How to enforce Secure Boot on the following setup : ubunutu 16.04 with grub2
Clash Royale CLAN TAG#URR8PPP up vote
0
down vote
favorite
Problem:
Unsigned kernels boot up on UEFI Secure Boot enabled machine
Setup:
OS: Canonical signed Ubuntu 16.04
GRUB2: Canonical signed 2.02~beta2-36ubuntu3.17
SHIM: Microsoft signed, Canonical keys in DB
Normal secure boot works and confirmed via demsg BOOT_IMAGE log to observe *...efi.signed image loads and 'sbverify' to check whether the same is signed with Canonical key.
I intend to disable unsigned kernel load on a UEFI machine with secure boot enabled. I referred to #1401532.
and other links related to the issue.
Is there any way to force only signed kernel load and block all unsigned kernel with the current setup mentioned above ?
with minimal changes in grub.cfg, any patch, etc.
Thanks,
AT
boot grub2 uefi secure-boot
asked May 15 at 14:15
aditya ece
12
add a comment |Â
up vote
0
down vote
favorite
Problem:
Unsigned kernels boot up on UEFI Secure Boot enabled machine
Setup:
OS: Canonical signed Ubuntu 16.04
GRUB2: Canonical signed 2.02~beta2-36ubuntu3.17
SHIM: Microsoft signed, Canonical keys in DB
Normal secure boot works and confirmed via demsg BOOT_IMAGE log to observe *...efi.signed image loads and 'sbverify' to check whether the same is signed with Canonical key.
I intend to disable unsigned kernel load on a UEFI machine with secure boot enabled. I referred to #1401532.
and other links related to the issue.
Is there any way to force only signed kernel load and block all unsigned kernel with the current setup mentioned above ?
with minimal changes in grub.cfg, any patch, etc.
Thanks,
AT
boot grub2 uefi secure-boot
asked May 15 at 14:15
aditya ece
12
add a comment |Â
up vote
0
down vote
favorite
up vote
0
down vote
favorite
Problem:
Unsigned kernels boot up on UEFI Secure Boot enabled machine
Setup:
OS: Canonical signed Ubuntu 16.04
GRUB2: Canonical signed 2.02~beta2-36ubuntu3.17
SHIM: Microsoft signed, Canonical keys in DB
Normal secure boot works and confirmed via demsg BOOT_IMAGE log to observe *...efi.signed image loads and 'sbverify' to check whether the same is signed with Canonical key.
I intend to disable unsigned kernel load on a UEFI machine with secure boot enabled. I referred to #1401532.
and other links related to the issue.
Is there any way to force only signed kernel load and block all unsigned kernel with the current setup mentioned above ?
with minimal changes in grub.cfg, any patch, etc.
Thanks,
AT
boot grub2 uefi secure-boot
asked May 15 at 14:15
aditya ece
12
Problem:
Unsigned kernels boot up on UEFI Secure Boot enabled machine
Setup:
OS: Canonical signed Ubuntu 16.04
GRUB2: Canonical signed 2.02~beta2-36ubuntu3.17
SHIM: Microsoft signed, Canonical keys in DB
Normal secure boot works and confirmed via demsg BOOT_IMAGE log to observe *...efi.signed image loads and 'sbverify' to check whether the same is signed with Canonical key.
I intend to disable unsigned kernel load on a UEFI machine with secure boot enabled. I referred to #1401532.
and other links related to the issue.
Is there any way to force only signed kernel load and block all unsigned kernel with the current setup mentioned above ?
with minimal changes in grub.cfg, any patch, etc.
Thanks,
AT
boot grub2 uefi secure-boot
asked May 15 at 14:15
aditya ece
12
edited May 16 at 4:29
asked May 15 at 14:15
aditya ece
12
asked May 15 at 14:15
aditya ece
12
asked May 15 at 14:15
aditya ece
12
12
add a comment |Â
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1036553%2fhow-to-enforce-secure-boot-on-the-following-setup-ubunutu-16-04-with-grub2%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password