# PreLoader.efi: What's wrong with my Secure Boot settings?

I installed Arch Linux with Secure Boot enabled using PreLoader. I enrolled the hash for loader.efi, containing rEFInd, and vmlinuz-linux using HashTools. The problem is that I get a message saying:

The system found unauthorized changes on the firmware, operating system or UEFI drivers. Press [N] to run the next boot device, or enter directly to BIOS Setup if there are no other boot devices installed. Go to BIOS Setup > Advanced >Boot and change the current boot device into other secured boot devices.

I always get this message twice. When I press N after the first message shows up, the rEFInd menu shows up. After I select Arch Linux and hit enter, the message shows up for the second time and I have to press N again to boot into Arch. It seems to me that the hashes are correctly enrolled, since both rEFInd and Arch is booting. I also checked the EFI boot entry, and it only contained the entries for rEFInd and Windows, so it can't be another unsigned boot loader getting in the way. Is there any way I can get rid of this message besides disabling Secure Boot? BTW, I'm using an ASUS motherboard with the latest firmware.

EDIT: I have the following files under /boot:

• initramfs-linux.img
• initramfs-linux-fallback.img
• intel-ucode.img
• refind_linux.conf
• vmlinuz-linux
• EFI/refind/HashTool.efi
• EFI/refind/refind.conf
• EFI/refind/icons/*.png
• EFI/refind/keys/*.cer

EDIT: output of efibootmgr -v:

BootCurrent: 0000
Timeout: 0 seconds
BootOrder: 0000,0001,0004

• Do you have any EFI filesystem drivers installed in rEFInd's drivers or drivers_x64 subdirectory? If so, you must enroll their hashes, too. Also, look for stray binaries in the rEFInd directory -- it could be that PreLoader is trying to launch Binary X, failing because its hash is not enrolled, and falling back on Binary Y. – Rod Smith Feb 18 '16 at 14:26
• Thanks for your reply I checked /boot, and I couldn't find any drivers or binaries other than vmlinuz-linux, initramfs-linux, intel-ucode.img, loader.efi, HashTool.efi, and PreLoader.efi. – Sora Minazuki Feb 18 '16 at 14:46
• Please edit your question to show the output of efibootmgr -v. (Add four characters to the start of each line to preserve the formatting.) – Rod Smith Feb 18 '16 at 19:36
• It looks correct to me. I have two thoughts. One is that you might not be running from the Boot0000 entry, but from the Boot0001 entry, if PreLoader were installed in place of EFI\Microsoft\Boot\bootmgfw.efi. You can check for a loader.efi file there, or try launching it directly from the firmware's boot manager, to test this hypothesis. My other thought is that PreLoader might just not be working well with your firmware. In this case, switching to Shim makes sense. Shim now works with hashes as well as signed binaries, although my testing of it this way is limited. – Rod Smith Feb 19 '16 at 21:44