Secure Boot
Secure Boot is a lock on the front door of the startup process. When it is on, the computer only starts boot software that carries a valid digital signature from a trusted company. That stops a category of malware that hides by loading before the operating system. Ubuntu, Windows, and most major Linux distributions work with Secure Boot turned on.
Secure Boot is defined in the UEFI specification. Firmware checks the signature of every EFI executable before running it, using keys stored in NVRAM:
- PK (Platform Key): owned by the hardware vendor; controls changes to KEK
- KEK (Key Exchange Key): authorizes updates to db and dbx
- db: allowed signing certificates and hashes
- dbx: revoked signatures (updated when a signed bootloader is found vulnerable)
How Linux boots under Secure Boot: most PCs ship with Microsoft’s UEFI CA in db. Distributions use shim, a small first-stage loader signed by Microsoft, which carries the distribution’s own key and verifies GRUB and the kernel. Ubuntu’s chain is shimx64.efi, grubx64.efi, then a Canonical-signed kernel.
MOK (Machine Owner Key): shim also trusts keys you enroll yourself. Third-party kernel modules such as DKMS-built drivers must be signed with an enrolled MOK, or the kernel refuses to load them while Secure Boot is on. The enrollment step happens in a blue MokManager screen on the next reboot.
What it does not do: Secure Boot verifies boot code only. It does not encrypt disks or protect the running OS.
Source: Ubuntu Wiki: UEFI Secure Boot
Checking and working with Secure Boot
# Is Secure Boot enabled?
$ mokutil --sb-state
SecureBoot enabled
# Keys enrolled through shim
$ mokutil --list-enrolled | grep Subject
# Enroll the DKMS signing key (set a one-time password, then reboot)
$ sudo mokutil --import /var/lib/shim-signed/mok/MOK.der
# A module blocked by Secure Boot shows up in kernel logs
$ sudo dmesg | grep -i "module verification failed\|Key was rejected"Secure Boot is on by default on almost every new PC and is required for Windows 11. On Linux it usually just works, until you install a third-party driver, most often NVIDIA or VirtualBox host modules, and it silently refuses to load. The right fix is enrolling the MOK when prompted, not turning Secure Boot off. Keep firmware updated too, because dbx revocation updates block known-vulnerable bootloaders.