1

I have laptop DELL latitude 5491 with preinstalled Windows 10 with secure boot enabled and EFI mode. After I purchased, I installed Ubuntu 20.04 next to Windows as a dualboot with still secure boot enabled/EFI. Partitions 2,3 and 5 are for Windows system, Partition 1 and 4 are for Ubuntu. On Partition 6 is stored ISO of Clonezilla live CD for backuping. So far everything is working well. In the next step I stored unpacked ISO of Parted Magic live CD on Partition 7, edited the grub menu, but booting the Parted Magic from grub menu ends in error with invalid signature for BzImage... However, when I boot the Parted Magic directly from EFI (temporary boot menu or EFI setup), system normally started. Where there may be a problem? Its look like

Partitions layout:

Device         Start        End   Sectors   Size Type
/dev/sda1       2048    1394687   1392640   680M EFI System
/dev/sda2    1394688    1656831    262144   128M Microsoft reserved
/dev/sda3    1656832  507570175 505913344 241,2G Microsoft basic data
/dev/sda4  507570176  983883775 476313600 227,1G Linux filesystem
/dev/sda5  983883776  985911295   2027520   990M Windows recovery environment
/dev/sda6  985911296  987500543   1589248   776M Linux filesystem
/dev/sda7  987500544 1000214527  12713984   6,1G Microsoft basic data

Edited 40_custom file:

#!/bin/sh
exec tail -n +3 $0
# This file provides an easy way to add custom menu entries.  Simply type the
# menu entries you want to add after this comment.  Be careful not to change
# the 'exec tail' line above.

menuentry "clonezilla" {
    set isofile="/clonezilla-live-20210127-groovy-amd64.iso"
    loopback loop (hd0,gpt6)$isofile
    linuxefi (loop)/live/vmlinuz boot=live components config findiso=$isofile ip=frommedia toram=filesystem.squashfs union=overlay username=user
    initrdefi (loop)/live/initrd.img
}
menuentry "partedmagic" {
 insmod chain
 set root=(hd0,gpt7)
 configfile /boot/grub/grub.cfg
}

grub.cfg file:

set default="0"
set timeout="20"
set hidden_timeout_quiet=false
set gfxmode=auto
insmod efi_gop
insmod efi_uga
insmod gfxterm
terminal_output gfxterm
set color_normal=white/black
set color_highlight=black/white
loadfont /boot/grub/unicode.pf2
background_image /boot/grub/pmagic.png

set default_settings="edd=on vga=normal mem=32G"
set live_settings="boot=live eject=no"
set linux="/pmagic/bzImage"
set initrd_img="/pmagic/initrd.img /pmagic/fu.img /pmagic/m.img"
set default=2
set message="Loading kernel and initramfs. Please wait..."

