Impossible to Secure Boot

blt · n00b Joined: 21 Mar 2021 Posts: 11

I tried to follow this guide to setup my brand new Gentoo install with Secure Boot as Sakaki is EOL (and anyways designed to be used with some homemade scripts to automatize almost everything), I am more on a learning approach as I am a new Gentoo user.

Everything is working correctly from the guide apart from the last piece when I enforce the check_signatures, my UEFI refuses to boot and I am stuck to UEFI boot list.

I am wondering if this if the issue is coming from the fact that the initrd is signed by gpg instead of sbsigntools (used to sign bootloader and kernel) as I don't see how my UEFI would use the Secure Boot keys to validate the initrd signed by GPG..

But maybe the issue is even earlier as it seems it is just when my UEFI tries to load GRUB, so I am wondering if Grub is even able to try to load the initrd so my assumption above may be discarded.

Any idea on where to start to troubleshoot this issue ? as I don't really know where to look for as my issue is so early into the boot process..

Many thanks
_________________
blt

alamahant · Advocate Joined: 23 Mar 2019 Posts: 3958

For secure boot
you need
shim64.efi
Get it from
sys-boot/shim
Actually i just installed it and it provides these binaries

blt · n00b Joined: 21 Mar 2021 Posts: 11

Thanks for your suggestion, I installed shim and tried to recreate grub.cfg but same issue and was about to ask you if I would need to add shim somewhere but I just saw your edits.

Will try your suggestion tomorrow morning and I let you know, thanks again
_________________
blt

alamahant · Advocate Joined: 23 Mar 2019 Posts: 3958

I used this to get all the necessary files
[url]
https://rpmfind.net/linux/fedora/linux/development/rawhide/Everything/x86_64/os/Packages/s/shim-x64-15-8.x86_64.rpm
[/url]
I extracted it.
Copied the shimx64.efi to /boot/efi/EFI/gentoo
Added a new efibootmgr entry and booted in.
It worked.
I dont know if I do foolish things but it seems to work.

pietinger · Posted: Thu Mar 25, 2021 10:50 am Post subject:

Maybe this can help: https://forums.gentoo.org/viewtopic-t-1112966.html

GDH-gentoo · Posted: Thu Mar 25, 2021 5:27 pm Post subject:

I think that some clarification is in order.

The methods described in the document linked in the OP, in Sakaki's guide, and in pietinger's guide, involve replacing the UEFI firmware's platform key, key exchange key, and the keys in the database used for verifying signed binaries. This requires a cooperative (i.e. not crappy) firmware.

The UEFI shim is kind of a workaround, it operates in a different way. The keys used by the firmware are left alone, and a separate set of keys (the machine owner keys) are created and used to sign the binaries. This is only useful if the shim itself is signed (usually with a Microsoft-approved key). Gentoo's sys-boot/shim package appears to just download Fedora's RPM and extract some of its (already compiled) files. I believe that the signed shim in the RPM is the file named shimx64-fedora.efi, and that the file named shimx64.efi is unsigned. I expect the unsigned shim not to work when secure boot is enabled in the firmware, and if it isn't, then, well, one can just boot the bootloader or stub kernel and not bother with the shim. I see no point in installing and booting the unsigned shim if one is going to have secure boot turned off anyway.

In any case, I believe that the only binary that the UEFI firmware verifies (with the keys in the database) is just the one it hands control to: bootloader, stub kernel or shim. If the shim is used, it can then verify the bootloader or stub kernel using a machine owner key. If a bootloader is used, whether the kernel and initramfs are subsequently verified or not, and how, is bootloader-specific. The (optional) verification that GRUB can do is described in its manual (info grub).

pietinger · Posted: Thu Mar 25, 2021 6:22 pm Post subject:

The Main Man · Posted: Sun Oct 17, 2021 2:51 pm Post subject:

How is the situation with secure boot this days ?
I'm thinking about switching to uefi and secure boot, and I probably will very soon, but I'm wondering how that really works with Gentoo.
Anyone here using it for a long time ?

pietinger · Posted: Sun Oct 17, 2021 4:58 pm Post subject:

The Main Man · Posted: Mon Oct 25, 2021 11:19 am Post subject:

Sorry for late reply, it seems complicated, I mean I don't mind complicated but sometimes I ask myself why bother, usually there's no answer to that question.
Anyway, I'm sure it works, but I'll pass, thanks for the guide though.

Marlo · Veteran Joined: 26 Jul 2003 Posts: 1591

I have worked through all these instructions. Shim does not work; signing grub does not work; signing initrd does not work either.

Only Sakaki's guide works and the gentoo's "signed kernel module support" works fine. (although the scripts don't work anymore).
Together with some kernel options (CONFIG_SECURITY_LOCKDOWN_LSM) I have:
signed kernel
signed modules
and a locked kernel
The whole security chain is in place.
I use this together with rEFInd and can access two gentoo installations, one Tumbleweed and 2 windows installations in secure boot.