Questions tagged [secure-boot]
For questions on “Secure Boot” and “Restricted Boot” the new bios feature that is in computers with the “Windows 8” logo.
101
questions with no upvoted or accepted answers
5
votes
0
answers
3k
views
Kernel lockdown disallows loading of an self-compiled and self-signed in-tree kernel module
I'm having difficulties loading a kernel module that I myself compiled and signed for Secure Boot. The module in question is ec_sys, located within drivers/acpi directory of the kernel tree.
I'm using ...
4
votes
0
answers
530
views
If TPM owner password set in linux, how to enter owner password in windows to enable bitlocker?
I have successfully taken ownership of, and used various features of, my tpm in linux, using tpm_takeownership and related applications.
Now when I try to enter the owner password in windows to ...
3
votes
0
answers
400
views
Is it safe to keep the default MOK.priv on after a fresh install of Ubuntu 18.04.2 with secure boot enabled?
I'm new to secure boot strategy. I found there is a default paris, MOK.der and MOK.priv, inside shim folder after a fresh installation of Ubuntu 18.04.2. If I understand correctly, they're there to ...
3
votes
0
answers
5k
views
How can I reset the Secure Boot keys on my Surface Pro 4?
I have a Surface Pro 4 and I guess my secure boot keys got messed up somehow. On Surface Pro 3 this fix is as easy as going into the UEFI and resetting to the default keys, but there's no such option ...
3
votes
1
answer
2k
views
Can Windows 10 on BitLocker dual-boot with Ubuntu on LUKS?
Good afternoon all,
I would like to ask if having a dual boot system of Windows 10 and Ubuntu is possible with the features below activated.
Secure boot
UEFI
TPM
BitLocker
Hyper-V with the security ...
3
votes
0
answers
147
views
Secure Golden Boot Key - am I vulnerable?
I'm an Arch Linux user. I'd like to protect myself from the live-usb hack by using SecureBoot:
Create my own Platform Key and sign the kernel with my own key.
Delete the Microsoft PKs
Enable ...
2
votes
0
answers
276
views
How does PCIe card vendors sign option ROMs?
If secure boot is enabled UEFI system would permit to run only signed Option ROMs.
I presume PCIe card vendors want their devices to work even if Secure Boot is enabled. Therefore how does PCIe card ...
2
votes
0
answers
748
views
Windows 11 no sound in secure boot
I have Windows 11, but I have no sound in secure boot. WHen it's enabled, I went to Device Manager, and all the sound drivers said: "Windows cannot verify the digital signature for this device.&...
2
votes
0
answers
658
views
How more secure is using Shim/PreLoader than having Secure Boot disabled?
I have my doubts on how secure is using Shim/PreLoader to allow booting Linux with Secure Boot enabled.
My doubt comes from the fact that it seems to me Shim's MokManager and PreLoader's HashTool can ...
2
votes
0
answers
88
views
Can I use my own driver on Windows without having to ask MS for permission while keeping Secure Boot on?
As per the subject :
I want to write my own kernel mode driver
I want to be able to use it with Secure Boot on
I don't want to ask for permission to use it (no WHQL testing or attestation signing)
...
2
votes
0
answers
655
views
Time Authenticated EFI Variable
I'm setting up custom secure boot keys on an Asus Z87I-Deluxe motherboard. On other computers I've setup with secure boot, I've been able to either write the PK, KEK, and DB keys into the EFI ...
2
votes
0
answers
1k
views
secureboot with parrotOS - not able to sign custom kernel
I've installed Parrot OS on my surface and built the custom kernel for the surface from jakeday repo. I'm currently trying to sign my custom kernel that I can turn on secureboot again.
I've followed ...
2
votes
0
answers
2k
views
Using rEFInd to boot Windows 10 with Secure Boot and Bitlocker encryption enabled
I have a corporate laptop (HP Zbook 15) with two m2.sata drives:
nvme0: the one that shipped with the computer, featuring Bitlocker encrypted Windows 10
nvme1: a secondary drive running linux I use ...
2
votes
1
answer
15k
views
Cant boot to EFI shell Asus Motherboard
I have an Asus Maximus VIII Impact MotherBoard
I just purchased an Intel RS3UC080 RAID card, and notice the firmware was very out of date. I figured I would update it before using the card. To do ...
2
votes
0
answers
412
views
VirtualBox 5.1 installation issues Ubuntu 16.04
I am using new to Vagrant. And stuck with VirtualBox installation with Ubuntu 16.04. Executing vagrant up command, gives the following error
The vboxdrv kernel module is not loaded. Either there is ...
2
votes
1
answer
165
views
Stop Windows 8.1 from removing Grub
I've got a relatively new HP Envy machine running Windows 8.1 that I want to run Ubuntu on. Installation works great and I'm all happy until I boot back into Windows, at which point grub is removed ...
2
votes
1
answer
5k
views
Monitor only works if Legacy BIOS (CSM) disabled?