menuentry "Parted Magic UEFI Boot Menu"{
    set
}
menuentry ' '{
    set
}
menuentry "1. Default settings (Runs from RAM 4GB+)"{
    echo $message
    search --set -f $linux
    linux $linux $default_settings
    initrd $initrd_img
}
menuentry "1a. Default settings with 4K Monitor"{
    echo $message
    search --set -f $linux
    linux $linux $default_settings m4k=yes
    initrd $initrd_img
}
menuentry "1b. Default settings + language menu"{
    echo $message
    search --set -f $linux
    linux $linux $default_settings lang=yes
    initrd $initrd_img
}
menuentry ' '{
     true
}
menuentry "2. Live with default settings (2GB+ RAM)"{
    echo $message
    search --set -f $linux
    linux $linux $default_settings $live_settings
    initrd $initrd_img
}
menuentry "2a. Live with default settings + language menu"{
    echo $message
    search --set -f $linux
    linux $linux $default_settings $live_settings lang=yes
    initrd $initrd_img
}
menuentry ' '{
     true
}
menuentry "3. Black/Blank Screen workaround"{
    echo $message
    search --set -f $linux
    linux $linux $default_settings nomodeset
    initrd $initrd_img
}
menuentry "4. No official NVIDIA driver - Use Nouveau NVIDIA driver instead."{
        echo $message
        search --set -f $linux
        linux $linux $default_settings modprobe="nouveau"
        initrd $initrd_img
}
menuentry "5. *** Hyper-V ***"{
    echo $message
    search --set -f $linux
    linux $linux $default_settings fbdev=yes
    initrd $initrd_img
}
menuentry "6. Memtest86+" {
    chainloader /boot/memtest/BOOTX64.EFI
}
menuentry "7. EFI Shell" {
    insmod fat
    insmod chain
    terminal_output console
    chainloader /boot/edk2/Shell.efi
}
menuentry ' '{
     true
}
submenu "Extras Menu"{
    set default_settings="edd=on vga=normal mem=32G"
    set live_settings="boot=live eject=no"
    set linux="/pmagic/bzImage"
    set initrd_img="/pmagic/initrd.img /pmagic/fu.img /pmagic/m.img"
    set message="Loading kernel and initramfs. Please wait..."
    menuentry "1. Super Grub2 Disk EFI" {
        chainloader /boot/supergrub2disk/super_grub2_disk_standalone_x86_64_efi_2.04s1.EFI
    }   
    menuentry "2. Clonezilla"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings clonezilla=yes
        initrd $initrd_img
    }
    menuentry "3. Nwipe"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings nwipe=yes
        initrd $initrd_img
    }
    menuentry "4. Load iSCSI Kernel Modules"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings iscsi=yes
        initrd $initrd_img
    }
    menuentry "5. Load config for xf86-video-qxl module"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings qxl=yes
        initrd $initrd_img
    }
}
}
submenu "Failsafe Menu"{
    set default_settings="edd=on vga=normal mem=32G"
    set live_settings="boot=live eject=no"
    set linux="/pmagic/bzImage"
    set initrd_img="/pmagic/initrd.img /pmagic/fu.img /pmagic/m.img"
    set message="Loading kernel and initramfs. Please wait..."
    menuentry "1. No ACPI (Advanced Configuration and Power Interface)"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings acpi=off
        initrd $initrd_img
    }
    menuentry "2. Do not eject CD"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings eject=no
        initrd $initrd_img
    }
    menuentry "3. Emulator compatibility"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings $live_settings noreplace-paravirt
        initrd $initrd_img
    }
    menuentry "4. Console (boots to the shell)"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings consoleboot=yes
        initrd $initrd_img
    }
    menuentry "5. Initrd.img (boot to initrd.img shell)"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings initrd_shell=yes
