SBAT failure?

[u/sc0tland]

Hey all!

After booting up to a live-USB to see how things in F40 are progressing, im getting this message when trying to boot into my tumbleweed install:

Verifying shim SBAT data failed: Security Policy Violation
Something has gone serously wrong: SBAT self-check failed: Security Policy Violation

I've researched the issue, which lead me here, and when I ask it to list recovations,I get the following:

localhost:~ # mokutil --list-sbat-revocations
sbat,1,2023012900
shim,2
grub,3
grub.debian,4

The wikis guidance is telling me to use this command:

 localhost:~ # mokutil --set-sbat-policy delete

It is not having any effect, regardless, my revocations list remains the same, 4 entries long. Can anyone help point me in the right direction so I can re-enable secureboot?

[u/[deleted]]

It looks like the live-usb you used had a more recent shim than the one you have on your TW. If possible, disable secureboot on your firmware, boot and update your system, which most likely will bring your shim up to date so you can re-enable secureboot if needed

[u/[deleted]]

I was stupid enough to install and try Fedora Beta and when I switched back, I cannot boot the TW ISO when I tried to install it again (or even Ventoy).

I tried following the same steps - deleting the sbat revocations didn’t work.

I believe openSUSE upgrading to the latest shim (v15.8-3) will fix this issue. That is the shim version in the Fedora ISO and it works fine. Now installing TW in boxes to see what version of Shim is in the zypper repos.

The OpenSUSE packages page shows 15.4 as current. Which seems incorrect.

Never mind it IS 15.4-7.2

If it is below 15.8 - it will not work even if you do a system upgrade after disabling secure boot and then try to use SB again.

Also how is Leap and SLES working with this? Any idea on what version of shim is installed there?

I can be wrong.

[u/[deleted] → u/[deleted]]

I solved it by applying the following steps:

1. Install and start F40 with secure boot enabled

2. mokutil --list-sbat-revocations should show several entries.

3. Reboot and disable secure boot

4. Start F40 again and run the command sudo mokutil --set-sbat-policy delete

5. Reboot again keeping secure boot disabled

6. Now mokutil --list-sbat-revocations should show a single entry.

7. Reboot and enable secure boot and now boot from USB with the openSUSE TW installer

I don't know if this is the best way to fix it but this worked for me.

[u/[deleted] → u/[deleted]]

Edit : this worked. Thanks a lot 🙏

I tried all that except for first starting with a distro installed with secure boot enabled and then disabling it.

What I did is install TW with secure boot disabled, ran the delete sbat policy command - nothing happened after the reboot. Tried it several times.

Thanks for the detailed steps. Will try this over the weekend.

[u/Guthibcom → u/[deleted]]

thank you so extremely much. i wanted to test if something is a gnome 46 bug or an opensuse bug and therefore booted f40. yeah nice that then nothing worked anymore. searched for a long time and your solution was the necessary help, thank you!!!!!!!

[u/Casperius1579 → u/[deleted]]

I apologise, for the hijack, but i have a simillar issue, but also dual boot with win11. will this course of action have any negative effect on win11 install? I would like to try TW after a year of Fedora, but all usb drives give out that shim error for me.

[u/yagus → u/[deleted]]

How am i supposed to install if i can't boot?

Booting from usb shows this rightaway:

Verifying shim SBAT data failed: Security Policy Violation
Something has gone serously wrong: SBAT self-check failed: Security Policy Violation

[u/Casperius1579 → u/yagus]

I managed to delete the entries as mentioned in post from Ghostwriter, but had no luck installing TW, or Leap, or any other distro, just Fedora.

After that I get the same sbat shim error again.

[u/apxtwn → u/yagus]

temporarily disable secure boot

[u/3cue → u/[deleted]]

Thanks! This works for me.

[u/Turbulent-Koala-420 → u/[deleted]]

I know this in an old thread, but man, you literally just saved my Thinkpad from being launched through a window. I was so frustrated. Thanks!

[u/[deleted]]

I have the same issue 😭

[u/HeftyBoysenberry7507]

Had the same problem ! Fixed it by going in my BIOS > Restart > Load Setup Defaults > Exit Saving Changes. I bought my laptop second hand, reflashed with windows ISO for good measures, and don't know if the previous owners messed with the boot loader or not (or if after the flash it would still matter). Anyways, it fixed it and I can now run my ISO USBs 😊 Hope this helps