Linux › Section E · How the Linux kernel boots › Topic E.4
UEFI secure boot and chainloading
Malware that runs before the operating system is hard to detect and hard to remove. UEFI Secure Boot answers it with a chain of digital signatures from the firmware to the kernel. This topic follows that chain, shows how Linux fits into a system built around Microsoft's keys, and how GRUB hands control to another operating system.
In this topic
- Why sign the boot path?
- Keys held by the firmware
- shim: the bridge to Linux
- Worked example: following the chain
- Machine Owner Keys and mokutil
- Lockdown and kernel modules
- Revocation and the 2026 certificate change
- Turning Secure Boot off
- Chainloading another system
- Worked example: a Windows entry on UEFI
- Common mistakes to avoid
- Key takeaways
This topic is part of Wuanberri Pro. Checking your access…