        initrd $initrd_img
    }
    menuentry "6. Radeon no modeset"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings blacklist=radeon
        initrd $initrd_img
    }
    menuentry "7. No / force CPU Frequency Scaling"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings cpufreq=no
        initrd $initrd_img
    }
    menuentry "8. Force vesa workaround"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings xconfig=forcevesa
        initrd $initrd_img
    }
    menuentry "9. Force refresh rate"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings xconfig=forcerefresh nomodeset
        initrd $initrd_img
    }
    menuentry "10. Disable accelerated 3D graphics (DRI)"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings nodri=yes
        initrd $initrd_img
    }
    menuentry "11. Missing Mouse Pointer"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings xmouse=yes
        initrd $initrd_img
    }
    menuentry "12. Macbook Pro 8,x Dual Graphics Workaround"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings
        outb 0x728 1 # Switch select
        outb 0x710 2 # Switch display
        outb 0x740 2 # Switch DDC
        outb 0x750 0 # Power down discrete graphics
        initrd $initrd_img
    }
    menuentry "13. Libata noncq - Drive will not unlock"{
        echo $message
        search --set -f $linux
        linux $linux $default_settings libata.force=1.0:noncq
        initrd $initrd_img
    }
    menuentry "14. No IPV6 - Stop Network Manager from disconnecting."{
        echo $message
        search --set -f $linux
        linux $linux $default_settings blacklist=ipv6
        initrd $initrd_img
    }
}
menuentry ' '{
     true
}
submenu "List of Cheat Codes"{
menuentry "directory=        Directory containing the pmagic folder"{set}
menuentry "iso_filename=     [path to/]iso filename"{set}
menuentry "root=             SQFS boot device by partition id"{set}
menuentry "label=            SQFS boot device by label"{set}
menuentry "uuid=             SQFS boot device by [partial] uuid"{set}
menuentry "blacklist=        Do not load kernel modules, e.g. blacklist=kmod1:kmod2:kmod3"{set}
menuentry "ahci=no           Do not load the ahci kernel module"{set}
menuentry "modprobe=         Load kernel modules, e.g. modprobe=kmod4:kmod5:kmod6"{set}
menuentry "consoleboot=yes   Do not start X-windows"{set}
menuentry "eject=no          Do not eject CD"{set}
menuentry "gpm=no            Disable the console mouse server"{set}
menuentry "pmodules=no       Do not install pmagic/pmodules"{set}
menuentry "slapt=no          Do not install /home/partedmagic/slapt-get/ packages"{set}
menuentry "scripts=no        Do not execute pmagic/pmodules/scripts"{set}
menuentry "sound=no          Do not let ALSA set volume levels (mute)"{set}
menuentry "numlock=on        Set numlock to on at boot"{set}
menuentry "conky=no          Do not auto-start conky"{set}
menuentry "zfs=no            Do not start zfs services"{set}
menuentry "hostname=         Set hostname to XXXXXX[.YYYYYY.ZZZ]"{set}
menuentry "timeconfig=<timezone>|no  Set timezone | do not start timeconfig at boot"{set}
menuentry "clockfmt=<format> clockfmt=%R (24-hours), clockfmt=%l:%M%P (am/pm)"{set}
menuentry "mdadm=no          Do not assemble raid filesystems"{set}
menuentry "lvm=no            Do not start the device mapper"{set}
menuentry "sshd=no           Do not start SSH daemon"{set}
menuentry "bluetooth=no      Do not start the bluetooth daemon"{set}
menuentry "consolekit=no     Do not start the consolekit daemon"{set}
menuentry "dmeventd=no       Do not start the device mapper event daemon"{set}
menuentry "dbus=no           Do not start the Dbus daemon"{set}
