UEFI MOK in Ubuntu 22.04 LTS Mate

I have a notebook (Lenovo) that is a UEFI machine and only compatible with Ubuntu. When I would install older versions LTS ,during the installation of the OS I would tick the option of allowing third party drivers and I would get the option of making a MOK password, and after rebooting to finish an intsallation I would get a MOK page to finish the MOK installing . Now ,with the newest Ubuntu Mate 22.04 LTS nothing happens when i allow the third party drivers, I dont get the option of making a MOK password and when rebooting I dont get the MOK page, I have to have the MOK and UEFI secure boot on my machine or it will stop functioning in a few weeks,but how ???

Hi, @Carollyne :slight_smile:

I believe I had a similar problem with the MOK (Machine Owner Key), maybe 2 months ago, in a 5-years old HP Laptop computer that I had previously set up with UEFI Secure Boot and that I upgraded from Ubuntu MATE 20.04.5 ("Focal Fossa") to Ubuntu MATE 22.04.1 ("Jammy Jellyfish") about 3 months ago.

To solve my problem (in Ubuntu MATE 22.04.1 LTS), I've followed the instructions available in the following answer written by "User 56ka - Super User" in "SuperUser.com" and posted on 17th March 2020:

Here is the text from that answer:

"I had same problem and I found a solution, actually it was quite easy.

The problem was that a script was waiting on me to confirm for adding an UEFI entry on my computer but the terminal was not showing up and consuming all ressources (active waiting ?)

Brief

My solution was to run manually the command line, restart the computer and enroll the MOK key.

Complete explication

1. Get the actual command copy-pastable
ps aux | grep -e "update-secureboot-policy"

2. Stop the current process
sudo kill <pid>

3. Run manually the command and follow UEFI instructions
sudo /usr/bin/perl -w /usr/share/debconf/frontend /usr/sbin/update-secureboot-policy --enroll-key

4. Reboot the computer and in the bios go to "MOK key" management

5. Enroll the key (see image below)

6. Finish "

enter image description here

I hope this also helps you @Carollyne :slight_smile:

1 Like

Hi ,thanks for the reply. Normally,the installation process would ask during installing ,on the page where you have to consent with third parties... and then there is a pop up option under that, that asks you to make a password for the keys ,that you need on rebooting to enroll them . When there was no password asked and made ,does this manual solution work ?

Hi, @Carollyne .

I'm afraid that I'm not sure if the manual solution I mentioned would/will work if there was no password asked and created. I think that in my case a password had been asked and I had defined one, but it's been a few months and my memory is fuzzy about that. Sorry! :frowning:

1 Like

It does not work for my problem ,when during the installation no password was made or asked ,there will also not be a screen for finishing the MOK enrolling of keys. My problem still is that nothing is asked during installation and my machine does not work without UEFI/MOK

Hi, @Carollyne.

You wrote:

I'm sorry to hear that :frowning: What is the model of the Lenovo laptop computer that you're using? See if the following excerpt from an answer written by "User Igor Kobzev - Ask Ubuntu" in the "Ask Ubuntu" web site helps you (I haven't tried the following suggestion because there are no "Additional Drivers" available for the HP laptop computer that I'm using):

"drivers - Installing Ubuntu 20.04 LTS with third-party software and Secure Boot is confusing - Ask Ubuntu" - https://askubuntu.com/a/1343582/52725

"(...) Q6: How to verify that everything is okay (UEFI or Secure Boot is not messed with something password or key, third-party software is installed/activated successfully)?

A6: You can confirm that the key wasn't installed properly by opening up a terminal (Ctrl+Alt+T) and typing:

mokutil -l

This will list all the enrolled keys, which in your case should be none.

Now, as for whether you really need to enroll this key, this depends on what exactly the 'third-party-software' was. This could have been some hardware drivers, in which case your PC might not work as well as it could have and you should install these drivers and then enroll the key associated with them. Does your Hp Envy have an nVidia GPU? If so, the proprietary driver for this videocard was definitely among the third-party software you failed to install by not enrolling the MOK key successfully. You can remedy this by pressing the Super (Windows) key and typing Additional Drivers, then selecting the application Additional Drivers, choosing 'proprietary-tested' from the list there and installing it. This will prompt you to enroll the MOK key again, and this time you can finish it."

1 Like