I am currently dual booting Gentoo and Windows (on two different disks). I boot on the linux drive with grub2, where I can choose either Gentoo or Windows (added by os-prober).
Recently, I updated windows 10 to windows 11. After that some apps started complaining that secure boot was not enabled. The fact is, in my motherboard's (asus z370f) bios menu the secure boot option was enabled. I then discovered that I could set the secure boot policy to either Other OS (as it already was) or Windows UEFI (which actually checked the microsoft provided signatures, I guess). After enabling the latter, my dual booting setup was for naught, and after a red error message I was redirected to windows 11.
In order to restore my dual booting and keep secure boot on, I followed Sasaki's guide on secure boot. To be more specific:
- I saved the efi keys (PK, PEK, db, dbx)
- Created new efi keys with openssl
- Created compound keys and signed them
- Cleared the motherboard keys and uploaded the compound ones
After that, I confirmed that the keys were successfully loaded with efi-readvar. I then proceeded to sign my kernel with sbsign using the newly created certificate.
sbsign --key /etc/efikeys/db.key --cert /etc/efikeys/db.crt --output /boot/vmlinuz-6.1.2.signed /boot/vmlinuz-6.1.2
I thought that everything should have worked now. Except that I was still getting the red error message about trying to load unsigned code. After banging my head on the desk for a while, I tried to also sign the grub image:
sbsign --key /etc/efikeys/db.key --cert /etc/efikeys/db.crt --output /boot/efi/gentoo/grubx64.efi grubx64.efi.back
Now things were going a little better: grub at least started correctly. However, it was unable to actually boot either linux or windows. After some more search and frustration, I realized that grub was unable to load some modules (since they are not signed) needed for booting. I then used grub-install with a bunch of modules.
MODULES="all_video cat chain configfile disk echo \
ext2 efi_gop efifwsetup efi_uga fat file font gfxmenu gettext gfxterm \
gzio help jpeg linux ls normal part_gpt \
reboot search test tpm video_colors video \
gcry_sha512 gcry_rsa gcry_sha256"
grub-mkconfig -o /boot/grub/grub.cfg
grub-install --target=x86_64-efi --efi-directory=/boot --disable-shim-lock --modules="$MODULES"
mv /boot/efi/gentoo/grubx64.efi grubx64.efi.back
sbsign --key /etc/efikeys/db.key --cert /etc/efikeys/db.crt --output /boot/efi/gentoo/grubx64.efi grubx64.efi.back
At this point I was able to actually use grub to boot in either windows 11 or gentoo, even with secure boot in windows uefi mode. Everything was working after a few hours of trial and error.
The problem arose the following day, when I noticed that not only I could boot with my vmlinux-6.1.2.signed (the kernel I actually signed) but also with vmlinux-6.1.2 (the original unsigned one). Grub allowed me to boot (with secure boot on) with the unsigned kernel (!) and when I checked dmesg both kernels had the Secure boot enabled message (!!).
So the current problem I have is: Why is grub (and my uefi) allowing me to boot unsigned kernels even though Secure boot is enabled? Did I make any mistake in the way I added my keys? Did I make an error when signing grub?
Note: I didn't use any GPG key in this process. For the creation and upload of the keys I followed strictly Sasaki's guide. If possible, I would like to use no gpg keys and only use the certificates created with openssl.
Note2: I tried adding these lines to my grub config, but it didn't work particularly well: Grub complained about missing .sig files and refused to boot anything.
set check_signatures=enfore
export check_signatures
Honestly I just wanted grub to check if the kernel was signed, but instead it seems this option is related to gpg signature, which I didn't add to my grub.
Note3: I also noticed that grub became significantly slower after the various change I made. Before, the boot was almost instantaneous, while now I can see the "welcome" message for a second before the menu opens. Also the console is very sluggish and every keystroke is registered with a delay. Did I make it worse with too much modules or something like that?
