Arch Linux

psjw12

Member

Registered: 2018-01-26

Posts: 4

Bootloader has not verified loaded image with shim and encrypted boot

I have setup Arch with an encrypted boot partition using the following setup instructions
https://wiki.archlinux.org/index.php/Dm … .28GRUB.29

Everything works fine and I can boot my system and unlock all my partitions successfully.

I wanted to turn secure boot back on my device (because of Bitlocker) and used the Shim method described here
https://wiki.archlinux.org/index.php/Secure_Boot#shim

I enrolled the keys no problem. When I boot, Grub loads fine and asks to decrypt partition, however shortly after booting I get an error

Bootloader has not verified loaded image
System is compromised. halting.

I was wondering if either I'm missing a Grub configuration or if vmlinuz-linux didn't sign correctly?

Thank you

lo1

Member

Registered: 2017-09-25

Posts: 584

Re: Bootloader has not verified loaded image with shim and encrypted boot

I was wondering if either I'm missing a Grub configuration or if vmlinuz-linux didn't sign correctly?

Probably both? Can you post what you did step by step in code tags? The wiki suggests

You may want to consider using Direct UEFI boot with efibootmgr after generating the signed .efi file."

so maybe someone experienced issues with grub or any other bootloader before (are you using auto configuration from grub-mkconfig?)

---

How To Ask Questions The Smart Way && Tacts Filters && K.I.S.S. &&
Rootless Root

psjw12

Member

Registered: 2018-01-26

Posts: 4

Re: Bootloader has not verified loaded image with shim and encrypted boot

Probably both? Can you post what you did step by step in code tags? The wiki suggests

You may want to consider using Direct UEFI boot with efibootmgr after generating the signed .efi file."

So the steps were very in line with what the wiki listed but isn't the bit about Direct UEFI boot for when using your own keys? I'm using Shim.

psjw12

Member

Registered: 2018-01-26

Posts: 4

Re: Bootloader has not verified loaded image with shim and encrypted boot

I've re-installed the kernel so it's unsigned, and re-signed it and I get the 2 following warnings:

warning: file-aligned section .text extends beyond end of file
warning: checksum areas are greater than image size. Invalid section table?

psjw12

Member

Registered: 2018-01-26

Posts: 4

Re: Bootloader has not verified loaded image with shim and encrypted boot

To work around this for now I just used PreLoader which works fine (although you need to enroll the unsigned EFI's, it won't enroll the signed ones).