I have an Asus Q550-LF computer running Windows 8.1 Enterprise. It has a MiniDisplayPort output which is connected to a MiniDP to DVI adapter. I discovered that my monitor was not working the same day ...
2
votes
3
answers
5k
views
turning on secure boot gives only a black screen
I have installed Windows 10 with secure boot off and now I want to install Windows 11. So I turned secure boot back on but, only a black screen shows after computer boots.
What I see - I can see POST ...
1
vote
0
answers
95
views
Why the TPM PCRs does not consider a UEFI settings change? If someone resets CMOS, it's undetected
In my laptop I've set up a bios pw when I power on the laptop, and once I enter it the laptop starts my linux distro and decrypts the disk without asking any other password. To do this I've set up TPM ...
1
vote
0
answers
883
views
What does “/EndEntire” followed by “file path: /ACPI(…,…)/PCI(…)/UnknownMessaging(…)/HD(…,…,…,…,…)/File(…)/File(…)/EndEntire” during boot mean?
I use Secure Boot, followed by GRUB2, set up to boot Debian 12 and Windows 11 at the choice of a user. Right after the user chooses Windows and hits ⏎, we see a black screen with two white lines on it ...
1
vote
2
answers
4k
views
Can't enable secure boot in Windows 11
I am using Windows 11 and can't enable secure boot. I tried to enable it in BIOS, but it still doesn't work, and in system information, it's off.
1
vote
0
answers
1k
views
bcdedit.exe command giving strange error
Until yesterday i could use the command bcdedit /set testsigning on, so that i could start kernel mode drivers that are not signed, and then bcdedit /set testsigning off before shutting down, and i ...
1
vote
0
answers
280
views
Is it possible to allow only a certain secure USB boot media to boot an UEFI system?
I want to restrict all USB boot media from my system, except for a certain USB boot drive that I declare secure via a certain key.
Is this possible using UEFI/Secure Boot/TPM? Maybe via TPM? TPM gets ...
1
vote
0
answers
116
views
USB Windows 11 for TPM/SB created on non-TPM/SB system
What option is needed to install Windows 11 to a live persistent USB on a non-TPM/Secure Boot system, if the USB will be used on a TPM/Secure Boot system. I assume it is the Standard with TPM & ...
1
vote
1
answer
398
views
Every time I eneble secure boot for windows 11 my pc doesnt boot and I have to reset bios settings by removing battary. Why is that?
So basically I want to update to windows 11 and I have to eneble 2 security settings TPM and secure boot I succesfully enebled Tpm but each time I try to do the same with secure boot my screen, ...
1
vote
0
answers
41
views
Unable to easily switch os after dual booting
I got a new laptop ((Asus vivobook 14)https://www.flipkart.com/asus-vivobook-14-ryzen-5-hexa-core-4500u-8-gb-512-gb-ssd-windows-10-home-m413ia-ek582t-thin-light-laptop/p/itm8d1c44556be49?pid=...
1
vote
0
answers
797
views
Signature verification fails for secure boot kernel
I'm trying to setup secure boot with using custom keys exclusively following the guide from rodsbooks. I created and enrolled keys for db, KEK and PK and signed grub and the kernel image accordingly (...
1
vote
0
answers
540
views
How to disable HDD lock in BIOS?
I have an Acer Spin 3 laptop with Secure Boot. I was messing around in BIOS and now the laptop asks for a HDD password upon boot. It is annoying, how do I disable it again?
The BIOS is Insyde H20 rev ...
1
vote
0
answers
792
views
Kali Linux Boot Image Authentication
I recently discovered Kali Linux and decided to make a live USB so that I could boot it on any available (64-bit) machine. In the process, I also discovered the common "Selected boot image did not ...
1
vote
0
answers
216
views
HP Wifi not working in Ubuntu 19.04 in Secure Boot
Output of lspci:
00:00.0 Host bridge: Intel Corporation Xeon E3-1200 v6/7th Gen Core Processor Host Bridge/DRAM Registers (rev 08)
00:02.0 VGA compatible controller: Intel Corporation UHD Graphics 620 ...
1
vote
0
answers
30
views
Rollback protection for network booting
I am interested in secure network booting. UEFI Secure Boot, combined with a signing key I control, ensures that no unauthorized code can run. However, it doesn’t provide rollback protection: an ...
1
vote
0
answers
193
views
How can i change my BIOS password?
I have tried everything, backdoor passwords, flashing the bios and bios reset tools
made by my manufacturer (which is HP). All fail to work. I'm trying to install Kali Linux but I have secure boot on ...
1
vote
0
answers
58
views
USB Devices arn't working while Computer has Secure Boot enabled
I have a problem that seems to stem from activating Secure Boot.
I have several customers with Dell desktops running Windows 10 Enterprise, that require Secure Boot to be enabled.
When they ...
