1 year ago

"Verifying shim SBAT data failed: Security Policy Violation
Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation"

The Ventoy USB drive almost bricked by UEFI Secure Boot enabled laptop.
I had to manually copy a newer version SHIM to the bootloader of the Ventoy USB drive.
That fixed not being able to boot from the USB drive,
but the Linux distro on the laptop's hard drive still wouldn't boot, but the Windows install would boot....
The laptop likely needs to be upgraded to Ubuntu 24.04 which should have the new SHIM now.

Steps to fix the USB drive:

Step 1 Download new SHIM from a Fedora distro:
https://kojipkgs.fedoraproject.org/packages/shim/15.8/3/x86_64/

Mount the Ventoy USB drive to another computer.
You want to mount the 32gb partition, that's the bootloader.

Extract the SHIM you downloaded earlier with rpm2cpio:
rpm2cpio {shim archive.rpm} | cpio -idmv

Copy the BOOTX64.EFI file from the extracted SHIM package to /EFI/BOOT on the Ventoy USB, overwriting the file that's currently there.

Copy the mmx64.efi file from the extracted SHIM package to /EFI/BOOT on the Ventoy USB (this file won't likely exist on the Ventoy drive).

Rename the grub.efi file on the Ventoy USB drive to grubx64.efi

You should now be able to boot to your Ventoy drive again.

Ventoy:
https://www.ventoy.net/en/index.html

Forum Threads:
https://github.com/ventoy/Ventoy/issues/2692
https://github.com/ventoy/Ventoy/issues/2947

Mokutil (if you can disable Secure Boot)
https://en.opensuse.org/openSUSE:UEFI#Reset_SBAT_string_for_booting_to_old_shim_in_old_Leap_image

Ubuntu Issues - New versions should ship with the new SHIM:
https://discourse.ubuntu.com/t/sbat-self-check-failed-mitigating-the-impact-of-shim-15-7-revocation-on-the-ubuntu-boot-process-for-devices-running-windows/47378

Chapters:
00:00 Overview of Problem
01:00 What Causes the SBAT Error?
02:12 Downloading the New SHIM
02:35 Mounting the USB Drive
03:26 Attempting to Extract the SHIM
04:11 Actually Extracting the SHIM
04:27 Copying the Files
05:42 Testing the Ventoy Boot Drive
06:07 Epilogue...