6

i try to update my ubuntu firmware but i get an issue:

Blocked executable in the ESP, ensure grub and shim are up to date: /boot/efi/efi.factory/boot/bootx64.efi Authenticode checksum [2ea4cb6a1f1eb1d3dce82d54fde26ded243ba3e18de7c6d211902a594fe56788] is present in dbx

here are the details of the update:

Version 217: This updates the dbx to the latest release from Microsoft which adds insecure versions of grub and shim to the list of forbidden signatures due to multiple discovered security updates.

Before installing the update, fwupd will check for any affected executables in the ESP and will refuse to update if it finds any boot binaries signed with any of the forbidden signatures. If the installation fails, you will need to update shim and grub packages before the update can be deployed.

Once you have installed this dbx update, any DVD or USB installer images signed with the old signatures may not work correctly. You may have to temporarily turn off secure boot when using recovery or installation media, if new images have not been made available by your distribution.

Version 211: This updates the dbx to the latest release from Microsoft which adds insecure versions of grub and shim to the list of forbidden signatures due to multiple discovered security updates.

Version 190: This updates the dbx to the latest release from Microsoft which adds insecure versions of grub and shim to the list of forbidden signatures due to multiple discovered security updates.

Catalina Manea
  • 69
  • Please do not show pictures of text, cut and paste the text into the body of the question. It may also help to know the version of Ubuntu you are using. EDIT the question and add this info not as comments please. – David Sep 27 '22 at 08:16
  • 3
    You are not alone. I have a very similar issue trying to update firmware to the same version (217) and all packages on my Ubuntu 22.04 install are up to date. My error: Blocked executable in the ESP, ensure grub and shim are up to date: /media/root/ESP/EFI/ubuntu/shimx64.efi – mckenzis Oct 01 '22 at 21:01
  • @mckenzis you can try this for possible solutions https://github.com/fwupd/fwupd/wiki/Blocked-executable-in-the-ESP,-ensure-grub-and-shim-are-up-to-date – Zobayer Hasan Nov 02 '22 at 07:14

2 Answers2

2

WARNING : I don't have the problem myself and I cannot test the answer below. Be aware that it could prevent your computer to boot.

The folder /boot/efi/efi.factory seems to be a specificity of DELL computers sold with Ubuntu [1].

You can check if you are actually using /boot/efi/efi.factory/boot/bootx64.efi to boot with this command :

sudo efibootmgr -v | grep "Boot$(sudo efibootmgr -v | awk '/BootCurrent/{print $2}')"

This command shows which EFI has been used to boot. If it's not /EFI/efi.factory/boot/bootx64.efi and you don't need to boot into DELL Recovery, I think you can safely delete or move it outside the /EFI folder : see https://unix.stackexchange.com/a/636034.

[1] : https://github.com/dell/dell-recovery/blob/master/debian/changelog#L514

Max
  • 574
  • 1
    hey max, thanks i did the command and it showed this:totoro@totoro-Dell-G15-5511:~$ sudo efibootmgr -v | grep "Boot$(sudo efibootmgr -v | awk '/BootCurrent/{print $2}')" [sudo] password for totoro: Boot0006* ubuntu HD(1,GPT,6943d891-5eb1-4136-88e2-945c741fe3c0,0x800,0x1b5800)/File(\EFI\ubuntu\shimx64.efi) – Catalina Manea Oct 07 '22 at 09:33
  • 1
    @CatalinaManea The command output show that you are using \EFI\ubuntu\shimx64.efi to boot and not /boot/efi/efi.factory/boot/bootx64.efi. So I suppose you can proceed and delete /boot/efi/efi.factory/boot/bootx64.efi BUT shimx64.efi is a small bootloader that loads an other EFI ; therefore shimx64.efi could theoretically load /boot/efi/efi.factory/boot/bootx64.efi. I can't help much more I'm afraid. – Max Oct 08 '22 at 10:17
  • @Max Renaming offending efi-file isn't enough — fwupdmgr will still complain. It should be moved from this folder. – whtyger Oct 27 '22 at 11:17
  • @whtyger, thanks, I have modified the proposed answer accordingly. – Max Oct 28 '22 at 16:13
2

This usually happens for old efi files that needed to be manually updated. Here's an excerpt from fwupd wiki pages

In my case, the file that the update complained about was /boot/efi/EFI/BOOT/bkpbootx64.efi. I discovered that that file was a year older than the other files within the same directory. A websearch disclosed that the file was 'a backup regularly created by Boot-Repair.' Boot-Repair is a third-party program that is designed to be used on Ubuntu and which one an use - with caution - on Ubuntu-derivatives such as Linux Mint. I am on Mint and had used the program. I deleted the backup file, i.e. /boot/efi/EFI/BOOT/bkpbootx64.efi. I told fwupd to do the update. I rebooted fwupd gave little sign of having done the update but running fwupd again suggested that the update had indeed been performed; and my system seems to continue to work perfectly well.

Another user found the following. 'My problem was that I had a very old /boot/efi/EFI/ubuntu from a previous install. I am running Fedora. So the very old ubuntu components were not being updated, blocking the UEFI dbx update.'

The error message usually tells you the name of the problematic efi file:

Blocked executable in the ESP, ensure grub and shim are up to date: /boot/efi/efi.factory/boot/bootx64.efi Authenticode checksum [2ea4cb6a1f1eb1d3dce82d54fde26ded243ba3e18de7c6d211902a594fe56788] is present in dbx

Filename: /boot/efi/efi.factory/boot/bootx64.efi

You can delete this file and then update fwupdmgr again

sudo fwupdmgr refresh --force
sudo fwupdmgr update

This will ask you for a reboot. After the reboot, if you check again, you'll see that the update has been installed.

Zobayer Hasan
  • 876
  • hi i did the sudo fwupdmgr refresh -- force and after the sudo fwupdmgr update and still have the same mistake: Blocked executable in the ESP, ensure grub and shim are up to date: /boot/efi/efi.factory/boot/bootx64.efi Authenticode checksum [2ea4cb6a1f1eb1d3dce82d54fde26ded243ba3e18de7c6d211902a594fe56788] is present in dbx just fustrating – Catalina Manea Nov 04 '22 at 06:24
  • @CatalinaManea did you delete /boot/efi/efi.factory/boot/bootx64.efi? If not, you might have to, as it is the old file. Everyone has problems with different files. I believe there will be a fix for this in one of the next releases, and ignoring this update won't cause any significant trouble. – Zobayer Hasan Nov 07 '22 at 03:28