menuentry "smart=no          Do not start the smartmontools daemon"{set}
menuentry "fstabdaemon=no    Do not start the Parted Magic /etc/fstab daemon"{set}
menuentry "nfs=no            Do not start the NFS daemon"{set}
menuentry "acpid=no          Do not start the acpi daemon"{set}
menuentry "cups=no           Do not start the CUPS server"{set}
menuentry "netw=no           Do not start the network at boot"{set}
menuentry "samba=yes         Start the samba daemons"{set}
menuentry "rdate=yes         Sync time with rdate at boot"{set}
menuentry "monday=1          Monday as first day of the week"{set}
menuentry "ntpd=yes          Start the ntpd daemon"{set}
menuentry "cpufreq=no/yes/<gov>  No (laptop), force (desktop) CPU freq scaling governor"{set}
menuentry "powermanager=no/yes   No (laptop), force (desktop) power manager"{set}
menuentry "iscsi=yes         Start iscsi initiator"{set}
menuentry "xconfig=XXXXXX|no Use /etc/X11/xorg.conf.XXXXXX | Undo"{set}
menuentry "nodri=yes         No DRI"{set}
menuentry "qxl=yes           X to start with QXL device"{set}
menuentry "xmouse=yes        Try this if your X does not show a mouse cursor"{set}
menuentry "clonezilla=yes    Boot into clonezilla"{set}
menuentry "nwipe=yes         Boot into nwipe"{set}
menuentry "cmd=              Boot into <command>, e.g. cmd="nwipe --method dod""{set}
menuentry "device_list=yes   Show devices/partitions being scanned for the SQFS"{set}
menuentry "removableonly=yes Only scan devices/partitions with "removable" attribute"{set}
menuentry "testing=yes       Wait at boot completion, use <Shift+Page Up|Down> to scroll"{set}
menuentry "                  Press <Enter> to continue"{set}
menuentry ""{set}
menuentry "Keyboard maps:"{set}
menuentry "azerty be-latin1 fr-latin1 fr-latin9 fr-pc fr wangbe wangbe2 ANSI-dvorak"{set}
menuentry "dvorak-l dvorak-r dvorak tr_f-latin5 trf bg-cp1251 bg-cp855 bg_bds-cp1251"{set}
menuentry "bg_bds-utf8 bg_pho-cp1251 bg_pho-utf8 br-abnt br-abnt2 br-latin1-abnt2"{set}
menuentry "br-latin1-us by cf cz-cp1250 cz-lat2-prog cz-lat2 cz defkeymap"{set}
menuentry "defkeymap_V1.0 dk-latin1 dk emacs emacs2 es-cp850 es et-nodeadkeys et"{set}
menuentry "fi-latin1 fi-latin9 fi gr-pc gr hu101 hypermap.m4 il-heb il-phonetic il"{set}
menuentry "is-latin1-us is-latin1 it-ibm it it2 jp106 la-latin1 lt.baltic lt.l4 lt"{set}
menuentry "mk-cp1251 mk-utf mk mk0 nl nl2 no-latin1.doc no-latin1 no pc110 pl pl2"{set}
menuentry "pt-latin1 pt-latin9 ro_win ru-cp1251 ru-ms ru-yawerty ru ru1 ru2 ru3 ru4"{set}
menuentry "ru_win se-fi-ir209 se-fi-lat6 se-ir209 se-lat6 sk-prog-qwerty sk-qwerty"{set}
menuentry "speakup-jfw speakup-jfw.readme speakupmap sr-cy sv-latin1 tr_q-latin5 tralt"{set}
menuentry "trq ua-utf-ws ua-utf ua-ws ua uk us-acentos us croat cz-us-qwertz"{set}
menuentry "de-latin1-nodeadkeys de-latin1 de de_CH-latin1 fr_CH-latin1 fr_CH hu"{set}
menuentry "sg-latin1-lk450 sg-latin1 sg sk-prog-qwertz sk-qwertz slovene"{set}
menuentry "Example:"{set}
menuentry "At the boot menu press <TAB> and then change 'keymap=us' to 'keymap=fr-latin1'"{set}
menuentry ""{set}
menuentry "VGA modes:"{set}
menuentry "Normal VGA console: vga=normal"{set}
menuentry "VESA framebuffer console @ 1024x768x64k: vga=791"{set}
menuentry "VESA framebuffer console @ 1024x768x32k: vga=790"{set}
menuentry "VESA framebuffer console @ 1024x768x256: vga=773"{set}
menuentry "VESA framebuffer console @ 800x600x64k:  vga=788"{set}
menuentry "VESA framebuffer console @ 800x600x32k:  vga=787"{set}
menuentry "VESA framebuffer console @ 800x600x256:  vga=771"{set}
menuentry "VESA framebuffer console @ 640x480x64k:  vga=785"{set}
menuentry "VESA framebuffer console @ 640x480x32k:  vga=784"{set}
menuentry "VESA framebuffer console @ 640x480x256:  vga=769"{set}
}

