🔓 secure-boot-locked-bios

Claude Code Skill for installing and maintaining Linux on Dell laptops with a locked BIOS supervisor password and Secure Boot that cannot be disabled.

The Problem

Bought a second-hand Dell laptop and the previous owner forgot to remove the BIOS supervisor password? Secure Boot is enabled and you can't disable it? F12 boot menu is locked?

This skill documents a complete, tested solution to install any Linux distribution on these locked machines — without cracking the BIOS password, without hardware modifications, and without disabling Secure Boot.

How It Works

We use Ubuntu's Microsoft-signed bootloader (shim) as a bridge to bypass Secure Boot, then sign our actual Linux bootloader and kernel with personal MOK (Machine Owner Key) keys. The BIOS thinks it's booting a Microsoft-trusted chain, but it's actually loading your Linux of choice.

BIOS (trusts Microsoft) → Ubuntu shim (Microsoft-signed)
  → systemd-boot disguised as grubx64.efi (MOK-signed)
    → Linux kernel (MOK-signed) → Your distro boots!

What's Included

• Complete step-by-step procedure from zero to working Linux
• MOK key generation and enrollment without BIOS access
• Automated Pacman hooks for Arch/CachyOS to survive kernel and systemd updates
• Recovery procedure without opening the laptop
• NVRAM troubleshooting (Volume Full errors)
• EFI partition reference structure

Installation

npx skills-installer add ascladino/secure-boot-locked-bios --client claude-code

Or manually copy SKILL.md to ~/.claude/skills/secure-boot-locked-bios/.

Tested On

• Dell Latitude 7330 (i7-1265U, BIOS 1.37.0) with CachyOS
• Should work on any Dell with UEFI Secure Boot and locked supervisor password

Key Lessons Learned

1. MOK doesn't talk to BIOS directly — only the shim reads MOK keys
2. The shim looks for grubx64.efi by hardcoded name — it doesn't care what's inside
3. Pacman hooks for systemd-boot MUST be priority 99 — systemd's own update routine overwrites signed files at lower priorities
4. Ubuntu's shim (BOOTX64.EFI) must NEVER be overwritten — it's the only Microsoft-signed file in the chain
5. Recovery without hardware access is possible by connecting Ubuntu via NVMe-to-USB adapter and letting the firmware fall through to it

Contributing

If you've tested this on other Dell models or other locked UEFI machines, please open an issue or PR with your experience.

License

MIT

Author

Ascencio Ladino (@ascladino) — Electronic Engineer, Colombia

Born from necessity: a second-hand Dell Latitude with a forgotten BIOS password and two days of trial, error, and persistence.