Can I, in GRUB, configure it to verify if the EFI file it is going to chainload being signed (using the Secure Boot database) and refuse to boot if not signed?
I had to disable secure boot for GRUB to allow me to dual-boot between Android and Windows. I don't want to lose that security for my Windows system.
I know GRUB can check the signature of Linux kernels, but what about EFI bootloaders? Is it possible? How?

  • 1
    you can disable grub and just Secure Boot your kernel. that's the far more straightforward way to go. grub is just in your way and doesn't make any sense on EFI systems. – mikeserv Jan 13 '16 at 20:20
  • I don't want to disable GRUB, I want to have the choice of the OS at startup. I want to check the integrity of an .efi file, not a linux kernel. – Charles Milette Jan 14 '16 at 1:03

The question resolved itself:

If GRUB attempts to chainload a file that is not accepted by Secure Boot (if Secure Boot is activated), it will get an Access Denied error.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.