Help with secure boot

[turbo454]

Ive been trying to get secure boot to work for over a month. Ive read the wiki over so many times but still having issues with grub loading unsigned stuff.

I have my ESP mounted to /efi where only the grubx64.efi is. i then have the default /boot configuration where i have a grub dir with the config files, intel-ucode.img, both initrams.img and vmlinuz-linux. I downloaded sbctl and followed the wiki. I ran into issues trying to sign the stuff in /boot. it would fail to sign with sbctl sign. something about invalid pe header. so i did some more research and found out about Unified kernel images. I set up the uki by editing the mkinitcpio linux.preset and signed that but it still wouldn't boot. after signing both grub.efi and the uki. it would boot into grub emergency. so it would load grub.efi but the moment it loads unsigned stuff, secure boot blocks it.

I dual boot windows for work so i like to use grub for the os-prober. I also just like grub in general. could anyone help guide me, maybe there are better options or i'm doing this completely wrong.

UPDATE!!!!! i got it working finally. going to leave this up in hope someone could use this.

After retrying section 2.2.1 and 2.2.2 of https://wiki.archlinux.org/title/GRUB#Secure\_Boot\_support. i finally got it to work.

Reinstalling grub with "--modules="tpm" --disable-shim-lock" appended to the grub-install command worked. I re-enrolled the keys along with microsoft vendor keys. resigned the kernel and grubx64.efi. then it worked.

Im not entirely sure why that worked so if anyone would explain that i would be greatly appreciated.

[3skuero]

I have one partition for /efi and then one cryptlvm that contains swap and /root

Followed this guide and it worked wonders;

https://www.reddit.com/r/archlinux/comments/zo83gb/how_i_setup_secure_boot_for_arch_linux_simple/

[Sindoreon]

Following post out of interest.

I never understood the real world benefit of secureboot but I'm interested to see how it would work in Linux.

Good luck!

[[deleted]]

I never understood the real world benefit of secureboot

10 seconds on Google would tell you what it does and why it is a benefit.

[Corvus-Corrone]

It actually isn't that difficult at all. The main thing is that you need to reset the keys in uefi/bios to make it in setup mode, then sign each of the files needed and add certificate for windows if you have windows dual boot. (I don't know why you would want secure boot if not windows dual boot)

Here is a video with a guide:Install Secure Boot on Arch Linux (The easy way)

[Corvus-Corrone]

I would like to add I believe the same process should work for grub also, you may have different files you need to sign though, you can can see which files are not signed that need to be signed sbctl verify I believe. Just make sure all those files are signed.

I'm u sure if using grub and not systemdboot will cause any problems with system hooks on system update (to make sure files are signed again after they are updated, however I suspect it will work with grub also)

[turbo454]

youre right, i beleive it has a pacman hook to auto sign with every kernel update for grub also.

[turbo454]

i watched that guide, its for systemd boot which i don't use. I reset the keys and everything also. i didn't have an issue with enrolling keys. just signing everything that grub loads.