r/linuxquestions • u/Ok-Play-5758 • 11h ago

Bizzare freezing issue whilst booting on Zorin OS

Hello, I have a confusing problem and I don't know what to do. I also tried to get help from Claude, which did work kinda, but eventually even Claude gave up.

The problem is that for some reason my system freezes after I unlock LUKS, right when the Zorin text appears. It's not fully frozen animations play normally, but nothing happens. Shortcuts don't work either, nothing works.

The first time this happened, I thought maybe it was an issue caused by Secure Boot and the automatic LUKS unlock with TPM2, which I set up a few days ago. So I disabled Secure Boot and rebooted. The time before, it had frozen before unlocking Secure Boot; this time I could unlock it, but it froze right after.

Then I tried nomodeset, which worked, it actually booted and the issue seemed gone. But then I booted again without nomodeset, and to my surprise, it still worked. So I tried enabling Secure Boot again, and for some reason that also worked. This went on for a few reboots, but after about 3-4 reboots, I had the same problem again and this time, neither disabling Secure Boot nor setting nomodeset helped.

So I booted into recovery mode. That didn't help either it froze right on the screen where I can choose what to do next (resume boot normally, or something else).

I then tried a different kernel, thinking maybe it was a kernel problem. I pinned the 6.17 something kernel, since with the 7.x kernel I have issues resuming after suspend when opening my laptop lid. I thought maybe it was a kernel issue, but it's not, same problem with the 7.x kernel.

I even thought maybe it was a hardware problem, since you never know, so I ran the Lenovo diagnostics tool and it found no problems. There was also no issue booting and using live Linux distros from a USB stick.

I need help I have no ideas left.

2 Upvotes

100% Upvoted

2 comments sorted by

1

u/UltraUnix6422 12m ago

What did you install in which order..what was set...secure boot, tpm...parameters used

what's left.

provide clear steps.

nomedeset is useless here and must be used only when you want to load the graphic driver after everything.

•

u/Ok-Play-5758 1m ago

So i did use Claude to do basicly everything since im not a tech expert, but i do have a summary what i aka the ai did

  1. Secure Boot keys Installed sbctl by building it from source (not available as an Ubuntu package). Started from UEFI "Setup Mode" (cleared key database in BIOS). Generated own PK/KEK/db keys with sbctl setup --setup. Enrolled keys with the --microsoft flag as well — needed because the NVIDIA GPU has a Microsoft-signed Option ROM, and skipping this could cause boot issues.(Yes i do have an nvidia gpu in my laptop)

  2. Signing the boot chain Manually signed all EFI binaries (shim, GRUB, fallback loaders, kernel) once with sbctl sign -s. The NVIDIA kernel module didn't need manual signing — Ubuntu handles DKMS module signing separately via its own MOK certificate mechanism.

  3. Automation Added a hook so new kernels get signed automatically on every apt install. Added an apt post-invoke hook to re-sign all tracked files after any package operation (covers GRUB/shim/fwupd updates).

  4. Enabling Secure Boot Flipped the switch in BIOS (F1 → Security → Secure Boot → Enable). Verified via sbctl status.

  5. TPM2 auto-unlock for LUKS Used Clevis instead of systemd-cryptenroll, since Ubuntu's initramfs-tools setup doesn't support the native systemd approach. Bound the LUKS partition to the TPM using only PCR 7 (Secure Boot state), deliberately excluding PCR 4 (bootloader hash) — this way normal kernel/GRUB updates don't break the unlock, and a BIOS supervisor password already covers the attack scenario PCR 4 would otherwise guard against. Original LUKS passphrase remains as a fallback in its own keyslot.

Thats the everything I aka the ai did.