Misc SecureBoot changes#552
Conversation
The `search.file "${prefix}/grub.cfg"` won't be useful, as $prefix
usually contains something like (cd0) and then search.file fails.
Explicitly ask for /boot/grub/grub.cfg, which we hardcode in
config/media-scripts/GRMLBASE/10-efi anyways.
Additionally ask for listing of $prefix/grub.cfg, to have an idea
whether the file exists at all.
We can't set $prefix to ($root)/${prefix}/, as $prefix is usually
already populated with "something" and we therefore end end up with an
unexpected and failing $prefix.
Instead, use /boot/grub as set in config/scripts/GRMLBASE/45-grub-images
and config/media-scripts/GRMLBASE/10-efi.
Fixup for 5c048ce
For yet unknown reasons, the secureboot/grub.cfg configuration file is no longer sourced on booting. The file can be sourced just fine though, but due to our copy-media-files + mv actions, the file is no longer available on the live system. Instead, let's make it a copy and try to read the file from the main GRUB configuration also (if $grml_secureboot is still unset, it means we didn't read the file yet).
| ## grub2 configuration | ||
|
|
||
| # secure boot, read only if not already sourced elsewhere | ||
| if [ "${grml_secureboot}" = "" ] ; then |
There was a problem hiding this comment.
not sure what we really need from secureboot/grub.cfg. if we only need grml_secureboot being set correctly, maybe its smarter to move the wrmsr test into grub.cfg and not source secureboot/grub.cfg?
There was a problem hiding this comment.
The secureboot/grub.cfg was meant as main entrance point as /boot/grub/grub.cfg in the efi.img (see config/media-scripts/GRMLBASE/10-efi), but yeah, maybe we can re-design this?
There was a problem hiding this comment.
Yeah I remember it was like that, but if it doesn't get loaded, lets put the relevant parts into the normal grub.cfg and keep the (debug) messages in secureboot/grub.cfg?
Sourcing secureboot/grub.cfg from the main config just seems to make things harder to understand?
There was a problem hiding this comment.
Absolutely, this only needs further work then. :) FTR, the changes I provide here and in grml-terminalserer as grml/grml-terminalserver#27 are what I was working on for Grml-Forensic, extensively tested and also released as such ("internally"). It's working as-is, the only thing that's not working yet is displaying "SecureBoot" on the splash screen when booting via PXE/netboot, but that's mainly a cosmetic issue only (and I need to see whether there actually is a good solution to get this working at all, given the limitations of test -f ... not working via tftp ;(
(Sorry for the ping-pong in "resolve converstation", GitHub doing strange things on a flaky network connection on a train ride)
2 participants
Disclaimer: I still don't know why the SecureBoot theme usage broke,
secureboot/grub.cfgin the efi.img just isn't read any longer. :-/