However path for "bootloader" of Partition 7 in EFI setup is:

\EFI\boot\bootx64.efi

When I used this path for editing 40_custom file instead of use grub.cfg file, it ends with error.

Thank you for your answers. P.

EDIT:

Option 1: I used follow edit of custom_40 file

menuentry "partedmagic" {
 insmod chain
 set root=(hd0,gpt7)
 configfile /boot/EFI/bootx64.efi
}

When I tried to edit this file follow as:

menuentry "partedmagic" {
insmod chain
set root=(hd0,gpt7)
chainloader /boot/EFI/bootx64.efi
}

I received a error message:

Bootloader has not verified loaded image... System is compromised. halting.

Option 2: Process of resign Parted Magic's bzImage was completed success, but when i try boot this, its still with error.

...has invalid signature, you need to load kernel first.

1 Answer 1

0

Clonezilla's kernel comes from Ubuntu, so it is signed with Canonical's (the company that maintains the Ubuntu distribution) Secure Boot private key.

If your boot process includes a shimx64.efi from Ubuntu, it will (non-persistently) add Canonical's certificate to firmware's Secure Boot whitelist, and so you'll be able to boot both Ubuntu and Clonezilla.

Some hardware vendors may also have included Canonical's Secure Boot certificate in the firmware whitelist, so systems from those vendors would be able to omit the shim when booting Ubuntu or Clonezilla.

Apparently Parted Magic live CD includes its own version of shimx64.efi which carries another Secure Boot certificate. When that version of the shim is included in the boot process, you will be able to boot Parted Magic with Secure Boot enabled.

As far as I can see, your options are:

Option 1

Instead of using GRUB's configfile directive to load Parted Magic's configuration with Ubuntu's GRUB, you might try chainloading the shim on the Parted Magic media.

menuentry "partedmagic" {
    insmod chain
    set root=(hd0,gpt7)
    chainloader /EFI/boot/bootx64.efi
}

It sounds like you may already have tried something similar, but did you try exactly like this?

Option 2

If you have Ubuntu's shim set up with a Machine Owner's Key (MOK) for enabling third-party kernel modules or custom kernels, you could re-sign Parted Magic's kernel with the MOK private key to allow Ubuntu's GRUB to boot it.

Assuming the MOK is in the default location, this would be done with:

openssl x509 -in /var/lib/shim-signed/mok/MOK.der -inform DER -out /var/lib/shim-signed/mok/MOK.pem
mv <mountpoint of sda7>/pmagic/bzImage <mountpoint of sda7>/pmagic/bzImage.orig

then either

sbsign --key /var/lib/shim-signed/mok/MOK.priv --cert /var/lib/shim-signed/mok/MOK.pem \
    --output <mountpoint of sda7>/pmagic/bzImage \
    <mountpoint of sda7>/pmagic/bzImage.orig

or

osslsigncode -certs /var/lib/shim-signed/mok/MOK.pem -key /var/lib/shim-signed/mok/MOK.priv \-in 
    -h sha256 <mountpoint of sda7>/pmagic/bzImage.orig \
    -out <mountpoint of sda7>/pmagic/bzImage

depending on which PE/COFF binary signing tool you have available to you.

Option 3

If your system firmware allows you to manipulate Secure Boot key whitelist (db), you could add both Canonical's and Parted Magic's Secure Boot certificates to the firmware whitelist directly.

To extract a Secure Boot certificate from an existing signed *.efi binary:

osslsigncode extract-signature -pem somefile.efi certificate.pkcs7
openssl pkcs7 -inform pem -print_certs -text -in certificate.pkcs7 >certificate.pem

To add certificates to the firmware whitelist, you could use either keytool.efi or BIOS settings menus, if they include the necessary functionality. If I recall correctly, keytool.efi will accept PEM-formatted certificates, but the firmware is more likely to require converting the certificate to either DER format, or into an EFI Signature List file in either signed or unsigned form (typically *.esl and *.auth respectively).

Option 0

... or if your system firmware allows you to disable Secure Boot, you could of course do that.

Clearing the Secure Boot Primary Key (PK) switches Secure Boot to Setup Mode, which will allow booting any OS, so it would be basically equivalent to disabling Secure Boot.

1
  • Hello telcoM, Thanks for your reply. I edited my original question. Its still mystery, when i boot parted magic directly from temporary boot of EFI, it booted corectly. But when i want boot from grub (same path /EFI/boot/bootx64.efi ) i have invalid signature...
    – Pablo
    Jun 27, 2022 at 10:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .