Nobara's kernels and GRUB are signed with the Nobara Secure Boot key, so Nobara
can boot with Secure Boot enabled. With Secure Boot on, Nobara can also boot
the way Easy Anti-Cheat (EAC) Linux v2 requires, which some games need.
This guide takes about 15 minutes and needs two restarts that you start.
The updater and MokManager add automatic restarts in between. You will:
nobara-eac, enroll the keys and prepare the update. No restartNothing here is required. If you don't play EAC games, Nobara keeps working
the way it always has with Secure Boot off.
Required packages. Secure Boot only works with at least these versions:
Package Minimum version kernel-core7.3.0-203.nobara(mainline) or6.18.55-200.lts.nobara(LTS)grub2-efi-x642.12-64nobara-eac1.0-3shim-x64any (Fedora's signed shim, installed by default) Older kernels and older GRUB builds are not signed and won't boot with
Secure Boot on.
Using DKMS or akmods modules (NVIDIA, xone and others)? Read
Kernel modules: DKMS and akmods before you
turn on Secure Boot, or those modules won't load in the EAC entry.
Windows dual boot with BitLocker: changing Secure Boot settings can make
Windows ask for your BitLocker recovery key on its next boot. Get the key
first from https://aka.ms/myrecoverykey.
Every signed kernel (7.3.0-203.nobara, 6.18.55-200.lts.nobara and later)
has two entries in the GRUB boot menu. Older kernels keep their single normal
entry, because they aren't signed and can't boot with Secure Boot on.
| Entry | What it does |
|---|---|
[EAC] Nobara Linux (<version>) ... |
The EAC entry. It's the default once Secure Boot is on and the keys are enrolled. |
Nobara Linux (<version>) ... |
The normal Nobara boot, with no extra restrictions. |
Until Secure Boot is on and the keys are enrolled, the normal entry stays the
default.
The EAC entry adds these kernel options: lockdown=integrity,
module.sig_enforce=1, sysctl.kernel.kexec_load_disabled=1,
iommu.passthrough=0, intel_iommu=on, and an lsm= list that includes
bpf. Two of them matter for daily use:
/dev/mem tools, and unsigned or[EAC], when youDo all of this in one session, in this order. The restart in step 2 then
confirms the keys and installs the update in one go.
sudo dnf install nobara-eac
Installing packages with dnf is fine. Don't update the system with
dnf update; use the Nobara updater, as below.
sudo nobara-eac-enroll
The command enrolls up to three keys in one step:
/var/lib/dkms/mok.pub). DKMS signs the modules itdkms-nvidia and xone./etc/pki/akmods/certs/public_key.der), if you useakmod-nvidia.The DKMS and akmods keys are created on your computer. Each computer has its
own, and their private halves never leave it. Because the keys exist before
the update, DKMS and akmods sign the modules they build for the new kernel
during the update.
The command asks you to choose a one-time password. Pick something short,
because you will type it once more in MokManager. MokManager may use a US
keyboard layout.
Don't restart yet. The keys are confirmed on your next restart, which
should be the one that installs the update (step 2).
The Nobara CA's SHA-256 fingerprint is:
A3:6D:9C:67:6F:ED:15:D6:45:A3:D2:84:5F:CE:8B:73:AB:54:CC:2B:DF:33:BD:A4:37:05:F7:40:68:41:6A:2E
You can compare it with your copy:
openssl x509 -inform der -in /usr/share/nobara/eac/nobara-sb-ca.der -noout -fingerprint -sha256
If you use DKMS or akmods modules (NVIDIA, xone and others), do
the module steps now.
Open DNF App Center, go to Updates and choose Update System. From
a terminal you can run sudo nobara-sync cli instead.
Wait until the updater says "System update will install on the next
restart". Kernel and bootloader updates install offline, during the
restart, so they never change the running system.
If the updater finds nothing to update, that's fine. Check the versions in
step 2 after the restart.
Save your work and restart. Then:
MokManager. Right after the firmware logo, a blue MokManager screen
appears ("Perform MOK management"). It waits only about 10 seconds, so be
ready and press any key.
If you miss the screen, see Troubleshooting.
The update installs before the desktop starts. Then the computer
restarts by itself, into the new kernel. Keep it powered on until the
desktop is back.
