Public bug reported:
With Secure Boot enabled, the GRUB menu appears, but booting the default
entry fails:
First attempt (before enrolling a MOK):
error: prohibited by secure boot policy.
error: shim_lock protocol not found.
error: you need to load the kernel first.
Second attempt (after enrolling a MOK via mokutil/MokManager):
error: shim_lock protocol not found.
error: you need to load the kernel first.
Failed to boot both default and fallback entries.
So the firmware accepts shim and shim starts GRUB, but GRUB then cannot
use shim's verification protocol to load the kernel. With Secure Boot
disabled the system boots normally.
Hardware / firmware
- HP ZBook 16 G1i, BIOS X96 Ver. 01.05.01 (latest per fwupd)
- BIOS Secure Boot settings (read via hp-bioscfg): Platform Key HP, "Enable MS
UEFI CA key" Yes, Microsoft UEFI CA 2023 / Option ROM UEFI CA 2023 / Windows
UEFI CA 2023 enabled, Sure Start Secure Boot Keys Protection enabled
- fwupd: no pending updates; KEK CA 2023 present, HP DB 2024, dbx 20260707
(latest)
Software (Ubuntu 24.04.5, all packages current)
- shim-signed 1.58+15.8-0ubuntu1
- grub-efi-amd64-signed 1.202.5+2.12-1ubuntu7.3
- grub-efi-amd64 / -bin / grub-common / grub2-common 2.12-1ubuntu7.3
- mokutil 0.6.0-2build3, secureboot-db 1.9build1
- Kernel: 6.17.0-1032-oem (default entry; fallback entry fails the same way)
Already verified
- Boot entry points to \EFI\ubuntu\shimx64.efi; \EFI\BOOT\BOOTX64.EFI is shim
too
- shimx64.efi and grubx64.efi on the ESP are identical to the package files
- grub.cfg and /etc/grub.d are stock
- Kernels are signed by Canonical (sbverify)
- SBAT level sbat,1,2021030218, no MokSBState set
- A MOK (DKMS) is enrolled; no module is involved, because the failure happens
before the kernel is loaded
Comparison
Two other users with the same model, same BIOS version and identical Secure
Boot settings run Debian 13 with Secure Boot enabled successfully: shim-signed
1.51~1+deb13u1+16.1-2~deb13u1, grub-efi-amd64-signed 1+2.12+9+deb13u2. This
suggests an incompatibility between Ubuntu's shim 15.8 / GRUB build and this
firmware, possibly fixed in shim 16.x.
I can test debug builds or provide further output (e.g. with
SHIM_VERBOSE / MokListRT dumps) if needed.
** Affects: grub2 (Ubuntu)
Importance: Undecided
Status: New
** Affects: shim-signed (Ubuntu)
Importance: Undecided
Status: New
** Tags: noble secureboot
** Tags added: secureboot
** Also affects: shim-signed (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2173509
Title:
HP ZBook 16 G1i: Secure Boot fails in GRUB with "shim_lock protocol
not found" (shim 15.8); Debian 13 boots on same hardware
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/2173509/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
