Can't load GRUB all of a sudden (UEFI problem)

Question

So, the last time I used my Ubuntu installation was last night. Today, as I booted it up, it told me that booting grubx64.efi is not allowed. Easy enough. I know how to re-enable it from my BIOS.

After re-enabling it, I try booting again and get the following error:

error: Secure Boot forbids loading module from (hd0, gpt7)/boot/grub/normal.mod

And then there's this some kind of 'grub resuce' CL prompt below that error. Never figured it out except that ls is a valid command. Using ls displays various (hdx , *) files/directories/drives.

Note that, as I never got to load Windows 8 from GRUB despite various tutorials, I use rEFInd to switch between loading GRUB (which, in turn, I use to load Ubuntu) and Windows 8.

How do I re-enable GRUB (and get to Ubuntu) and does anyone know what just caused this problem? I remember installing Ubuntu updates last night but I can't remember if there was anything that might relate to something UEFI-specific.

Solution 1

I haven't figured out an exact solution for this but I managed to get back to Ubuntu by a more "general" (for lack of a better term) solution.

I was having a look around at my BIOS when I noticed an option to turn off Secure Boot (wonder why I never noticed it before when I was having trouble dual booting Win8 and Precise). I turned this off and voila, GRUB loads. What's more is that I can now load Windows 8 from GRUB; I no longer need rEFInd as an intermediary. Choosing Win8 from GRUB shows some error tho (which I can bypass with just a press of any key). I'll look into this some other time, unless I figure it's something really risky.

Solution 2

As you've discovered, disabling Secure Boot fixes the problem. My hunch is that you either had it disabled before and somehow accidentally enabled it or you were using a Secure Boot-enabled version of GRUB before and a software update installed an unsigned GRUB or changed the boot path in a way that bypassed the shim program (which is what Ubuntu uses to support Secure Boot).

Another option is to add Secure Boot support more generally. If your first boot loader is rEFInd, you can read rEFInd's Secure Boot documentation for details of how to get it to work with Secure Boot. Unfortunately, Ubuntu doesn't yet ship with a MOK-enabled version of shim, so you'll need to install another version of shim and add Ubuntu's public key to your MOK list. This is possible, and it's not even all that hard, but it involves using several command-line tools and following instructions pretty precisely. Note that Ubuntu added Secure Boot support with version 12.10. I noticed a 12.04 tag on your question, so if you're using 12.04, your kernels are almost certainly not signed, which will complicate this fuller use of Secure Boot. Overall, it's probably best to leave Secure Boot disabled; I mention this alternative in case you have reason to enable it.

Comments

[kramer65]

In addition to this, I also had to disable UEFI-only so that it could also boot from "legacy"