bugGNU GRUB - Bugs: bug #65103, no way to disable secure boot...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #65103: no way to disable secure boot signature for images to boot from grub

Submitter:  akallabeth <akallabeth>
Submitted:  Mon 01 Jan 2024 11:04:44 AM UTC
   
 
Category:  Security Severity:  Major
Priority:  5 - Normal Item Group:  None
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Release:  other
Release:  Reproducibility:  Every Time
Planned Release:  None

Mon 01 Jan 2024 11:22:06 AM UTC, comment #1: 

missing from the initial report:

1. using 2.12-rc1 debian package with argon2 patches from https://gitlab.com/mattz7/pkgbuild-public
2. I use different keys for MOK and grub (RSA2048 vs RSA4096)

 akallabeth <akallabeth>
Mon 01 Jan 2024 11:04:44 AM UTC, original submission:  

My setup is as follows:

1. I have a grubx64.efi signed with my own MOK secure boot keys
2. I have enabled signature verification with grub-mkstandalone --pubkey <key> and set check_signatures=enforce
3. Booting without secure boot works fine, the grub signature checks are enforced (can not load any image that does not have a detached signature with my grub key id)
4. If I enable secure boot each image must also be signed with my MOK keys or the image will not boot
5. I have tried to build the grub image with and without  --disable-shim-lock

I have not found a way to disable this behavior and let grub boot arbitrary images that are only signed with the grub key.

The secure boot keys are a no longer needed (and in my case only used to make manipulation of the grub image harder).
All further operations should only depend on the grub signature verification for my setup.

 akallabeth <akallabeth>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by akallabeth (Submitted the item)

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    No changes have been made to this item

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-72d9.
    Corresponding source code