GRUB cannot boot with secure boot

[FlyingBullets]

#######
PROBLEM
#######

I'm trying to use secure boot with my setup, but I keep getting errors in GRUB.

#####
SETUP
#####

My setup is the following:
Drive Partition_name Mountpoint
/dev/sda
|-/dev/sda1 EFI System /efi
|-/dev/sda2 Linux extended boot /boot
`-/dev/sda3 Linx filesystem

sda1 is the ESP where the '.efi' file is /efi/EFI/BOOT/BOOTX64.EFI

sda2 is the XBOOT that contains:
|-grub/
|-amd-uc.img
|-intel-uc.img
|-System.map-x.y.z-gentoo
|-config-x.y.z-gentoo
|-initramfs-x.y.z-gentoo.img
`-vmlinuz-x.y.z-gentoo

sda3 is the encrypted root.

sys-kernel/installkernel is compiled with:
USE="dracut grub"

sys-boot/grub is compiled with:
USE="device-mapper fonts nls secureboot themes"
GRUB_PLATFORMS="efi-64"

GRUB is installed with the following command:

[rab0171610]

My solution is to disable it entirely. I assume you have decided that you are at high risk of unauthorized code execution, a bootkit, or some sort of malware that specifically affects your Linux installation. My question, seeing your exhaustive efforts to enable and troubleshoot secure boot, is are you sure you really need it?
Do you have reason to believe that your system integrity is at risk and need to verify it every time you boot?
If you do not need it after all, then simply disable it. If you feel you %100 require it or benefit from it for your use case, then proceed.
Obviously, if you must dual-boot with Windows for some reason, it may be difficult to avoid. Otherwise it is optional.

[FlyingBullets]

[Child_of_Sun_24]

I use secureboot with sys-boot/shim and it works with dual-boot windows.

https://wiki.gentoo.org/wiki/Shim

Here is everything discribed what you need for it.

[pietinger]

FlyingBullets,

SecureBoot means: Your UEFI verify the signature of the FIRST application it starts. This can be a bootloader/-manager OR a Linux kernel (or Windows). If it is grub - and UEFI has started your grub, ANYTHING else is THEN the job of grub. This means: If you dont want that somebody exchange your kernel then you must configure GRUB so that it verify ALSO your kernel. There was a description for this in our forum (at first glance it was very complicated) and I had forgotten it ... because the simplest way (for me) WHEN using SecureBoot is: Start your signed kernel directly via UEFI ...

In this article is also a link to my (manually) SecureBoot solution:
https://wiki.gentoo.org/wiki/User:Pietinger/Tutorials/Boot_kernel_via_UEFI

Another story is ... a UKI ... If you need SecureBoot you should not use a kernel WITH an external initramfs. If you need an initramfs (because your root partition is encrypted) then USE an embedded initramfs. You have two choices to do this:

1. Automatically with installkernel, or
2. Manually: https://wiki.gentoo.org/wiki/User:Pietinger/Tutorials/Initramfs_Overview#Special_Case:_Building_an_embedded_initramfs_with_a_CPIO_archive

[rab0171610]

[FlyingBullets]

[FlyingBullets]

As a sanity check, I made a UKI by following the instructions on the "Unified kernel image" wiki page; I was able to boot with secure boot, but I had to boot directly into the kernel.

I'm still working on getting GRUB to work.

[zen_desu]

If you want to embed a CPIO archive into the kernel, you must remove compression on that file if there is any.

If you want to embed a dracut initramfs into the kernel, I think you have to use special tools to extract it because Dracut makes a "layered" CPIO for early microcode.

Once extracted, you can point CONFIG_INITRAMFS_SOURCE to the directory containing the extracted initramfs.

You do not need to embed the initramfs for secure boot. This just ensures the initramfs is signed because the whole kernel (containing the initramfs) is signed.

A more straightforward method is to use a UKI.

[pietinger]

[zen_desu]

[FlyingBullets]

[zen_desu]

If your system has a boot menu, you can use that. I do that on most of my systems, I can press f12 or whatever to see boot options and change which kernel version I'm booting into.
You can also install an EDK2 shell to your ESP if your UEFI doesn't have similar. Using that, you can boot any kernel/initramfs/cmdline you want.

Technically a UKI means you only need a single unencrypted file, but it has components equivalent to multiple files, more or less. You can almost treat it like a self extracting archive. When it runs, it extracts parts such as the kernel/initramfs from itself.

It being a single file mostly helps with signing as only a single file must be signed.

I think you can simply change the extension of the dracut ".img" to ".cpio.zstd" for example, if it uses zstd compression.

CONFIG_INITRAMFS_SOURCE should target either the initramfs file (properly suffixed) or a directory containing the initramfs tree which will be packed as part of the kernel build process.
_________________
µgRD dev
Wiki writer

[sMueggli]

I think you did not sign all the necessary parts of Grub. For example the "insmod" commands in grub.cfg will fail. The needed modules have to be part of the standalone Grub image.


Links:

• https://www.gnu.org/software/grub/manual/grub/html_node/UEFI-secure-boot-and-shim.html
  
• https://wiki.archlinux.org/title/GRUB#Secure_Boot_support
  

And why are you using "--removable"? As long as you have no other systems, you will not see any difference. But the "\EFI\BOOT\BOOTx64.efi" might be overwritten with other EFI binaries.

[Nowa]

[GDH-gentoo]

[FlyingBullets]