/boot/grub/grub.cfg
#
# do not edit this file
#
# it is automatically generated by grub-mkconfig using templates
# from /etc/grub.d and settings from /etc/default/grub
#
### begin /etc/grub.d/00_header ###
if [ -s $prefix/grubenv ]; then
load_env
fi
if [ "${next_entry}" ] ; then
set default="${next_entry}"
set next_entry=
save_env next_entry
set boot_once=true
else
set default="advanced options for gentoo gnu/linux>gentoo gnu/linux, with linux 5.15.6-gentoo.signed"
fi
if [ x"${feature_menuentry_id}" = xy ]; then
menuentry_id_option="--id"
else
menuentry_id_option=""
fi
export menuentry_id_option
if [ "${prev_saved_entry}" ]; then
set saved_entry="${prev_saved_entry}"
save_env saved_entry
set prev_saved_entry=
save_env prev_saved_entry
set boot_once=true
fi
function savedefault {
if [ -z "${boot_once}" ]; then
saved_entry="${chosen}"
save_env saved_entry
fi
}
function load_video {
if [ x$feature_all_video_module = xy ]; then
insmod all_video
else
insmod efi_gop
insmod efi_uga
insmod ieee1275_fb
insmod vbe
insmod vga
insmod video_bochs
insmod video_cirrus
fi
}
insmod part_gpt
insmod fat
search --no-floppy --fs-uuid --set=root e179-b0bd
if loadfont /grub/fonts/terminus18.pf2 ; then
set gfxmode=2560x1440,auto
load_video
insmod gfxterm
set locale_dir=$prefix/locale
set lang=en_us
insmod gettext
fi
terminal_output gfxterm
insmod part_gpt
insmod fat
search --no-floppy --fs-uuid --set=root e179-b0bd
insmod gfxmenu
loadfont ($root)/grub/themes/vimix/dejavu_sans_12.pf2
loadfont ($root)/grub/themes/vimix/dejavu_sans_14.pf2
loadfont ($root)/grub/themes/vimix/dejavu_sans_16.pf2
loadfont ($root)/grub/themes/vimix/dejavu_sans_24.pf2
loadfont ($root)/grub/themes/vimix/dejavu_sans_32.pf2
loadfont ($root)/grub/themes/vimix/dejavu_sans_48.pf2
loadfont ($root)/grub/themes/vimix/terminus-12.pf2
loadfont ($root)/grub/themes/vimix/terminus-14.pf2
loadfont ($root)/grub/themes/vimix/terminus-16.pf2
loadfont ($root)/grub/themes/vimix/terminus-18.pf2
insmod jpeg
insmod png
set theme=($root)/grub/themes/vimix/theme.txt
export theme
if [ x$feature_timeout_style = xy ] ; then
set timeout_style=menu
set timeout=5
# fallback normal timeout code in case the timeout_style feature is
# unavailable.
else
set timeout=5
fi
### end /etc/grub.d/00_header ###
### begin /etc/grub.d/10_linux ###
menuentry 'gentoo gnu/linux' --class gentoo --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-889b06ae-8d49-4046-a1c6-42e6967862b2' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_gpt
insmod fat
search --no-floppy --fs-uuid --set=root e179-b0bd
echo 'loading linux 6.1.2-gentoo.signed ...'
linux /vmlinuz-6.1.2-gentoo.signed root=/dev/nvme1n1p3 ro vt.default_utf8=1
}
submenu 'advanced options for gentoo gnu/linux' $menuentry_id_option 'gnulinux-advanced-889b06ae-8d49-4046-a1c6-42e6967862b2' {
menuentry 'gentoo gnu/linux, with linux 6.1.2-gentoo.signed' --class gentoo --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.1.2-gentoo.signed-advanced-889b06ae-8d49-4046-a1c6-42e6967862b2' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_gpt
insmod fat
search --no-floppy --fs-uuid --set=root e179-b0bd
echo 'loading linux 6.1.2-gentoo.signed ...'
linux /vmlinuz-6.1.2-gentoo.signed root=/dev/nvme1n1p3 ro vt.default_utf8=1
}
menuentry 'gentoo gnu/linux, with linux 6.1.2-gentoo.signed (recovery mode)' --class gentoo --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.1.2-gentoo.signed-recovery-889b06ae-8d49-4046-a1c6-42e6967862b2' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_gpt
insmod fat
search --no-floppy --fs-uuid --set=root e179-b0bd
echo 'loading linux 6.1.2-gentoo.signed ...'
