3

I'm trying to create a new image of GRUB which has an embedded public key file to validate all files loaded by GRUB. So I used the command grub-mkimage to manually create a new GRUB core image.

grub-mkimage --config='./grub.cfg' --compression='auto' --pubkey='./grub.key' --output='./core_custom.efi' --format='x86_64-efi' --prefix='(hd0,gpt2)/grub' --verbose ext2 fshelp part_gpt pbkdf2 crypto password_pbkdf2 pbkdf2_test

The grub.cfg contains a superuser with a pbkdf2 password (that's why I included the pbkdf2 modules) to prevent manipulating the config so that the password protection becomes not loaded. Also I set the variable pager to 1.

But after rebooting my computer and booting from the newly created GRUB image the GRUB environment variable check_signatures is not set to enforce (like mentioned in the official GRUB2 manual), the key I passed to the grub-mkimage command is not listed when I enter the list_trusted command in the GRUB shell and finally the verify_detached command does not find the public key.
But the verbose log of the grub-mkimage command clearly states that the key was read and when I load the key manually in the GRUB shell everything works fine.

Information about my installation:
-ArchLinux
-GRUB 2.04
-EFI platform -> GRUB x86_64-efi

1
  • Were you able to solve this? I'm facing the exact same problem.
    – Maxxim
    Jul 26 '20 at 9:46
1

I faced the exact same problem and was able to figure it out after hours of trial and error. This is poorly handled on GRUB's side to say the least, it just silently fails. Documentation doesn't seem to help either, I was unable to find anything useful about this specific error.

The solution is quite simple - there a some modules that have to be pre-loaded. For me, using GRUB 2.04 on amd64, those were:

  • verifiers
  • gcry_sha256
  • gcry_sha512
  • gcry_dsa
  • gcry_rsa

The resulting command for me was:

grub-mkstandalone --verbose --format=x86_64-efi --output=grubsax64.efi --pubkey=grub.pub --modules="verifiers gcry_sha256 gcry_sha512 gcry_dsa gcry_rsa" boot/grub/grub.cfg=grub.cfg

The important part here is --modules="...".

I also tried loading the exact same modules using insmod in grub.cfg, but this will not work, it has to be done like outlined above.

Judging by the output produced by grub-mkstandalone, this should also work for grub-mkimage (grub-mkstandalone at some point calls grub-mkimage), although I haven't tested it myself:

grub-mkimage ... verifiers gcry_sha256 gcry_sha512 gcry_dsa gcry_rsa

Build the GRUB image/binary, reboot, enter command line and you'll notice list_trusted now produces output. Further tests showed signature checking is now working as expected for me.


EDIT 04/23/21 regarding GRUB 2.06:

In GRUB 2.06, verifiers was moved from module to core (see this commit), i.e. it is no longer a separate module. Thus, the commands described above need to be changed as well:

grub-mkstandalone --verbose --format=x86_64-efi --output=grubsax64.efi --pubkey=grub.pub --modules="gcry_sha256 gcry_sha512 gcry_dsa gcry_rsa" boot/grub/grub.cfg=grub.cfg
grub-mkimage ... gcry_sha256 gcry_sha512 gcry_dsa gcry_rsa

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.