I am trying to sign an nVidia kernel and a virtualbox module using mokutil.
My problem is that the Shim IEFI Key Management is not showing up after reboot so that I can enroll the key.
Using mokutil --list-new
, I can see that my key is scheduled to be enrolled. Also, the Secure Boot feature is enabled, alongside the mokutil validation. However, after rebooting, I expect the Shim IEFI Key Management to load, but I boot to Ubuntu, and the keys remain not enrolled (executing mokutil --list-enrolled
gives: Failed to read MokListRT: No such file or directory)
My OS is Ubuntu 16.04 LTS, the nvidia driver I am trying to sign is 384.59, and my virtualbox version is 5.1.26.
Thank you in advance.
Best Answer
There are several ways you can proceed, but they might not all work equally well, depending on your hardware and needs:
MokManager.efi
ormmx64.efi
in the same directory that holdsshimx64.efi
andgrubx64.efi
). This is likely to be the most direct approach, but this EFI feature is relatively rare, and even if it's present, there's no standardization on where it's located in the EFI's menu system, so you'll have to go looking for it.EFI/BOOT
directory on that drive, and copy some files from the/boot/efi/EFI/ubuntu
directory to theEFI/BOOT
directory on the USB flash drive: Copyshimx64.efi
and rename it tobootx64.efi
in its new location and copyMokManager.efi
ormmx64.efi
without renaming it. (Your Ubuntu probably hasmmx64.efi
, but I don't recall when it was renamed.) You can then boot to the USB flash drive, which should launch MokManager.EFI/BOOT/bootx64.efi
. You should then be able to boot the USB flash drive into the shell and use it to run MokManager. Note, however, that you'll need to temporarily disable Secure Boot to run the EFI shell. You'll also need to learn enough of the EFI shell to navigate to the MokManager binary and run it. (This shell is similar to a DOS or Windows command prompt. The Arch wiki provides some tips on how to use it.)I'd try the options in more-or-less this order, although you can use your own judgment and skip something if you don't like the way it sounds or know it won't work.