GRUB2 - Revision history

Admin at 01:02, 7 August 2026

2026-08-07T01:02:58Z

← Older revision		Revision as of 01:02, 7 August 2026
Line 1:		Line 1:
	== Secure Boot ==		== Secure Boot ==
	You NEED to set your BIOS/UEFI settings to make Secure Boot is in "setup" mode, this is different on every motherboard but will usually be under the security settings in the BIOS settings. Some MSI motherboards force setup mode by using the options "Delete all platform variables" in the Secure Boot settings. This option is turned off after the next boot so make sure to do this in one sitting.		You NEED to set your <abbr title="Basic Input Output System">BIOS</abbr>/<abbr title="Unified Extensible Firmware Interface">UEFI</abbr> settings to make Secure Boot is in "setup" mode, this is different on every motherboard but will usually be under the security settings in the <abbr title="Basic Input Output System">BIOS</abbr> settings. Some MSI motherboards force setup mode by using the options "Delete all platform variables" in the Secure Boot settings. This option is turned off after the next boot so make sure to do this in one sitting.

	You also NEED to know which folder stores your boot loader, in the case of EndeavourOS it is either /boot/efi OR /efi, look for the folder in the output of "df -h" Example:		You also NEED to know which folder stores your boot loader, in the case of EndeavourOS it is either /boot/efi OR /efi, look for the folder in the output of "df -h" Example:
Line 34:		Line 34:


	If you are getting an error when booting with text similar to "Prohibited by secure boot policy" you can just turn off Secure Boot in your BIOS again and troubleshoot what happened.		If you are getting an error when booting with text similar to "Prohibited by secure boot policy" you can just turn off Secure Boot in your <abbr title="Basic Input Output System">BIOS</abbr> again and troubleshoot what happened.

	== grub_is_using_legacy_shim_lock_protocol while booting ==		== grub_is_using_legacy_shim_lock_protocol while booting ==
Line 86:		Line 86:
	IF you have this file (you see a line containing -rw-r----- 1 root root) then ALSO run the command		IF you have this file (you see a line containing -rw-r----- 1 root root) then ALSO run the command
	grub-install --target=x86_64-efi --efi-directory=/boot/efi --removable		grub-install --target=x86_64-efi --efi-directory=/boot/efi --removable
	This installs GRUB to the default location your BIOS searches for bootloaders, which is how your PC may be set up instead of using the normal location stored in the EFI memory.		This installs GRUB to the default location your <abbr title="Basic Input Output System">BIOS</abbr> searches for bootloaders, which is how your PC may be set up instead of using the normal location stored in the EFI memory.


	Press Ctrl+D to exit the chroot, then type reboot to restart the system and everything should work.		Press Ctrl+D to exit the chroot, then type reboot to restart the system and everything should work.

Admin: /* Secure Boot */

2026-06-18T19:45:18Z

Secure Boot

← Older revision		Revision as of 19:45, 18 June 2026
Line 14:		Line 14:

	sudo sbctl sign -s /boot/efi/EFI/boot/bootx64.efi		sudo sbctl sign -s /boot/efi/EFI/boot/bootx64.efi
	EndeavourOS users will also probably have this file, ~~toher~~ distributions will have similar		EndeavourOS users will also probably have this file, other distributions will have similar
	sudo sbctl sign -s /boot/efi/EFI/endeavouros/grubx64.efi		sudo sbctl sign -s /boot/efi/EFI/endeavouros/grubx64.efi
	Install GRUB on your system with the extra TPM module so Secure Boot will work		Install GRUB on your system with the extra TPM module so Secure Boot will work

Admin at 18:06, 18 June 2026

2026-06-18T18:06:48Z

← Older revision		Revision as of 18:06, 18 June 2026
Line 10:		Line 10:
	Enroll all the needed keys in to your EFI, '''do not run this without the -m argument or you can brick your system.'''		Enroll all the needed keys in to your EFI, '''do not run this without the -m argument or you can brick your system.'''
	sudo sbctl enroll-keys -m -f		sudo sbctl enroll-keys -m -f
	Sign all the needed files, at a minimum it needs these first 3 files, if you are using a custom kernel you will need to sign other files, for example "/boot/vmlinuz-linux-zen"		Sign all the needed files, at a minimum it needs these first 2 files, if you are using a custom kernel you will need to sign other files, for example "/boot/vmlinuz-linux-zen"
	sudo sbctl sign -s /boot/vmlinuz-linux		sudo sbctl sign -s /boot/vmlinuz-linux

	sudo sbctl sign -s /boot/efi/EFI/boot/bootx64.efi		sudo sbctl sign -s /boot/efi/EFI/boot/bootx64.efi
			EndeavourOS users will also probably have this file, toher distributions will have similar
	sudo sbctl sign -s /boot/efi/EFI/endeavouros/grubx64.efi		sudo sbctl sign -s /boot/efi/EFI/endeavouros/grubx64.efi
	Install GRUB on your system with the extra TPM module so Secure Boot will work		Install GRUB on your system with the extra TPM module so Secure Boot will work

Admin at 18:05, 18 June 2026

2026-06-18T18:05:39Z

← Older revision		Revision as of 18:05, 18 June 2026
Line 2:		Line 2:
	You NEED to set your BIOS/UEFI settings to make Secure Boot is in "setup" mode, this is different on every motherboard but will usually be under the security settings in the BIOS settings. Some MSI motherboards force setup mode by using the options "Delete all platform variables" in the Secure Boot settings. This option is turned off after the next boot so make sure to do this in one sitting.		You NEED to set your BIOS/UEFI settings to make Secure Boot is in "setup" mode, this is different on every motherboard but will usually be under the security settings in the BIOS settings. Some MSI motherboards force setup mode by using the options "Delete all platform variables" in the Secure Boot settings. This option is turned off after the next boot so make sure to do this in one sitting.

	You also NEED to know which ~~partition~~ stores your boot loader in the case of EndeavourOS it is either /boot/efi OR /efi, look for the folder in the output of "df -h" Example:		You also NEED to know which folder stores your boot loader, in the case of EndeavourOS it is either /boot/efi OR /efi, look for the folder in the output of "df -h" Example:
	/dev/nvme1n1p1 2.0G 708K 2.0G 1% /boot/efi		/dev/nvme1n1p1 2.0G 708K 2.0G 1% /boot/efi
	Install the tools for signing files		Install the tools for signing files

Admin at 18:04, 18 June 2026

2026-06-18T18:04:08Z

← Older revision		Revision as of 18:04, 18 June 2026
Line 31:		Line 31:
	Vendor Keys: microsoft builtin-KEK		Vendor Keys: microsoft builtin-KEK

			This command may also give you additional information about quirks on your motherboard that you might need to pay attention to.


	If you are getting an error when booting with text similar to "Prohibited by secure boot policy" you can just turn off Secure Boot in your BIOS again and troubleshoot what happened.		If you are getting an error when booting with text similar to "Prohibited by secure boot policy" you can just turn off Secure Boot in your BIOS again and troubleshoot what happened.

Admin: /* Secure Boot */

2026-06-18T18:03:17Z

Secure Boot

← Older revision		Revision as of 18:03, 18 June 2026
Line 23:		Line 23:
	sudo sbctl status		sudo sbctl status

			An example of a correct setup:

	If you are getting ~~and~~ error when booting ~~about~~ "Prohibited by secure boot policy" you can just turn off Secure Boot in your BIOS again and troubleshoot what happened.		Installed: ✓ sbctl is installed
			Owner GUID: random-data-here
			Setup Mode: ✓ Disabled
			Secure Boot: ✓ Enabled
			Vendor Keys: microsoft builtin-KEK


			If you are getting an error when booting with text similar to "Prohibited by secure boot policy" you can just turn off Secure Boot in your BIOS again and troubleshoot what happened.

	== grub_is_using_legacy_shim_lock_protocol while booting ==		== grub_is_using_legacy_shim_lock_protocol while booting ==

Admin: /* Secure Boot */

2026-06-18T18:00:58Z

Secure Boot

← Older revision		Revision as of 18:00, 18 June 2026
Line 22:		Line 22:
	Reboot and verify everything is working with		Reboot and verify everything is working with
	sudo sbctl status		sudo sbctl status


			If you are getting and error when booting about "Prohibited by secure boot policy" you can just turn off Secure Boot in your BIOS again and troubleshoot what happened.

	== grub_is_using_legacy_shim_lock_protocol while booting ==		== grub_is_using_legacy_shim_lock_protocol while booting ==

Admin: /* Secure Boot */

2026-06-18T17:58:37Z

Secure Boot

← Older revision		Revision as of 17:58, 18 June 2026
Line 10:		Line 10:
	Enroll all the needed keys in to your EFI, '''do not run this without the -m argument or you can brick your system.'''		Enroll all the needed keys in to your EFI, '''do not run this without the -m argument or you can brick your system.'''
	sudo sbctl enroll-keys -m -f		sudo sbctl enroll-keys -m -f
	Sign all the needed files, at a minimum it needs ~~the~~ first 3 files, if you are using a custom kernel you will need to sign other files, for example "/boot/vmlinuz-linux-zen"		Sign all the needed files, at a minimum it needs these first 3 files, if you are using a custom kernel you will need to sign other files, for example "/boot/vmlinuz-linux-zen"
	sudo sbctl sign -s /boot/vmlinuz-linux		sudo sbctl sign -s /boot/vmlinuz-linux

Admin at 17:55, 18 June 2026

2026-06-18T17:55:00Z

← Older revision		Revision as of 17:55, 18 June 2026
Line 1:		Line 1:
			== Secure Boot ==
			You NEED to set your BIOS/UEFI settings to make Secure Boot is in "setup" mode, this is different on every motherboard but will usually be under the security settings in the BIOS settings. Some MSI motherboards force setup mode by using the options "Delete all platform variables" in the Secure Boot settings. This option is turned off after the next boot so make sure to do this in one sitting.

			You also NEED to know which partition stores your boot loader in the case of EndeavourOS it is either /boot/efi OR /efi, look for the folder in the output of "df -h" Example:
			/dev/nvme1n1p1 2.0G 708K 2.0G 1% /boot/efi
			Install the tools for signing files
			sudo pacman -S sbctl
			Create the keys for your system
			sudo sbctl create-keys
			Enroll all the needed keys in to your EFI, '''do not run this without the -m argument or you can brick your system.'''
			sudo sbctl enroll-keys -m -f
			Sign all the needed files, at a minimum it needs the first 3 files, if you are using a custom kernel you will need to sign other files, for example "/boot/vmlinuz-linux-zen"
			sudo sbctl sign -s /boot/vmlinuz-linux

			sudo sbctl sign -s /boot/efi/EFI/boot/bootx64.efi

			sudo sbctl sign -s /boot/efi/EFI/endeavouros/grubx64.efi
			Install GRUB on your system with the extra TPM module so Secure Boot will work
			sudo grub-install --target=x86_64-efi --efi-directory=/boot/efi --removable --modules="tpm" --disable-shim-lock


			Reboot and verify everything is working with
			sudo sbctl status

	== grub_is_using_legacy_shim_lock_protocol while booting ==		== grub_is_using_legacy_shim_lock_protocol while booting ==

Admin: /* grub_is_using_legacy_shim_lock_protocol while booting */

2026-06-10T16:57:17Z

grub_is_using_legacy_shim_lock_protocol while booting

← Older revision		Revision as of 16:57, 10 June 2026
Line 44:		Line 44:
	Reinstall GRUB		Reinstall GRUB
	grub-install		grub-install

			Run
			ls -la /mnt/boot/efi/EFI/boot/bootx64.efi
			IF you have this file (you see a line containing -rw-r----- 1 root root) then ALSO run the command
			grub-install --target=x86_64-efi --efi-directory=/boot/efi --removable
			This installs GRUB to the default location your BIOS searches for bootloaders, which is how your PC may be set up instead of using the normal location stored in the EFI memory.


	Press Ctrl+D to exit the chroot, then type reboot to restart the system and everything should work.		Press Ctrl+D to exit the chroot, then type reboot to restart the system and everything should work.