linux /vmlinuz-6.1.2-gentoo.signed root=/dev/nvme1n1p3 ro single }
menuentry 'gentoo gnu/linux, with linux 6.1.2-gentoo' --class gentoo --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.1.2-gentoo-advanced-889b06ae-8d49-4046-a1c6-42e6967862b2' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_gpt
insmod fat
search --no-floppy --fs-uuid --set=root e179-b0bd
echo 'loading linux 6.1.2-gentoo ...'
linux /vmlinuz-6.1.2-gentoo root=/dev/nvme1n1p3 ro vt.default_utf8=1
}
menuentry 'gentoo gnu/linux, with linux 6.1.2-gentoo (recovery mode)' --class gentoo --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.1.2-gentoo-recovery-889b06ae-8d49-4046-a1c6-42e6967862b2' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_gpt
insmod fat
search --no-floppy --fs-uuid --set=root e179-b0bd
echo 'loading linux 6.1.2-gentoo ...'
linux /vmlinuz-6.1.2-gentoo root=/dev/nvme1n1p3 ro single
}
menuentry 'gentoo gnu/linux, with linux 5.15.6-gentoo.signed' --class gentoo --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-5.15.6-gentoo.signed-advanced-889b06ae-8d49-4046-a1c6-42e6967862b2' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_gpt
insmod fat
search --no-floppy --fs-uuid --set=root e179-b0bd
echo 'loading linux 5.15.6-gentoo.signed ...'
linux /vmlinuz-5.15.6-gentoo.signed root=/dev/nvme1n1p3 ro vt.default_utf8=1
}
menuentry 'gentoo gnu/linux, with linux 5.15.6-gentoo.signed (recovery mode)' --class gentoo --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-5.15.6-gentoo.signed-recovery-889b06ae-8d49-4046-a1c6-42e6967862b2' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_gpt
insmod fat
search --no-floppy --fs-uuid --set=root e179-b0bd
echo 'loading linux 5.15.6-gentoo.signed ...'
linux /vmlinuz-5.15.6-gentoo.signed root=/dev/nvme1n1p3 ro single
}
menuentry 'gentoo gnu/linux, with linux 5.15.6-gentoo' --class gentoo --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-5.15.6-gentoo-advanced-889b06ae-8d49-4046-a1c6-42e6967862b2' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_gpt
insmod fat
search --no-floppy --fs-uuid --set=root e179-b0bd
echo 'loading linux 5.15.6-gentoo ...'
linux /vmlinuz-5.15.6-gentoo root=/dev/nvme1n1p3 ro vt.default_utf8=1
}
menuentry 'gentoo gnu/linux, with linux 5.15.6-gentoo (recovery mode)' --class gentoo --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-5.15.6-gentoo-recovery-889b06ae-8d49-4046-a1c6-42e6967862b2' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_gpt
insmod fat
search --no-floppy --fs-uuid --set=root e179-b0bd
echo 'loading linux 5.15.6-gentoo ...'
linux /vmlinuz-5.15.6-gentoo root=/dev/nvme1n1p3 ro single
}
}
### end /etc/grub.d/10_linux ###
### begin /etc/grub.d/20_linux_xen ###
### end /etc/grub.d/20_linux_xen ###
### begin /etc/grub.d/30_os-prober ###
menuentry 'windows boot manager (on /dev/nvme0n1p1)' --class windows --class os $menuentry_id_option 'osprober-efi-3e17-e3b9' {
