Difference between revisions of "Package:Shim"

Revision as of 18:41, January 7, 2023

We have fedora's EFI secure boot shim. Documentation suggests loading the shim to unlock secure boot, and that the shim side loads grubx64.efi in the same directory.

sys-boot/shim

    Homepage:            https://apps.fedoraproject.org/packages/shim/
    Description:         Fedora's signed UEFI shim

root # emerge sys-boot/shim

these files are added to the system:

/usr/share/shim/BOOTIA32.EFI
/usr/share/shim/BOOTX64.EFI
/usr/share/shim/mmia32.efi
/usr/share/shim/mmx64.efi

root # mkdir /boot/EFI/FUNTOO
root # cp /usr/share/shim/* /boot/EFI/FUNTOO/

uefi secure boot

first, sign your kernel & modules as seen here Signed_kernel_module_support

press the f1 f2 f8 f9 f10 esc or delete to load bios.
set bios to load uefi usb devices first, disable secure boot, and enable legacy mode. save settings and exit.
press the f1 f2 f8 f9 f10 esc or delete to load your boot selection menu.
load EFI from file, point to /boot/EFI/FUNTOO/shim
shim will greet you with access violation warnings.
fiddle around to get mok manager to load up.
select add key
point to /boot/EFI/FUNTOO/grubx86.efi
press the f1 f2 f8 f9 f10 esc or delete key to load your boot selection menu.
load EFI from file, and again point to /boot/EFI/FUNTOO/shim which will now load funtoo under secure boot.

key management

mokutil loads the arbitrary machine owner key management console and allows us to load keys that are not signed by microsoft:

root # emerge sys-boot/mokutil

"users may wish to disable validation in shim while booted with Secure Boot enabled on an official kernel by using 'sudo mokutil --disable-validation', providing a password when prompted, and rebooting; or to disable Secure Boot in firmware altogether. " - https://wiki.ubuntu.com/UEFI/SecureBoot

these might be needed to get shim running but doubtful. we should be well covered with mokutil.

root # emerge app-crypt/sbsigntools app-crypt/efitools

Links

fallback default efi partition

Warning

avoid this if possible

root # mkdir /boot/EFI/BOOT
root # cp /boot/EFI/FUNTOO/* /boot/EFI/BOOT/

@@ Line 34: / Line 34: @@
 *load EFI from file, and again point to /boot/EFI/FUNTOO/shim which will now load funtoo under secure boot.
-===Uncooperative===
+===key management===
-{{warning|untested, LETS TRY IT IT LOOKS FUN! {{=}}D}}
+*mokutil loads the arbitrary machine owner key management console and allows us to load keys that are not signed by microsoft:
-*mokutil looks helpful when uefi secure boot is uncooperative:
 {{console|body=
 ###i## emerge sys-boot/mokutil