Now check the versions. Yours must be at least these:
rpm -q kernel-core grub2-efi-x64 shim-x64 nobara-eac
sudo nobara-eac-enroll --check && echo enrolled
| Package | Minimum version |
|---|---|
kernel-core |
7.3.0-203.nobara (mainline) or 6.18.55-200.lts.nobara (LTS) |
grub2-efi-x64 |
2.12-64 |
nobara-eac |
1.0-3 |
shim-x64 |
any (Fedora's signed shim) |
The second command must print enrolled.
If the kernel or GRUB is older, your mirror may not have the new packages yet.
Run the updater again later; that update needs one more restart. Don't turn
on Secure Boot until all of them are at least these versions.
Older kernels won't boot with Secure Boot on. Only
7.3.0-203.nobara,
6.18.55-200.lts.nobaraand later kernels are signed. If you pick an older
kernel in the GRUB menu, it stops withbad shim signature. Choose a newer
kernel instead. The updater boots the newest kernel after an update, so you
normally don't have to choose.
Finally, check that the firmware starts Nobara through shim, not straight
through GRUB:
efibootmgr
The BootCurrent entry, usually labelled Fedora or Nobara, must end in
\EFI\fedora\shimx64.efi. If it ends in grubx64.efi instead, see
Troubleshooting.
Restart straight into your firmware setup:
systemctl reboot --firmware-setup
If that doesn't work, restart and press Del, F2, F10 or F12 at the
logo.
The menu names differ between vendors. Look for these settings:
Save and exit. Nobara starts.
On this first boot with Secure Boot on, the GRUB menu still defaults to the
normal entry. To use EAC right away, choose the [EAC] entry in
the GRUB menu. If the menu is hidden, hold Shift or press Esc while
booting to show it. From the next boot on, the EAC entry is the default:
nobara-eac.service switches it once it sees Secure Boot and the enrolled
keys. You don't need an extra restart for that.
Many ASUS boards, and some other vendors' boards, have an OS Type
dropdown, usually under Boot → Secure Boot. Its options are:
| Option | What it does |
|---|---|
| Other OS | Secure Boot stays off, even if it says Enabled elsewhere. Often the default. |
| Windows UEFI Mode | Secure Boot is on, using the standard Microsoft keys. |
Choose Windows UEFI Mode, even though you're running Nobara. The name is
misleading: it doesn't make the computer Windows-only. It just turns on Secure
Boot with the Microsoft keys, and Nobara's shim is signed by Microsoft.
If your firmware has no OS Type dropdown, skip this; setting Secure Boot to
Enabled is enough.
To check it worked, run this after Nobara starts:
mokutil --sb-state # SecureBoot enabled
Make sure you booted the EAC entry. Then run:
mokutil --sb-state # SecureBoot enabled
cat /sys/kernel/security/lockdown # none [integrity] confidentiality
cat /sys/module/module/parameters/sig_enforce # Y
cat /proc/sys/kernel/kexec_load_disabled # 1
cat /sys/kernel/security/lsm; echo # ...,bpf,...
cat /sys/kernel/iommu_groups/0/type # DMA or DMA-FQ (not identity)
ls /dev/tpmrm0 # /dev/tpmrm0
sudo nobara-eac-enroll --check && echo enrolled # enrolled
If you use NVIDIA, check that the driver is loaded and signed:
nvidia-smi
modinfo -F signer nvidia # DKMS module signing key, or your akmods key
The EAC entry only loads kernel modules signed with a key the kernel trusts:
| Modules | Signed with | What you need to do |
|---|---|---|
| Modules shipped with the Nobara kernel | The kernel's own build key | Nothing |
DKMS: dkms-nvidia, xone, xpad-noone, openrazer-driver and other DKMS packages |
Your DKMS key, /var/lib/dkms/mok.pub |
Enroll the key, then check the modules are signed |
akmods: akmod-nvidia and other akmod-* packages |
Your akmods key, /etc/pki/akmods/certs/public_key.der |
Enroll the key, then check the modules are signed |
| Modules you built by hand, or other installers | Usually nothing | They load only in the normal entry, without [EAC] |
sudo nobara-eac-enroll (step 1) enrolls the DKMS and akmods keys together
with the Nobara CA. It also creates them if they don't exist yet. You don't
need to do anything else for this step.
DKMS and akmods sign every module they build, but only once their key exists.
Modules built before that are unsigned. Check each module you use:
modinfo -F signer nvidia # NVIDIA, from dkms-nvidia or akmod-nvidia
modinfo -F signer xone_gip # xone
dkms status # list all your DKMS modules
The output should say DKMS module signing key or the name of your akmods
key. If it's empty, the module is unsigned and must be rebuilt (step C).
