This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
start:issecurebootworking [2022/05/16 16:47] – peter | start:issecurebootworking [2023/09/17 12:46] – admin | ||
---|---|---|---|
Line 1: | Line 1: | ||
+ | DATE CHECKED THIS PAGE WAS VALID: 30/ | ||
+ | |||
Ok So it was possible to get secure boot working. It took me a long time as I didnt fully understand what was happening. | Ok So it was possible to get secure boot working. It took me a long time as I didnt fully understand what was happening. | ||
Line 20: | Line 22: | ||
If there are keys but you want to start again you can delete them and also clear any secure boot config in your bios, as you have to clear things both sides to truly start again, but if you dont have any listed in that directory you can generate some new ones, or try using the ones already there. | If there are keys but you want to start again you can delete them and also clear any secure boot config in your bios, as you have to clear things both sides to truly start again, but if you dont have any listed in that directory you can generate some new ones, or try using the ones already there. | ||
+ | Note: If you already have keys and just updated your drivers and they stopped working (ie are no longer signed) just move on to the section below where you sign them again. | ||
- | So if you need to generate new then the Debian guide is accurate: | + | So if you need to generate new then the Debian guide is accurate |
< | < | ||
Line 42: | Line 45: | ||
Once you reboot the machine at this point you will be asked to enter the mok key by the box's bios. You need to complete this correctly so the bios trusts the debian install and you can boot it without getting an error. | Once you reboot the machine at this point you will be asked to enter the mok key by the box's bios. You need to complete this correctly so the bios trusts the debian install and you can boot it without getting an error. | ||
- | Once booted (and you dont get an untrusted OS error) we can make Nvidia drivers work. This part I got stuck on and this is how I resolved it. I personally had no issues getting the system to boot fine with secure boot but the nvidia driver wouldnt load and I only got the intel card listed under gnome settings and the command " | + | So to reiterate, this part worked fine for me following debians wiki and I didnt get stuck at all here. It was only the nvidia part I got stuck on. |
+ | |||
+ | So once booted (and you dont get an untrusted OS error) we can now make Nvidia drivers work. This part I got stuck on and this is how I resolved it. I personally had no issues getting the system to boot fine with secure boot but the nvidia driver wouldnt load and I only got the intel card listed under gnome settings and the command " | ||
Here I made sure my nvidia drivers were installed perfectly before continuing: | Here I made sure my nvidia drivers were installed perfectly before continuing: | ||
Line 51: | Line 56: | ||
This made sure I had all the packages I needed. I believe you should be able to use the command "sudo dkms status" | This made sure I had all the packages I needed. I believe you should be able to use the command "sudo dkms status" | ||
- | Once I had this all in place I then typed this in the terminal: | + | Note: If you just updated your drivers and they stopped working (ie are no longer signed) just sign them again as per the below (assume sbssigntool is already installed and skip that line). |
+ | Once I had this all in place I then typed this in the terminal | ||
< | < | ||
Line 62: | Line 68: | ||
</ | </ | ||
- | Very important - after you type the next command it asks you for a password, but its not obvious that its asking for a password, the terminal just sits and waits for input. | + | **CRITICAL NOTE!!!!!!!!! |
+ | ON DEBIAN 12 THERE WAS A CHANGE WHERE THIS PART OF THE SCRIPT INCORRECTLY GETS THE DIRECTORY: | ||
+ | < | ||
+ | uname -r | cut -d . -f 1-2 | ||
+ | </ | ||
+ | This means that ls / | ||
+ | < | ||
+ | SHORT_VERSION=" | ||
+ | </ | ||
+ | This means "ls / | ||
+ | |||
+ | |||
+ | Very important - after you type the next command it asks you for a password, but its not obvious that its asking for a password, the terminal just sits and waits for input. | ||
< | < | ||
Line 70: | Line 88: | ||
Make sure you type the password carefully here with no errors, and dont get confused by it just waiting. | Make sure you type the password carefully here with no errors, and dont get confused by it just waiting. | ||
- | Next export it and sign all modules: | + | Next export it and sign all modules |
< | < | ||
export KBUILD_SIGN_PIN | export KBUILD_SIGN_PIN | ||
Line 76: | Line 94: | ||
</ | </ | ||
+ | Assuming you type the password correct, you wont get any errors. | ||
You should be able to now see that a module is signed. You can pick any module in that directory but as an example: | You should be able to now see that a module is signed. You can pick any module in that directory but as an example: | ||
< | < | ||
sudo modinfo nvidia-tesla-510-drm.ko | sudo modinfo nvidia-tesla-510-drm.ko | ||
</ | </ | ||
+ | NOTE: Filename may be different just use tab completion to find appropriate file to check eg even nvidia-current-drm or some other name. | ||
Above assumes you have that particular driver installed but just check a different file/ | Above assumes you have that particular driver installed but just check a different file/ | ||
Line 92: | Line 112: | ||
</ | </ | ||
- | {{: | + | {{: |
Sorry I realise this guide is a little rough around the edges, I had to write up a lot from memory but this is essentially how I did it. | Sorry I realise this guide is a little rough around the edges, I had to write up a lot from memory but this is essentially how I did it. | ||
P | P | ||
+ | |||
+ | |||
+ | Edit: Just wanted to show what a signed module looks like, note there is a signature with some signed information: | ||
+ | {{: |