Grub cannot load image. How to prepare grub for shim?

[nxe9]

Hi, I managed to load gentoo uki kernel via shim without grub. Now I would like to try shim with grub between shim and uki. I tried two approaches, which ended in failure.

This is what my boot partition looks like in a nutshell:
/boot/EFI/gentoo/shim64.efi < - shim
/boot/EFI/gentoo/mmx64.efi < - signed MOK Manager
/boot/EFI/gentoo/grubx64.efi < - signed grub
/boot/EFI/Linux/gentoo-6.6.58-gentoo-dist.efi < - signed UKI kernel

Approach 1:
I just signed grubx64.efi. Without secure boot option the system boots, but with secure boot there is a secure boot violation / invalid signature detected. For me this means that grub contains some unsigned components or is prepared inappropriately, maybe something with sbat etc. From what I understand, it is better to creat grub with ‘grub-mkstandalone’, so I would like to focus on the second approach where I did it.

Approach 2:
I created grub using mkstandalone. With the secure boot option, grub boots to the kernel selection window and then gives an error. So grub seems to be signed correctly, but there is still something wrong with the configuration.

Error after selecting kernel:

[Child_of_Sun_24]

Maybe it helps you here is my command for installing grub, you have to sign it manually after this:

[nxe9]

Looking at your command, I found this entry.

[Child_of_Sun_24]

Since i use chainloader to start my Windows 11 through grub i would say it works.

Here's my snippet of grub.cfg:

[nxe9]

@Child_of_Sun_24: Your Approach 1 looks promising. This is more or less how it is also documented on the Arch wiki, to add modules directly during grub-install. Then you will probably avoid the problem with unsigned modules that I had in this case. On the other hand, it is a bit ugly that you have to manually list the modules to be added.

Do you use the grub-mkconfig command later? Can you copy your menuentry for gentoo?

Back to Approach 2.
I tried to move the kernel from

[Child_of_Sun_24]

Here is the snippet from gentoo kernel:

[Nowa]

[nxe9]

@Nowa / Approach 2:

Secureboot flag doesn't work on grub package properly. That is the reason why I am trying to do it manually. See the following for details
https://forums.gentoo.org/viewtopic-t-1171516.html
https://bugs.gentoo.org/935733

I think grub finds the location of my kernel because in case "chainloader $uki_path" there is an error as I wrote in the first post

[Nowa]

[nxe9]

@Nowa, thanks.

I make UKi installing gentoo-kernel with* uki and dracut flags.

*EDIT: gentoo-kernel doesn't contain uki and dracut. I mean 'installkernel' with uki and dracut. gentoo-kernel calls installkernel.

emerge --config gentoo-kernel output:
https://bpa.st/ZMRFQ
https://bpa.st/Y3GYY

The -pid-sandbox allows me to build grub with secureboot flag and generates signed grub but the result after reboot is the same.

[nxe9]

I tried (approach 1):

[Child_of_Sun_24]

No i'm not using Uki.

[Nowa]

What is this "/boot/grub/grubenv"? Do you know where it comes from?

You should not need anything at /boot/grub at all, the grub.cfg and the standalone grubx64.efi should be enough to boot. Could you try moving the /boot/grub directory (if it exists) somewhere out of the way and then re-generating the grub.cfg? Is there something in your grub configuration files that references this "/boot/grub/grubenv"?

What is in the .cmdline section of your UKI?
_________________
OS: Gentoo 6.10.12-gentoo-dist, ~amd64, 23.0/desktop/plasma/systemd
MB: MSI Z370-A PRO
CPU: Intel Core i9-9900KS
GPU: Intel Arc A770 16GB & Intel UHD Graphics 630
SSD: Samsung 970 EVO Plus 2 TB
RAM: Crucial Ballistix 32GB DDR4-2400

[GDH-gentoo]

[Nowa]

[nxe9]

@Nowa

"/boot/grub/grubenv" error occurs only with grub standalone. In case of grub standalone and non secureboot when this error occurs I can still boot the system. I suppose this grubenv error is because standalone doesn't have <archive / own environment>/boot/grub/grubenv. The grubenv exist only inside <disk / partition>/boot/grub and standalone doesn't know anything about it. On the other hand, "grub install" (grub non standalone) knows this location and that's why the error doesn't appear there. See "12.3.1 Technical Information" for details https://wiki.archlinux.org/title/GRUB/Tips_and_tricks#Technical_information
I don't think this error is key here.

I also tried to execute

[Nowa]

[nxe9]

... cat /tmp/cmdlline gives the same result as cat /proc/cmdlline above.

Interestingly, chanload works, but only in the absence of secure mode. This is also not due to incorrect signing of the bootloader / UKI. Because if I don't sign grub, I get an error from the UEFI level "Secure boot violation" and my signed UKI works without any problem with secure boot option without grub.

In short, there is some problem in the following case:
secure boot + grub + UKI (+cmdline).

Maybe that's why someone on reddit also wrote about some Ubuntu patches.

At least I know I have alternatives for secure boot:
1. UKI without grub.
2. non UKI with grub

[Nowa]