DKMS (for example dkms-nvidia, xone, xpad-noone or
openrazer-driver). This rebuilds every DKMS module for every kernel it's
installed for, so it can take a few minutes:
sudo bash -c 'dkms status | while IFS=", :" read -r mod kver arch state; do
case "$state" in installed*)
dkms build --force "$mod" -k "$kver" && dkms install --force "$mod" -k "$kver" ;;
esac
done'
akmods (for example akmod-nvidia):
sudo akmods --force --rebuild
Then check again with modinfo -F signer (step B). You don't need to restart
for that.
/var/lib/dkms/mok.key,/var/lib/dkms/mok.pub or the files in /etc/pki/akmods/. New keys aren'tsudo nobara-eac-enroll again, confirm it indkms-nvidia and akmod-nvidia uses a differentsudo nobara-eac-enroll again afterwards, so the new key is/etc/sysconfig/nobara-eac chooses the default entry:
EAC_DEFAULT=auto # EAC when Secure Boot is on and the keys are enrolled (default)
EAC_DEFAULT=yes # always EAC
EAC_DEFAULT=no # never EAC, but the EAC entry stays in the menu
The change applies on the next boot. To apply it right away, run:
sudo /usr/lib/kernel/install.d/95-nobara-eac.install apply-all
Your own kernel options, for example set with grubby or in
/etc/default/grub, apply to both entries. In the EAC entry, options that
conflict with EAC are left out, for example iommu=pt, amd_iommu=off or
another lockdown=.
bad shim signature / Verification failed: (0x1A) Security Violation
The kernel or GRUB you chose isn't signed by Nobara. Choose a newer kernel.
If no entry boots, turn Secure Boot off, update with the Nobara updater, and
check the versions in step 2.
mokutil --sb-state says SecureBoot disabled, although the firmware says Enabled
Your firmware probably has an OS Type dropdown still set to Other OS. Set it
to Windows UEFI Mode; see the OS Type dropdown. If
the firmware says it is in Setup Mode, restore its factory (default) keys.
The boot entry ends in grubx64.efi instead of shimx64.efi
Check that shim is on the EFI partition:
sudo ls /boot/efi/EFI/fedora/shimx64.efi
If the file is missing, reinstall the package with
sudo dnf reinstall shim-x64.
Then create a firmware boot entry that points at shim. First find the disk
and partition of /boot/efi:
findmnt /boot/efi
For example, /dev/nvme0n1p1 is disk /dev/nvme0n1, partition 1. Then:
sudo efibootmgr --create --disk /dev/nvme0n1 --part 1 --label Nobara --loader '\EFI\fedora\shimx64.efi'
I missed the MokManager screen
The update still installs normally; only the keys aren't enrolled yet. Don't
turn on Secure Boot yet. Run sudo nobara-eac-enroll again. If it says the keys are "waiting for
confirmation", just reboot and watch for the blue screen. If the screen never
appears, cancel the request and start over:
sudo mokutil --revoke-import
sudo nobara-eac-enroll
NVIDIA (or another module) doesn't load in the EAC entry
Its signing key isn't enrolled. Check this:
sudo nobara-eac-enroll --check || echo "not enrolled"
If the keys aren't enrolled, run sudo nobara-eac-enroll and confirm them in
MokManager on the next restart. If they are,
the module is probably unsigned: check it with modinfo -F signer <module>
and rebuild it, as described in
Kernel modules: DKMS and akmods. Until
then, use the normal entry, without [EAC], where all modules load.
Modules you built by hand, or that come from packages that use neither DKMS
nor akmods, only load in that entry.
The EAC entry isn't the default
auto needs Secure Boot on and every key enrolled. Check both:
mokutil --sb-state
sudo nobara-eac-enroll --check && echo enrolled
Then reboot once, so nobara-eac.service can update the entries.
Turning Secure Boot off again
Turn it off in the firmware. With EAC_DEFAULT=auto, the normal entry becomes
the default again on the next boot. The enrolled keys can stay.
Uninstalling
sudo dnf remove nobara-eac
This removes the EAC entries and restores your normal boot entries. To also
remove the enrolled keys, run:
sudo mokutil --delete /usr/share/nobara/eac/nobara-sb-ca.der /var/lib/dkms/mok.pub
Add /etc/pki/akmods/certs/public_key.der to that command if you enrolled it.
Then reboot and confirm the deletion in MokManager. Don't delete the Nobara
CA while Secure Boot is on, or Nobara won't boot.