu 16.04 (and I want to keep secure boot)
Since kernel version 4.4.0-20, it was enforced that unsigned kernel modules will not be allowed to run with Secure Boot enabled. Because you want to keep Secure Boot, then the next logical step is to ...
- 7,534
107
votes
Accepted
Why do I get "Required key not available" when install 3rd party kernel modules or after a kernel upgrade?
Since Ubuntu kernel 4.4.0-20 the EFI_SECURE_BOOT_SIG_ENFORCE kernel config has been enabled. That prevents from loading unsigned third party modules if UEFI Secure Boot is enabled.
The easiest way to ...
- 87.5k
51
votes
Why do I get "Required key not available" when install 3rd party kernel modules or after a kernel upgrade?
As suggested by user @zwets, I'm copying (with edits) an answer here:
Since kernel version 4.4.0-20, it was enforced that unsigned kernel modules will not be allowed to run with Secure Boot enabled. ...
- 7,534
50
votes
Is it safe to disable Secure Boot?
Secure boot forces both Windows and Ubuntu to require that all system level drivers are "signed", proving that they approved as authentic software. The idea is fairly good, and on Windows, Microsoft ...
- 66.8k
49
votes
Accepted
Ubuntu: "Booting in insecure mode" with SecureBoot enabled
If you want get rid of the message about Insecure Boot you need to enable secure boot.
To do this you need turn on validation in module MOK (Machine Owner Key):
sudo mokutil --enable-validation
You ...
- 506
43
votes
Accepted
Why disabling "Secure Boot" is enforced policy when installing 3rd party modules
This is not a bug, it is a feature.
As Anthony Wong says, when you install a DKMS package you are compiling the package yourself, thus, Canonical cannot sign the module for you.
However, you can ...
- 914
29
votes
Accepted
Stuck in terminal at Configuring Secure Boot
I did Ctrl + 'mousewheel down' (Ctrl + PageDown for those without mice) and a screen for typing password appeared.
I then typed password pressed Enter,
retyped password pressed Enter
and the ...
- 611
26
votes
Hibernate with UEFI and secure boot enabled
I have the same problem and, unfortunately, it's impossible with the official Ubuntu kernel since version 4.13 due to kernel lockdown patchset (efi-lockdown).
Substantiation is:
There is currently no ...
- 498
23
votes
Could not load 'vboxdrv' after upgrade to Ubuntu 16.04 (and I want to keep secure boot)
I know that this question is too old, but because there is no accepted answer and none of these answers solved the issue in my case, I am writing how I solved this today without disabling the Secure ...
23
votes
CPU running much harder/louder after software update
Killing is not an option and disabling SecureBoot is not good idea in UEFI era. The problem appears, because "frontend" program is waiting for password to enroll keys, but the GUI to type ...
- 331
22
votes
Accepted
Is secure boot properly enabled on ubuntu 16.10?
Install mokutil ( It is pre-installed on newer Ubuntu releases)
sudo apt-get install mokutil
mokutil is a tool that lets you add and/or remove machine owners keys ( MOK ).
Check if secure boot is ...
- 941
20
votes
Could not load 'vboxdrv' after upgrade to Ubuntu 16.04 (and I want to keep secure boot)
On my system I did the following to make it work:
Run mokutil:
sudo mokutil --disable-validation
Then mokutil asked me to set a password for the MOK Manager.
After rebooting the PC the BIOS showed ...
- 317
20
votes
Why disabling "Secure Boot" is enforced policy when installing 3rd party modules
In short, this is not a bug but a new change introduced in 16.04.
Because what you are installing is a dkms package. DKMS modules are compiled on your own machine and so Canonical can't sign the ...
- 882
19
votes
How to install nvidia driver with secure boot enabled?
Try this:
Download the latest driver from the NVIDIA website: https://www.geforce.com/drivers.
Create a new pair of private key (Nvidia.key) and public key (Nvidia.der) by running the command:
...
- 199
16
votes
Accepted
Is it possible to delete an enrolled key using mokutil without the original .der file?
To delete only one specific key from the database you could first use the --export flag, like so:
$ mokutil --export
This will export all machine owner keys to the current directory:
$ ls -1 MOK*
...
- 176
12
votes
Accepted
Why was I asked to create a password in order to disable secure boot on initial installation of Ubuntu 16.04?
UEFI Secure Boot protects your boot loader from being tampered with by using a combination of CA keys and signatures in boot files. Microsoft for example has signed boot loaders for which CA keys are ...
- 10.6k
11
votes
How Shim verifies binaries in secure boot?
Kaz Wolfe's answer is pretty good, but I want to emphasize and expand on a couple of points....
The last I checked, Shim basically provided a sort of parallel Secure Boot verification feature. It's ...
- 43.2k
11
votes
Accepted
How can I protect against single user mode
Potential Attacks
Single User Mode
This is the easiest way to gain unauthorised access to a Linux system is to boot the server into Single User Mode because it does not, by default, require a root ...
- 183
11
votes
Enroll a new Machine-Owner Key?
sudo dpkg-reconfigure virtualbox-dkms
if you need to get back to that dialog again.
Ubuntu 18.04 + virtualbox-dkms will only bring up that dialog box if you do not have a Machine Owner Key (MOK) ...
- 574
10
votes
Disable secure boot y/n?
Secure Boot prevents from booting unsigned operational systems.
It allows to boot only systems that are signed with a key that is stored in UEFI.
Ubuntu kernels are signed and you can install Ubuntu ...
- 87.5k
9
votes
Accepted
Install VirtualBox while keeping Secure Boot
I have not tried either of those procedures. I do, however, do this in a different way -- but it's a very tedious method. This description will make it seem easier than that because I refer to a big ...
- 43.2k
9
votes
Enroll MOK password doesn't match
I had the same problem and it enventually worked by typing the password as if I had a qwerty keyboard in the MOK manager, though it is an azerty one...
(note that I used a short password as suggested, ...
- 91
8
votes
Why do I get "Required key not available" when install 3rd party kernel modules or after a kernel upgrade?
You can disable Secure Boot (UEFI) in the BIOS with the following steps:
Reboot your machine and enter the BIOS Menu (In my case pressing F2)
Search for Secure Boot and change to Legacy
In an ASUS ...
- 125
8
votes
Is it safe to disable Secure Boot?
Yes, no, maybe so. This is really quite an opinionated question and not really about Ubuntu. Nevertheless, I will do my best to answer in an impartial way, so I don't start arguments and can allow you ...
- 19.3k
8
votes
Accepted
Is re-enabling Secure Boot in UEFI secure?
Yes, you can safely re-enable Secure Boot. It is very unlikely that something has been damaged.
Afterwards change the default boot loader from grubx64.efi to shimx64.efi in BIOS | UEFI.
Otherwise ...
- 30.6k
8
votes
Accepted
Module "ashmem" doesn't load with Secure Boot on (but "binder" does load with secure boot on)
You need to sign the module. Looks like it can be done with:
kmodsign sha512 /var/lib/shim-signed/mok/MOK.priv /var/lib/shim-signed/mok/MOK.der /lib/modules/`uname -r`/kernel/drivers/staging/android/...
- 289k
8
votes
Accepted
How do I boot to recovery mode in Ubuntu 20.04?
To boot into recovery mode, follow the steps in Takkat's answer, which I also mention here.
Before the Plymouth (boot splash) screen appears, press the Shift or Esc key (could be another key, as it ...
- 6,464
7
votes
Accepted
How to use the Linux Foundation's PreLoader?
Setting up PreLoader
Find and mount your EFI system partition and backup its contents. Some files may be manufacturer specific and cannot be restored by reinstalling Windows.
In a working UEFI ...
- 28.3k
7
votes
secure boot: verification of initramfs
According to my current understanding with regard to Ubuntu 20.04:
shim is signed by Microsoft's key and contains a Canonical key. Microsoft's key is shipped preinstalled in EFI, and is used to ...
6
votes
Why disabling "Secure Boot" is enforced policy when installing 3rd party modules
Another way to do it is to create your own key, insert the public part into the MOK database and sign the modules you compile with the private part.
Look here for detailed info: Could not load '...
- 71
Only top scored, non community-wiki answers of a minimum length are eligible