How-To: Check Whether Your Linux Box Booted With Secure Boot

With Secure Boot coming to Omarchy (see the news post in this batch), here’s how I check what my machines are doing today, without touching the firmware.

1. Is it even UEFI?

[ -d /sys/firmware/efi ] && echo UEFI || echo "Legacy BIOS"

2. Secure Boot state

bootctl status 2>/dev/null | grep -i "secure boot"
# or, if mokutil is installed:
mokutil --sb-state

You’ll see “enabled,” “disabled,” or “setup” mode. On Omarchy today it should say disabled, because the installer needs it off.

3. What’s booting you

bootctl status | sed -n '1,25p'
efibootmgr -v | head

This shows your bootloader, whether you’re booting a Unified Kernel Image, and your firmware boot order.

Don’t

• Don’t turn Secure Boot on just to see what happens. On an unsigned install you’ll get a “Secure Boot Violation” and won’t boot until you turn it back off.
• Don’t enroll random keys. Wait for the official signed builds.

Write the results down for each machine so you know where you’re starting from when signed releases show up.

God Bless, and Happy hacking!

References & Further Reading

• bootctl (systemd man page)
• UEFI Secure Boot (ArchWiki)
• Secure Boot is coming to Omarchy (Omarchy Central)