Secure Boot Bug

English Install/Boot/Login
1

Both my 2022 Dell Precision desktop (Intel and AMD Radeon) and my 2018 Lenovo Thinkpad laptop (Intel and Intel graphics) will not boot with TW or Aeon. Shim SBAT failed security violation.

As both boot fine on Ubuntu, Debian, and Fedora, I know the problem is not with my hardware. It’s with openSUSE for sure. I can’t find the link to the bug report, but recently saw that it had been reopened. That’s good news, but the problem goes on and on and on. I read a lot of posts on this issue and no solutions ever seem to happen that don’t involve a high level of CLI skill - that I don’t have.

This has been going on since last spring some time. Does anyone have any ideas how to resolve this problem?

2

@iamjiwjr Hi, have you read this thread https://forums.opensuse.org/t/after-a-shim-update-yesterday-no-longer-able-to-boot-with-secure-boot-enabled/165382 is this what your seeing?

3

Yes. My point is that if it’s taken seriously and fixed, these posts go away, You don’t see them on Ubuntu Fedora and Debian forums. I am frustrated because it seems to be blamed on individuals and hardware. In 2023 I shouldn’t have to do anything to get an iso or an hdd to boot up. All openSUSE’s peers do routinely.

4

@iamjiwjr the only way is via adding your voice to the bug report for your hardware…

You could just be seeing differences in the other distributions because things like kernel lock down etc are not part of those distribution releases yet, unless your prepared to delve into those differences it’s hard to know what’s different.

5

See Bug 1209985 – the last few comments will give you a workaround.

The basic problem is that Tumbleweed is still using an older shim. There are plans to update, but apparently there’s a snag somewhere.

1 Like
6

@nrickert I suspect @iamjiwjr is not confident from the command line, perhaps you could summarize the steps as it looks like you need to also do something in the system BIOS as well as the command line?

7

https://en.opensuse.org/openSUSE:UEFI#Reset_SBAT_string_for_booting_to_old_shim_in_old_Leap_image

1 Like
8

The procedure requires booting with the new shim at some stage.

For this @iamjiwjr will either need to have Leap 15.5 (or 15.4 or 15.6) available, either on another partition or some other boot media such as the install media for 15.5 or 15.6. The install media for 15.4 might be too old.

I’ll wait to hear from @iamjiwjr before giving more details.

9

Thanks. This situation seems surreal to me. Am I the only one who sees that a reasonable solution is to just fix the shim situation? Once done I’ll be glad to reload a fresh iso.

10

I agree that’s the correct solution. But that change seems to be slow coming.

1 Like
11

Here we are approaching 9 months since I’ve been able to boot into TW or Aeon. No shim batt (or whatever it’s called) fix in sight. Bizarre why one would want to send so many users away. 9momths. Bizarre.

12

@iamjiwjr ,

I can understand you have some frustration, but ranting here in the user forum is useless. It only will lead to people not listening to you anymore. And ranting elsewhere will also not produce positive (for you) results.

1 Like