4

When I installed Ubuntu 22.04.4 on a system of mine just now, with secure boot enabled, I opted to enable third party drivers, and left "Configure secure boot" ticked, and entered a password.

enter image description here (illustrative screenshot borrowed from another question about an earlier Ubuntu but the window contents are exactly the same even though the window borders are old style now)

After reboot, I did get a MokManager menu where the default option was to continue booting, and I wasn't prompted for the password I set there.

What I am unsure about is whether that password needs to be stored somewhere for future driver installations throughout the lifetime of this Ubuntu installation, or whether it's just a one-shot password that's used for the next boot and I'll be prompted for another one if something else needs it for a later kernel module installation.

Closest question and answer is this: https://askubuntu.com/a/815614/1242564 but it doesn't answer my precise question of whether the password needs to be remembered in the long term.

Also can someone suggest a package I might install from APT that would test this? e.g. would VirtualBox do it as IIRC it has a DKMS portion to it?

Nick Booker
  • 49
  • 1
  • 3

1 Answers1

5

The Secure Boot password you created is persistently stored in the motherboard of the computer. Because the Secure Boot password is persistently stored in the computer's motherboard you need to save it in a safe place where it won't be lost if something bad happens to the operating system or if you decide to remove or reinstall Ubuntu.

The Secure Boot password is used to generate a key that interacts with the computer's UEFI firmware and is stored in a secure area on the motherboard. Since the key is tied to the UEFI firmware it is independent of whatever operating system that is running on the computer.

During the Ubuntu installation a UEFI Secure Boot window may appear with this message.

You have chosen to enable third-party software as part of your install, which for this system includes hardware drivers for graphics and/or wi-fi hardware. Your system also has UEFI Secure Boot enabled. UEFI Secure Boot is not compatible with the use of these third-party drivers.

After installation completes, Ubuntu will assist you in disabling UEFI Secure Boot. To ensure that this change is being made by you as an authorized user, and not by an attacker, you must choose a password now and then use the same password after reboot to confirm the change.

Warning: If you choose not to install these drivers, or if you proceed but do not confirm the password upon reboot, Ubuntu will still be able to boot on your system but these third-party drivers will not be available for your hardware.

The password you set during the Ububntu installation process persists on your motherboard's UEFI firmware, not within Ubuntu itself. It's independent of the operating system.

karel
  • 122,292
  • 133
  • 301
  • 332