1
vote
1
answer
7k
views
Lenovo Ideapad 320-15IAP Secure Boot option not available in BIOS setup
I recently bought a Lenovo IdeaPad 320-15IAP (running Windows 10, with an Intel Pentium N4200 quad-core processor). Upon trying to install Ubuntu alongside my Windows partition, I kept getting a GRUB ...
1
vote
0
answers
1k
views
Installing a Linux kernel in the UEFI BIOS of the Xiaomi Mi Air 13
My post is about the UEFI BIOS of the Xiaomi Mi Air 13. It is a very interesting laptop, light and tough. His BIOS seems an InsydeH20 One, and I can't clear Secure Boot keys.
I'm in the process to ...
1
vote
0
answers
140
views
Windows 10 Education Failing to Boot
I have been in a bit of a loop for a while now, so hear me out please.
I have an HP Probook 4540s that has been with me for about 5 years now. I have an original Windows 10 Education installed on it. ...
1
vote
3
answers
9k
views
After disabling Secure Boot in Lenovo Yoga 14 I cannot boot into Windows 10
To test a bootable USB flash drive, I disabled Secure Boot on my Lenovo Yoga 14.
When I want to restore my BIOS setting back, I found every time I did it and restarted the PC, the setting with ...
1
vote
1
answer
2k
views
Installing Ubuntu with secure boot on and no way to disable it?
I don't have any OS installed. I wanted to install Win10 but it failed with error code 0x80070570 during install.
Now, I want to go back to Ubuntu but I am not able to (Only Unetbootin screen shows ...
1
vote
0
answers
813
views
Virtualization with UEFI'secure boot feature
I'm interested in the notion of emulating digital signature checks in virtual machines—the host can be booted without hardware-based digital signature checks, which can be moved to the VM, and the ...
1
vote
0
answers
43
views
Windows 8 can't override Ubuntu
I had Windows 8 installed on my Asus X5551M, then I installed Ubuntu 14.04 over it. Now I want to go back to Windows 8 to sell the computer.
I created a Windows 8 USB using the exe from the Windows ...
1
vote
0
answers
275
views
UEFI multi-factor authentication on admin password?
Many UEFI vendors offer boot and Admin passwords for a local machine.
For a normal cold boot or reset, I would like the UEFI system to simply pick the properly signed bootloader and proceed.
Having ...
1
vote
1
answer
3k
views
Questions about using Clonezilla to create and restore image on Windows 8.1 secure boot system
I'd like to use clonezilla to create a disk image of a Windows 8.1 system with secure boot enabled and some third-party software installed, so that I can at a later time restore the system from that ...
1
vote
1
answer
1k
views
Secure Boot is not compatible on my PC; will I be able to install Windows 8 on it?
Yesterday, I ran Windows 8 upgrade assistant on my PC, Only problem it gave is that
Secure Boot isn't compatible with your PC
Your PC's firmware doesn't support Secure Boot so you won't be able to ...
0
votes
1
answer
87
views
Delete PK key from terminal when secure boot is disabled
When secure boot is disabled, is it possible to delete the PK key from terminal? I know that to change the keys, you need to enter setup mode. And to enter setup mode, you need to delete the PK key. ...
0
votes
0
answers
85
views
How to get minimal vendor information about the TPM chip installed in my laptop
How do I get some minimal information about the TPM chip in my Linux laptop?
Information such as the manufacturer, manufacturer id, manufacturer version.
So far I have tried the tpm2_getcap command to ...
0
votes
0
answers
12
views
How does the SPK ID provide security in Xilinx secure boot
My understanding of the Xilinx ultra scale secure boot process is that the CSU validates the SPK with the PPK. If the SPK is authenticated, the CSU checks to see if the SPK ID that’s associated with ...
0
votes
0
answers
199
views
Does the Microsoft update for BlackLotus mitigation SKUSiPolicy.p7b require Memory Integrity to be on and working in the Security Center?
In other words is the "Code Integrity feature" on this Microsoft kb5025885 page:
The Code Integrity Boot Policy (SKUSiPolicy.p7b) uses the Code Integrity feature of Windows to prevent ...
0
votes
0
answers
1k
views
Gigabyte b650 DS3H secure boot won't boot from USB
Gigabyte b650 DS3H secure boot won't boot from USB.
I'm trying to run clean install for win 11 from USB drive system running on gigabyte b650 DS3H. I've made sure that TMP 2.0 is enabled and CSM is ...
0
votes
0
answers
391
views
Cannot enable Secure boot on Gigabyte H61M-DS2
Trying to help a friend do a fresh install of Windows, but the bootable USB isn't even listed in the BIOS. I realized that Secure Boot is currently disabled, and assume this is the issue. However ...
0
votes
0
answers
547
views
Cannot change my secure boot configuration in BIOS
Device: ASUS Vivobook pro 15
OS: Windows 11 Pro 22H2
As in the image above, the configuration for secure boot has been disabled in my BIOS configuration.
How can I change my secure boot configuration?...