1

Target: Debian with secure boot on USB

Some Links I base my progress on

Steps so far:

# download debian8.4-netinstall (official link)
wget http://cdimage.debian.org/debian-cd/8.4.0/amd64/iso-cd/debian-8.3.0-amd64-netinst.iso
mkdir debNet   # extract iso
bsdtar -C debNet -xf debian-8.4.0-amd64-netinst.iso


ls debNet
>autorun.inf  doc        install      pool                 README.txt
>boot         efi        install.amd  README.html          setup.exe
>css          firmware   isolinux     README.mirrors.html  tools
>debian       g2ldr      md5sum.txt   README.mirrors.txt   win32-loader.ini
>dists        g2ldr.mbr  pics         README.source

As described by rodsbooks,I should now

  • rename EFI/BOOT/bootx64.efi to EFI/BOOT/grubx64.efi
  • move shim.efi to EFI/BOOT/bootx64.efi
  • move MokManager.efi to EFI/BOOT/
  • make some nice magic with keys and signing, tadaa, you're done.

To make an bootable USB, I take the following steps

sources="debNet"
outISO="debian8.4.0.modified.iso"
relative_isolinuxbin="isolinux/isolinux.bin"
xorriso -as mkisofs \
    -isohybrid-mbr /usr/lib/syslinux/isohdpfx.bin   \
    -c boot.cat \
    -b $relative_isolinuxbin \
    -no-emul-boot -boot-load-size 4 -boot-info-table -eltorito-alt-boot \
    -e boot/grub/efi.img -no-emul-boot -isohybrid-gpt-basdat \
    -o $outISO $sources
sudo dd if=debian8.4.0.modified.iso of=/dev/sdb

If I had any idea what I was doing before (just getting uefi to run), I would have seen that I use efi.img. So it took some time experimenting with debNet/efi/boot to find that adding or changing of even deleting this directory does not change booting at all. (maybe deleting the directory corrupts the installation - didnt try - but not the booting)

So, I finally understood I have to change debNet/boot/grub/efi.img. So here's my main question so far - how do I create this efi.img for my needs?

dd if=/dev/zero of=efi.img bs=1k count=3000
mkfs.vfat efi.img
sudo mount efi.img img_mountpoint/

and copying the bootloaders as described in rodsbooks does not seem to work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.