0

For my own personal purposes, I am writing a script in order to automate installation of a custom Debian system onto the hard drive of whatever computer the script is running on. This script is intended to be used from any live Linux distribution.

I am aware of Debian preseeding - unfortunately, preseeding is not a viable solution in this situation.

The script works. However, it does not work consistently. On some machines (for example, my 2011 Macbook Air), the new EFI configuration is updated without any issues. However, on some machines (notably newer Dell laptops), I have to go into the BIOS and manually add my \EFI\debian\grubx64.efi file.

How would I alter the below script in order to accommodate most modern UEFI systems?

I am aware that I will likely need to alter my efibootmgr commands below.

#!/bin/bash

# Preliminary commands
set -e

echo "Available disks:"

current_disk=$(df / | awk 'NR==2 {print $1}')
for disk in $(lsblk -dnro NAME,TYPE | awk '$2=="disk" {print $1}'); do
if [ "$disk" != "${current_disk#/dev/}" ]; then
    size=$(lsblk -dnro SIZE "/dev/$disk")
    echo "/dev/$disk: $size"
fi
done

read -p "Enter the disk you want to install Debian on (e.g. /dev/sda): " disk

mkdir -p /mnt
sgdisk --zap-all "$disk" > /dev/null
parted "$disk" mklabel gpt
parted "$disk" mkpart ESP fat32 0% 512MB
parted "$disk" mkpart primary ext4 512MB 100%

# Set up main partition
yes | mkfs.ext4 "${disk}2"
mount "${disk}2" /mnt

# Set up EFI partition
yes | mkfs.fat -F32 "${disk}1"
mkdir -p /mnt/efi
mount "${disk}1" /mnt/efi

debootstrap --arch=amd64 buster /mnt http://ftp.us.debian.org/debian/

# Set up bindings
mount --bind /dev /mnt/dev
mount --bind /proc /mnt/proc
mount --bind /sys /mnt/sys

# Chroot to set up grub
chroot /mnt /bin/bash << "EOT"
apt update -y
apt install -y linux-image-amd64 grub-efi-amd64
grub-install --target=x86_64-efi --efi-directory=/efi --bootloader-id=debian --recheck --no-floppy
update-grub
EOT

# Set the path to your .EFI file
efi_file="\EFI\debian\grubx64.efi"
bootnum=$(efibootmgr -v | grep "Boot" | awk '{print $1}' | sed 's/Boot//g' | sort -n | tail -1 | awk '{print $1+1}')
efibootmgr -c -d "$disk" -p 1 -L "Debian" -l "${efi_file}" -b "${bootnum}"
efibootmgr -o "${bootnum}"

# Unmount bindings
umount -l /mnt/sys
umount -l /mnt/proc
umount -l /mnt/dev

# Unmount filesystems
umount -l /mnt/efi
umount -l /mnt

reboot

1 Answer 1

0

Newer systems tend to have Secure Boot enabled by default, and grubx64.efi needs to be explicitly whitelisted if you want to boot it directly in systems with factory default configuration, as Debian's grubx64.efi is not signed by either Microsoft or the system manufacturer.

When you go to BIOS settings and manually configure grubx64.efi to boot, the firmware might automatically whitelist it for you, as you have explicitly specified you wish to use it, in a direct user interaction that cannot be (easily) subverted by software.

You should probably change the line

apt install -y linux-image-amd64 grub-efi-amd64

to

apt install -y linux-image-amd64 grub-efi-amd64 grub-efi-amd64-signed shim-signed 

This will install a version of grubx64.efi that has all relevant GRUB modules built-in (since Secure Boot will prevent GRUB from loading any modules: GRUB modules are not PE-COFF binaries but ELF binaries, so the Secure Boot firmware cannot validate them) which is signed by Debian, and shimx64.efi which is signed by Microsoft. Both of those have been built as reproducible binaries, so if you wish, you can redo the build process yourself to get absolutely identical binaries, so you can verify there is no malware in their code.

If the -signed packages are installed, grub-install should automatically use them, but if you want to be sure, you can add the --uefi-secure-boot option for it to specify you explicitly want to use them.

When used in this way, you should change efi_file= to be \EFI\debian\shimx64.efi; it will check for Secure Boot, non-persistently add Debian's Secure Boot certificate to the whitelist if necessary, and then load grubx64.efi automatically. If the system has Secure Boot disabled, it will just load grubx64.efi and run it.

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .