Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a happy user of Fedora 19 and I have it installed on a Samsung Series 5 laptop, which has an off board video card from NVidia - specifically a GeForce GT 630M. I managed to successfully install Fedora and dual boot it with Windows 8 (not via GRUB, but that's for another moment) and installed Bumblebee, since the Nouveau drivers cause the laptop to get really warm and don't provide a good energy management.

However, I can't get the Bumblebee compiled NVidia drivers to load - and I discovered that happens because of Secure Boot enabled! Since I don't know what kind of issue might arise from disabling Secure Boot, here comes my question: is there a way to make NVidia proprietary drivers load properly via Bumblebee without disabling Secure Boot?

I'm looking for some kind of signing which can make these drivers to load.

share|improve this question

Only under rare circumstances will disabling secure boot cause issues, and those circumstances are those where malware tries to change your boot order. If the easiest solution to your problem is disabling secure boot, then that's the best option. Careful browsing habits and antivirus software in Windows combined with using Fedora as a primary or secondary OS will make it highly unlikely you'll ever get malware that secure boot would stop.

share|improve this answer
Sounds fair - I'm going to consider this approach. – Mauren Sep 7 '13 at 2:37

Yes, you now can. The current version of bumblebee includes a new config file called bumblebee-nvidia-sign.conf where you can set your signing keys.

  • Search for "Signing Kernel Modules for Secure Boot" to learn how to create your keys, how to import them into the UEFI Secure Boot keys database, and how to sign drivers with them.
  • For bbswitch you need to sign them manually. But that is very easy, simply create a script under /etc/kernel/postinst.d/ with the following line:

perl /usr/src/kernels/$KVER/scripts/sign-file sha256 $KEYPATH/private_key.priv $KEYPATH/public_key.der /usr/lib/modules/$1/extra/bbswitch.ko

And your system will run that script after every new kernel install. So dkms will compile the driver for the new kernel and this script will sing it.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .