| View previous topic :: View next topic |
| Author |
Message |
nvaert1986
Tux's lil' helper
Joined: 05 May 2019
Posts: 124
|
 Posted: Wed Apr 05, 2023 4:51 pm Post subject: [SOLVED]Grub and UEFI Secure Boot |
 |
|
Hello everyone,
I'm trying to get grub fully working with SecureBoot using sbctl, but I'm running into issues and was wondering anybody else has experience with this and knows how to resolve the issue.
After running sbctl sign filename on my grub and kernel I noticed that I only got a grub rescue prompt. After reading online, I found out that it doesn't work with a modular grub, and that I needed to make a standalone EFI file and sign it using grub-mkstandalone. After running: | Code: | | grub-mkstandalone --fonts=all -O x86_64-efi -o grubx64.efi "/boot/grub/grub.cfg" -v |
, signed it and rebooted my laptop. I finally got a grub with a menu, but the kernel still wasn't loading. I received the error message: | Code: | | error: verification requested but nobody cares: |
After some more reading I found out that I needed to disable shim_lock, so I ran: | Code: | | grub-mkstandalone --disable-shim-lock --fonts=all -O x86_64-efi -o grubx64.efi "/boot/grub/grub.cfg" -v |
, signed it and and rebooted again, but now I received the error message: | Code: | | error: verification requested but nobody cares: |
.
After googling some more I found somebody found a solution, by running | Code: | | sed -i 's/SecureBoot/SecureB00t/' /boot/EFI/gentoo/grubx64.efi |
. After rebooting my system finally boots with Secure Boot enabled, but my kernel still displays the message: Secure Boot Disabled and certain SecureBoot EFI related variables are not visibile, but the system does boot with EFI Secure Boot enabled
Note: I found the idea of sedn: hxxps://wejn.org/2021/09/fixing-grub-verification-requested-nobody-cares/
Does anybody know how to resolve this mess with grub and Secure Boot properly?
Last edited by nvaert1986 on Thu Apr 06, 2023 7:35 am; edited 1 time in total |
|
| Back to top |
|
 |
nvaert1986
Tux's lil' helper
Joined: 05 May 2019
Posts: 124
|
| Posted: Thu Apr 06, 2023 7:35 am Post subject: |
|
|
| I've been able to resolve my issue by using Fedora's signed shim64.efi and adding the --sbat sbat.csv parameter when generating my grub EFI image. This resolved the issue and now my system boots in UEFI Secure Boot mode. The shimx64.efi is signed by Microsoft and since I added the Microsoft certificate to my signed certificate database (using sbctl), my system is functioning correctly now. |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Kernel & Hardware
