From a90844ba1bbaa712ab8d4ec2dffdf06c6c03d355 Mon Sep 17 00:00:00 2001 From: Michael Prokop Date: Sun, 12 Jul 2026 23:08:15 +0200 Subject: [PATCH 1/3] SecureBoot: update debugging hints in grub.cfg The `search.file "${prefix}/grub.cfg"` won't be useful, as $prefix usually contains something like (cd0) and then search.file fails. Explicitly ask for /boot/grub/grub.cfg, which we hardcode in config/media-scripts/GRMLBASE/10-efi anyways. Additionally ask for listing of $prefix/grub.cfg, to have an idea whether the file exists at all. --- config/media-files/GRMLBASE/secureboot/grub.cfg | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/config/media-files/GRMLBASE/secureboot/grub.cfg b/config/media-files/GRMLBASE/secureboot/grub.cfg index 23f0b10a3..76020c9a1 100644 --- a/config/media-files/GRMLBASE/secureboot/grub.cfg +++ b/config/media-files/GRMLBASE/secureboot/grub.cfg @@ -36,7 +36,8 @@ echo \$prefix echo \$root echo \$grml_orig_prefix echo \$grml_orig_root -search.file "${prefix}/grub.cfg" +ls \$prefix/grub.cfg +search.file /boot/grub/grub.cfg Hint: Create a screenshot or a picture with your digital camera or mobile phone." From 08a47ea9bd2be0396b70fdf266e69a63356f5448 Mon Sep 17 00:00:00 2001 From: Michael Prokop Date: Mon, 13 Jul 2026 00:19:11 +0200 Subject: [PATCH 2/3] SecureBoot: fix prefix setting We can't set $prefix to ($root)/${prefix}/, as $prefix is usually already populated with "something" and we therefore end end up with an unexpected and failing $prefix. Instead, use /boot/grub as set in config/scripts/GRMLBASE/45-grub-images and config/media-scripts/GRMLBASE/10-efi. Fixup for 5c048ce45afbe8ba61963828348780a20595b6d1 --- config/media-files/GRMLBASE/secureboot/grub.cfg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/media-files/GRMLBASE/secureboot/grub.cfg b/config/media-files/GRMLBASE/secureboot/grub.cfg index 76020c9a1..ce9e4a28f 100644 --- a/config/media-files/GRMLBASE/secureboot/grub.cfg +++ b/config/media-files/GRMLBASE/secureboot/grub.cfg @@ -7,7 +7,7 @@ set grml_orig_root=$root export grml_orig_root search.file %BOOT_FILE% root -set prefix=($root)/${prefix}/ +set prefix=($root)/boot/grub/ # this is a simple test to identify whether GRUB is running in Secure Boot mode # or not; "wrmsr" is in the list of disabled_mods of GRUB and is supposed to be From c81eed73ba0ae55b7b90f6206a418faeccd2ebbf Mon Sep 17 00:00:00 2001 From: Michael Prokop Date: Mon, 13 Jul 2026 00:23:09 +0200 Subject: [PATCH 3/3] SecureBoot: read secureboot/grub.cfg also from main GRUB configuration For yet unknown reasons, the secureboot/grub.cfg configuration file is no longer sourced on booting. The file can be sourced just fine though, but due to our copy-media-files + mv actions, the file is no longer available on the live system. Instead, let's make it a copy and try to read the file from the main GRUB configuration also (if $grml_secureboot is still unset, it means we didn't read the file yet). --- config/media-files/GRMLBASE/boot/grub/grub.cfg | 7 +++++++ config/media-scripts/GRMLBASE/10-efi | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/config/media-files/GRMLBASE/boot/grub/grub.cfg b/config/media-files/GRMLBASE/boot/grub/grub.cfg index ad87aef06..d13e295fd 100644 --- a/config/media-files/GRMLBASE/boot/grub/grub.cfg +++ b/config/media-files/GRMLBASE/boot/grub/grub.cfg @@ -1,5 +1,12 @@ ## grub2 configuration +# secure boot, read only if not already sourced elsewhere +if [ "${grml_secureboot}" = "" ] ; then + if [ -f "${prefix}/../../secureboot/grub.cfg" ] ; then + source "${prefix}/../../secureboot/grub.cfg" + fi +fi + if [ -f "${prefix}/grub_local_custom_early.cfg" ] ; then source "${prefix}/grub_local_custom_early.cfg" fi diff --git a/config/media-scripts/GRMLBASE/10-efi b/config/media-scripts/GRMLBASE/10-efi index b3a7f5545..302154e25 100755 --- a/config/media-scripts/GRMLBASE/10-efi +++ b/config/media-scripts/GRMLBASE/10-efi @@ -93,7 +93,7 @@ grub_setup() { echo "I: Secure Boot is enabled [mode: ${SECURE_BOOT}]" grml-live-command copy-media-files media /secureboot/grub.cfg - $ROOTCMD mv "${GRML_LIVE_MEDIADIR}"/secureboot/grub.cfg /tmp + $ROOTCMD cp "${GRML_LIVE_MEDIADIR}"/secureboot/grub.cfg /tmp grml-live-adjust-boot-files "${target}"/tmp/grub.cfg