insmod part_gpt
insmod fat
search --no-floppy --fs-uuid --set=root 3e17-e3b9
chainloader /efi/microsoft/boot/bootmgfw.efi
}
### end /etc/grub.d/30_os-prober ###
### begin /etc/grub.d/30_uefi-firmware ###
menuentry 'uefi firmware settings' $menuentry_id_option 'uefi-firmware' {
fwsetup
}
### end /etc/grub.d/30_uefi-firmware ###
### begin /etc/grub.d/40_custom ###
# this file provides an easy way to add custom menu entries. simply type the
# menu entries you want to add after this comment. be careful not to change
# the 'exec tail' line above.
#set check_signatures=enforce
#export check_signatures
### end /etc/grub.d/40_custom ###
### begin /etc/grub.d/41_custom ###
if [ -f ${config_directory}/custom.cfg ]; then
source ${config_directory}/custom.cfg
elif [ -z "${config_directory}" -a -f $prefix/custom.cfg ]; then
source $prefix/custom.cfg
fi
### end /etc/grub.d/41_custom ###
/etc/default/grub
# Copyright 1999-2020 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2
#
# To populate all changes in this file you need to regenerate your
# grub configuration file afterwards:
# 'grub-mkconfig -o /boot/grub/grub.cfg'
#
# See the grub info page for documentation on possible variables and
# their associated values.
GRUB_DISTRIBUTOR="Gentoo"
# Default menu entry
#GRUB_DEFAULT=0
# Boot the default entry this many seconds after the menu is displayed
GRUB_TIMEOUT=5
#GRUB_TIMEOUT_STYLE=menu
# Append parameters to the linux kernel command line
#GRUB_CMDLINE_LINUX=""
#
# Examples:
#
# Boot with network interface renaming disabled
# GRUB_CMDLINE_LINUX="net.ifnames=0"
#
# Boot with systemd instead of sysvinit (openrc)
# GRUB_CMDLINE_LINUX="init=/usr/lib/systemd/systemd"
# Append parameters to the linux kernel command line for non-recovery entries
#GRUB_CMDLINE_LINUX_DEFAULT=""
# Uncomment to disable graphical terminal (grub-pc only)
#GRUB_TERMINAL=console
# The resolution used on graphical terminal.
# Note that you can use only modes which your graphic card supports via VBE.
# You can see them in real GRUB with the command `vbeinfo'.
GRUB_GFXMODE=2560x1440,auto
# Set to 'text' to force the Linux kernel to boot in normal text
# mode, 'keep' to preserve the graphics mode set using
# 'GRUB_GFXMODE', 'WIDTHxHEIGHT'['xDEPTH'] to set a particular
# graphics mode, or a sequence of these separated by commas or
# semicolons to try several modes in sequence.
#GRUB_GFXPAYLOAD_LINUX=
# Path to theme spec txt file.
# The starfield is by default provided with use truetype.
# NOTE: when enabling custom theme, ensure you have required font/etc.
GRUB_THEME="/boot/grub/themes/vimix/theme.txt"
# Background image used on graphical terminal.
# Can be in various bitmap formats.
#GRUB_BACKGROUND="/boot/grub/mybackground.png"
# Uncomment if you don't want GRUB to pass "root=UUID=xxx" parameter to kernel
#GRUB_DISABLE_LINUX_UUID=true
# Uncomment to disable generation of recovery mode menu entries
#GRUB_DISABLE_RECOVERY=true
# Uncomment to disable generation of the submenu and put all choices on
# the top-level menu.
# Besides the visual affect of no sub menu, this makes navigation of the
# menu easier for a user who can't see the screen.
#GRUB_DISABLE_SUBMENU=y
# Uncomment to play a tone when the main menu is displayed.
# This is useful, for example, to allow users who can't see the screen
# to know when they can make a choice on the menu.
#GRUB_INIT_TUNE="60 800 1"
GRUB_DEFAULT="Advanced options for Gentoo GNU/Linux>Gentoo GNU/Linux, with Linux 5.15.6-gentoo.signed"
# EDITED
GRUB_TERMINAL_OUTPUT="gfxterm"
GRUB_FONT=/boot/grub/fonts/Terminus18.pf2
GRUB_GFXMODE=2560x1440,auto
GRUB_GFXPAYLOAD_LINUX=keep
GRUB_DISABLE_OS_PROBER=n
GRUB_CMDLINE_LINUX_DEFAULT="vt.default_utf8=1"
