Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #256340 > unrolled thread

shim boot-loader problem

Back to article view | Back to linux.debian.user

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  shim boot-loader problem KCB Leigh <kcbl2003@yahoo.co.uk> - 2023-03-24 23:10 +0100
    Re: shim boot-loader problem Max Nikulin <manikulin@gmail.com> - 2023-03-25 05:10 +0100

#256340 — shim boot-loader problem

I have an ACER ASPIRE 5.14 laptop with an internal hard disk, with
both Windows 10, & Ubuntu v.20.04 on separate partitions (which I use
only occasionally), but have been running the machine primarily from
a USB stick with Debian 11.6:

Linux cpe-67-241-65-193 5.10.0-21-amd64 #1 SMP Debian 5.10.162-1 (2023-01-21) x86_64 GNU/Linux

The problem:
    > I can boot with Debian with no problems;
    > I can boot with Windows with no problems;
    > Through about May of 2022 I was able to also boot with
      Ubuntu, with no problems... but some time in the last half
      of 2022, I updated Debian, & now, although the Ubuntu option
      exists in the GRUB boot loader menu, when I select it, I get
      the error message: 'bad shim signature' & I cannot boot with
      Ubuntu any more.
    > To boot with Ubuntu, I have to disable secure boot in the
      BIOS/UEFI setup (F2 on my computer).  With earlier
      versions of the kernel, I think one had to disable secure
      boot to boot with debian, but after kernel 5.10, one could
      boot with secure boot enabled, as my experiences through the
      middle of 2022 showed.
    > The APPARENT reason is that on the Debian boot volume, the
      /boot/efi/ directory contains:
        /EFI/debian/
        fbx64.efi, grubx64.efi, mmx64.efi, shimx64.efi
        BOOTX64.CSV & grub.cfg
      I think the relevant file is the shimx64.efi file.  On the
      Ubuntu volume, the /boot/efi/ directory is completely empty &
      I've not been able to find any files with names containing shim.

My QUESTION: can I simply copy the /EFI/debian/... directory & files
to the UBUNTU volume to enable the machine to boot when secure boot is
enabled?  My worry is that the Ubuntu OS uses a different version of
kernel: the 2 most recent versions of kernel on each volume are:

      DEBIAN 11.6    |       UBUNTU
    5.10.0-20-amd64  |  5.15.0-67-generic
    5.10.0-21-amd64  |  5.19.0-35-generic

so the shimx64.efi may work for the debian OS but not the UBUNTU,
though this shim 'boot-loader' is 'used' before the kernel, I think.

I would be most appreciative of any advice, or suggestions for a
better place to submit this question, if this forum's not appropriate.

With many thanks,
Ken

(I have not subscribed to the list, but will try to check it; I would
be very grateful if replies could be cc to my e-mail address:
kcbl2003@yahoo.co.uk.)

[toc] | [next] | [standalone]

#256352

On 25/03/2023 04:48, KCB Leigh wrote:
>      > Through about May of 2022 I was able to also boot with
>        Ubuntu, with no problems... but some time in the last half
>        of 2022, I updated Debian, & now, although the Ubuntu option
>        exists in the GRUB boot loader menu, when I select it, I get
>        the error message: 'bad shim signature' & I cannot boot with
>        Ubuntu any more.

Perhaps old key that was used to sign shim in ubuntu has been revoked 
since that time due to a vulnerability in grub. If so then you need to 
update the shim-signed package.

>          /EFI/debian/
>          fbx64.efi, grubx64.efi, mmx64.efi, shimx64.efi
>          BOOTX64.CSV & grub.cfg
>        I think the relevant file is the shimx64.efi file.  On the

The relevant file can be found in output of (it does not matter if 
Debian or Ubuntu is booted)

     efibootmgr -v

Likely you are right.

>        Ubuntu volume, the /boot/efi/ directory is completely empty &
>        I've not been able to find any files with names containing shim.

Perhaps a wrong partition is mounted to /boot/efi. Usually the same 
partition should be mounted in Debian and Ubuntu. Compare

     fdisk -l
     findmnt /boot/efi

> My QUESTION: can I simply copy the /EFI/debian/... directory & files
> to the UBUNTU volume to enable the machine to boot when secure boot is
> enabled?

No. Files are signed with distribution-specific keys and have different 
compiled in paths (/EFI/debian, /EFI/ubuntu)

Ensure that the proper partition is mounted to /boot/efi and run 
update-grub. I do not remember if it is enough or shim package has its 
own script.

I suggest to look into EFI/BOOT directory on the EFI System Partition. 
It may contain fallback from some OS. This directory is intended for 
removable media, but firmware may prefer it even for built-in drives. 
Signed shim .efi file may be installed as EFI/BOOT/BOOTX64.EFI. Several 
years ago buggy EFI was not uncommon.

Notice that os-probber was disabled by default some time ago, so 
alternative OS entries disappeared from *grub* menu unless it is 
explicitly enabled. It should not affect the firmware (BIOS) boot menu.

You may get some impression of expected file layout for EFI system 
partition from
https://wiki.debian.org/UEFI

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web