Skip to content

Misc SecureBoot changes #552

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mika merged 3 commits into from
Jul 17, 2026
Merged

Misc SecureBoot changes #552

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a90844b
SecureBoot: update debugging hints in grub.cfg
mika Jul 12, 2026
08a47ea
SecureBoot: fix prefix setting
mika Jul 12, 2026
c81eed7
SecureBoot: read secureboot/grub.cfg also from main GRUB configuration
mika Jul 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions config/media-files/GRMLBASE/boot/grub/grub.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,12 @@
## grub2 configuration

# secure boot, read only if not already sourced elsewhere
if [ "${grml_secureboot}" = "" ] ; then

@zeha zeha Jul 13, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure what we really need from secureboot/grub.cfg. if we only need grml_secureboot being set correctly, maybe its smarter to move the wrmsr test into grub.cfg and not source secureboot/grub.cfg?

@mika mika Jul 14, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The secureboot/grub.cfg was meant as main entrance point as /boot/grub/grub.cfg in the efi.img (see config/media-scripts/GRMLBASE/10-efi), but yeah, maybe we can re-design this?

@zeha zeha Jul 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I remember it was like that, but if it doesn't get loaded, lets put the relevant parts into the normal grub.cfg and keep the (debug) messages in secureboot/grub.cfg?

Sourcing secureboot/grub.cfg from the main config just seems to make things harder to understand?

@mika mika Jul 14, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Absolutely, this only needs further work then. :) FTR, the changes I provide here and in grml-terminalserer as grml/grml-terminalserver#27 are what I was working on for Grml-Forensic, extensively tested and also released as such ("internally"). It's working as-is, the only thing that's not working yet is displaying "SecureBoot" on the splash screen when booting via PXE/netboot, but that's mainly a cosmetic issue only (and I need to see whether there actually is a good solution to get this working at all, given the limitations of test -f ... not working via tftp ;(

(Sorry for the ping-pong in "resolve converstation", GitHub doing strange things on a flaky network connection on a train ride)

if [ -f "${prefix}/../../secureboot/grub.cfg" ] ; then
source "${prefix}/../../secureboot/grub.cfg"
fi
fi

if [ -f "${prefix}/grub_local_custom_early.cfg" ] ; then
source "${prefix}/grub_local_custom_early.cfg"
fi
Expand Down
5 changes: 3 additions & 2 deletions config/media-files/GRMLBASE/secureboot/grub.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ set grml_orig_root=$root
export grml_orig_root

search.file %BOOT_FILE% root
set prefix=($root)/${prefix}/
set prefix=($root)/boot/grub/

# this is a simple test to identify whether GRUB is running in Secure Boot mode
# or not; "wrmsr" is in the list of disabled_mods of GRUB and is supposed to be
Expand Down Expand Up @@ -36,7 +36,8 @@ echo \$prefix
echo \$root
echo \$grml_orig_prefix
echo \$grml_orig_root
search.file "${prefix}/grub.cfg"
ls \$prefix/grub.cfg
search.file /boot/grub/grub.cfg

Hint: Create a screenshot or a picture with your digital camera or mobile phone."

Expand Down
2 changes: 1 addition & 1 deletion config/media-scripts/GRMLBASE/10-efi
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ grub_setup() {
echo "I: Secure Boot is enabled [mode: ${SECURE_BOOT}]"

grml-live-command copy-media-files media /secureboot/grub.cfg
$ROOTCMD mv "${GRML_LIVE_MEDIADIR}"/secureboot/grub.cfg /tmp
$ROOTCMD cp "${GRML_LIVE_MEDIADIR}"/secureboot/grub.cfg /tmp

grml-live-adjust-boot-files "${target}"/tmp/grub.cfg

Expand Down
Loading