I run the latest Arch Linux image on ASUS Sabertooth 990FX and get this error.

Failed to install override security policy.

How can i fix it?

  • 2
    When and where do you see this error? – Karan Jul 3 '13 at 18:07
  • After UEFI loading, before kernel was run. – celebnseventeen Jul 3 '13 at 20:00
  • I just had this problem trying to UEFI-boot Arch Linux ISO (archlinux-2013.08.01-dual.iso) from USB. I have an ASUS E45M1-M PRO motherboard and I updated the firmware yesterday to version 1202 from 08/07/2012. My year-old ASUS Zenbook UEFI-boots just fine off this USB stick though so I'm quite confident that the USB stick is allright. ASUS BIOSes don't allow you to disable Secure Boot and I've found no such options in my settings. I guess I'll run old-fashioned BIOS-boot. vip.asus.com/forum/… – crow43 Aug 10 '13 at 17:42
  • I've got an ASUS P8H77-I motherboard, which does support Secure Boot and most definitely does permit disabling Secure Boot. The option to do so is poorly named, though; it's called OS Type, and to disable Secure Boot, you change the option from Windows 8 UEFI to Other OS. See here for more details. FWIW, I don't get the "failed to install override security policy" error on this board, so there may be a difference on this score between ASUS models. – Rod Smith Aug 12 '13 at 16:09
  • So, did any of the answers solve your problem? I am very curious to know! – SDG Apr 12 '16 at 11:47

I ran into the same error on an Asus UX21E machine. The latest BIOS (v 214) didn't fix the trick, and my USB disk was properly prepared as a EFI boot devices.

I was able to work around the problem using a hack I found on a related thread on the ArchLinux BBS. The gist of it is that since this system shipped with Windows 7 it doesn't have Secure Boot stuff enabled by default (in my case it isn't even supported). This thows off the ArchLinux boot routie which seems to expect it.

You can disable to check entirely by switching out which file the EFI system boots to. There are three .efi files in the ISO image. By overwriting the one your system is using with the simpler non Secure Boot enabled one, you can sidestep the whole problem.

  1. Mount your USB boot media (or unpack the ISO to later repack and burn if you must use a CD)
  2. Move to the directory where it is mounted and issue the following copy command:

    cp EFI/boot/loader.efi EFI/boot/bootx64.efi
  3. Boot that sucker up and eat cake.

Worked like a charm for me. For the record I used the 2013-11-01 Archlinux media.

  • Yep, that worked on my ASUS Sabertooth 990FX – bsd Apr 5 '14 at 17:11
  • This method worked on my Asus Crosshair V Formula. I verified it yesterday. Bios 1703. – 86bornprgmr Jul 27 '14 at 7:14
  • Worked like a charm on my MSI P67A (P67A-GD55) board as well. – Emil Lundberg Aug 12 '14 at 20:10
  • 1
    If someone has a problem with a read-only filesystem on an USB device: You have to mount the EFI Partition (fat32) and not the one with the iso9660 filesystem, to modify the files (the files are stored in both filesystems, but only the fat32 is writeable). My KDE caused some headache by mounting the write-protected filesystem by default. – JepZ Jan 12 '16 at 19:09
  • Finally! Grabbing my cake now :) Thank you Caleb! – SDG Apr 12 '16 at 12:06

The only reference I can find to that error message is in the source code to PreLoader.efi, the Linux Foundation's Secure Boot loader. It indicates that the program was unable to register itself as an extension to the firmware's built-in Secure Boot functions. This error is quite rare. As the developer of rEFInd, I'd be interested in knowing what firmware you've got (make and model of motherboard, as well as the publisher of the firmware and its version number). I also strongly recommend you e-mail Matthew Garrett and James Bottomley; they're the developers of shim and PreLoader, the two Linux Secure Boot solutions released to date. Both are likely to be interested in knowing about this failure, because it affects future directions for their Secure Boot solutions.

It's conceivable that a firmware upgrade would fix this problem, but I can't make any promises about that. If a firmware upgrade doesn't help, I recommend you disable Secure Boot in your firmware. Alternatively, you could try installing using shim rather than PreLoader; shim uses a different method to work around Secure Boot problems. Yet another option is to install your own keys in the firmware, but this procedure is quite tedious. Unless you really want to avoid using Microsoft's keys, this method is likely to be too much effort.

  • 1
    I had a similar problem. I noted some of the details in my answer, if more details are of interest to you or anybody I would be happy to assist. – Caleb Nov 14 '13 at 21:26
  • I too am currently experiencing this issue. I've been dredging google, arch wiki, superuser, ubuntu forums, and various other sites to try to find out if I can disable the secure boot. I am running an Asus Crosshair V formula (not a formula-Z) I'm running bios version 1703 x64 build date: 10/17/2012. It seems that this can be corrected with Caleb's response. I'm going to give that a bit of a try and see if it fixes things. I'll post another reply if it works. – 86bornprgmr Jul 25 '14 at 8:54

This motherboard uses a UEFI insecure boot (and the Asus CHF-V non Z version too).

  • To bypass plug the Arch USB installer into your current Windows OS.
  • Rename EFI-Bootx64.efi to Bootx64.bak
  • Copy loader.efi to bootx64.efi

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.