Mirroring EFI System Partition (ESP) on Ubuntu

Question

When setting up a RAID-1 Ubuntu system (i.e. where / and /boot are on RAID-1 mirrors) it's unclear to me what Ubuntu's answer is to making the EFI System Partition (ESP, i.e. /boot/efi) redundant, as well.

The Fedora solution, i.e. just putting it on a superblock 1.0 RAID-1, apparently isn't supported at all and thus makes grub-install fail.

There seems to be some support for letting the Ubuntu installer create 2 ESPs and install the files to both of them. But according to this recent bug report it's still unclear how this scheme is supported by regular package updates:

https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1876974 (see also)

So how do I have to set up the ESP's on the both disks (when aiming for RAID-1 setup with - say - Ubuntu 20.04 LTS) to make them redundant and keep them in-sync for later Ubuntu updates?

The objective here is to still be able to boot that Ubuntu system, i.e. even when one disk dies.

How does my /etc/fstab (or other relevant) configuration files have to look for such a setup?

For example, when the first ESP is mounted under /boot/efi where has the second one to be mounted in order to be recognized by Ubuntu package post-install scripts?

And what are the necessary grub-install/dpkg-reconfigure/reinstall commands to fix the ESP setup after an installer failed to set up the ESPs correctly?

Answer 1

Ubuntu's solution to a redundant ESP is to just to create and mount two of them, and reconfigure grub, instead of creating one on a superblock 1.0 RAID-1.

The name of the second mount point doesn't matter. Since a single ESP is usually mounted under /boot/efi, mounting the second ESP under something like /boot/eficopy would be natural.

Both ESPs have to be mounted automatically via /etc/fstab in case a grub package update happens.

It's important that both ESPs have the right GPT type (i.e. C12A7328-F81F-11D2-BA4B-00A0C93EC93B). Sizing them 200 MiB each is sufficient.

The initial setup then requires reconfiguring grub:

dpkg-reconfigure grub-efi-amd64

The grub reconfigure script then checks for all partitions with the ESP GPT type and allows the user to select both. After that change future package updates/re-installs will update both ESPs.

Note that (as of 2020), the reconfigure only works for grub-efi-amd64 and not for grub-efi-amd64-signed (where reconfigure doesn't prompt for anything).

Thus, one might need to install the right grub first, e.g.:

apt-get install grub-efi-amd64
apt-get remove grub-efi-amd64-signed

Answer 2

It does seem to work with grub-efi-amd64-signed but confusingly, to get the prompt to identify efi partitions you have to call dpkg-reconfigure shim-signed.

Answer 3

One can install a grub hook to copy the EFI partition whenever it changes. This is the method recommended by the Debian Wiki:

• Create an fstab entry for the backup partition. It can mount anywhere, but /boot/efi2 is a reasonable choice. The fstab entry can be be given the noauto option.

• Create a grub hook /etc/grub.d/90_copy_to_boot_efi2 (chmod 0755) containing:

  #!/bin/sh
  # https://wiki.debian.org/UEFI#RAID_for_the_EFI_System_Partition
  set -e
  
  if mountpoint --quiet --nofollow /boot/efi; then
      mount /boot/efi2 || :
      rsync --times --recursive --delete /boot/efi/ /boot/efi2/
      # Being FAT it is even better when not mounted, won't be damaged in case of computer crash or power outage.
      # Ref: https://forums.debian.net/viewtopic.php?p=759692&sid=ff62e9207a064b027f041d2cd0a612a4#p759692
      umount /boot/efi2
  fi
  exit 0
  

• For an immediate update, run sudo update-grub. The backup partition will be populated from the main efi partition then unmounted - remember this part when you look to see if it worked :)

• Any future Debian or Ubuntu update that modifies the EFI partition will also update grub and the grub hook will therefore automatically update your backup EFI partition as well.