• 0 Posts
  • 174 Comments
Joined 3 years ago
cake
Cake day: June 4th, 2023

help-circle









  • The key enrollment that Mint did sounds like registering the Machine Owner Key (MOK). That basically tells the bios that anything signed with that key should be permitted. The MOK is especially required when compiling your own drivers. Anything shipped by a Linux distro should already be signed so that the shim will permit it. SecureBoot is more about making sure your boot files haven’t been tampered with rather than being about preventing the owner from doing something.

    You should already be able to boot any modern Linux OS that has support for SecureBoot. Only if you compile your own drivers or kernel would you need to use a MOK. If you do need that, you should be able to enroll another MOK or copy the MOK key files from the Mint install and use those keys to sign drivers in any other Linux distro.

    The cli program mokutil will let you view and export your enrolled MOKs.




  • Further, I think your EFI Boot Manager has a BootNext entry that is booting the MOK utility instead of the Linux shim or kernel. You should be able to remove this BootNext entry in your EFI settings.

    If you can get it booted into Linux from a bootable USB drive, you can use the “efibootmgr” program to inspect and remove the BootNext entry.

    sudo efibootmgr

    will show you all of the EFI boot entries. If the first line says BootNext, then that’s likely the problem. Note that these are not grub boot entries. The EFI has a boot list that happens before grub.

    sudo efibootmgr —delete-bootnext

    will remove the temporary BootNext entry.

    After that, make sure secure boot is disabled and you should be able to boot Linux.