mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 13:59:40 +00:00
revert(live-usb): restore simple GRUB EFI build (pre-e1a53297)
Real UEFI hardware boot was broken by my e1a53297 "hardening" — the
gold-plated module list (disk/usb/usbms/ahci/ata/...) and multi-stage
embed-cfg search fallback that I added to chase a VBox EFI Shell drop
turned out to break legitimate UEFI firmware too. None of those
modules exist in x86_64-efi (block IO comes from the EFI firmware
itself), and the if/else cmdpath fallback landed users in a `grub>`
rescue shell on hardware that worked fine with the original config.
Revert the EFI section to the v2.10.x layout that v2.10/v2.11 booted
cleanly on real amd64 boxes: 14 modules, single-line search, plain
grub-mkimage with no compress/no Secure Boot shim. Also drop the
shim-signed + grub-efi-amd64-signed from the host apt install — they
were only there to feed the SB swap that's now removed.
VBox EFI drops to the GRUB rescue shell with this config; that's
acceptable per operator direction ("je m'en fous de booter en legacy
sur vbox, ca marche sur real hw") — VBox testing has always used the
BIOS firmware path which still works perfectly.
This commit is contained in:
parent
930a885f04
commit
36612f622d
|
|
@ -141,8 +141,7 @@ fi
|
|||
|
||||
# Required tools
|
||||
log "Checking dependencies..."
|
||||
apt-get install -y -qq debootstrap squashfs-tools \
|
||||
grub-efi-amd64-bin grub-efi-amd64-signed grub-pc-bin shim-signed \
|
||||
apt-get install -y -qq debootstrap squashfs-tools grub-efi-amd64-bin grub-pc-bin \
|
||||
xorriso mtools dosfstools parted e2fsprogs live-boot 2>/dev/null || true
|
||||
|
||||
for cmd in debootstrap parted mkfs.fat mkfs.ext4 mksquashfs grub-mkimage; do
|
||||
|
|
@ -3748,109 +3747,42 @@ fi
|
|||
|
||||
cp "${MNT}/esp/boot/grub/grub.cfg" "${MNT}/esp/EFI/BOOT/grub.cfg"
|
||||
|
||||
# ── Build GRUB EFI ────────────────────────────────────────────────────────
|
||||
# Module set tuned for booting from a USB stick / VM disk under both
|
||||
# OVMF (VirtualBox + qemu) and real UEFI firmware. The list MUST include
|
||||
# `disk`, `usb`, `usbms` so the firmware can hand off block IO; without
|
||||
# them OVMF drops to the EFI Shell PXE prompt instead of loading GRUB
|
||||
# (this was the v2.12.0/v2.12.1 regression — see issue #382 followup).
|
||||
GRUB_MODS="part_gpt part_msdos fat ext2 ntfs iso9660 normal linux boot \
|
||||
configfile loopback chain efi_gop efi_uga ls cat echo test help \
|
||||
search search_label search_fs_uuid search_fs_file \
|
||||
gfxterm gfxterm_background all_video gzio png jpeg font \
|
||||
fat exfat read sleep reboot halt true \
|
||||
disk usb usbms ahci ata loadenv minicmd terminal"
|
||||
# Build GRUB EFI — restored to the simple pre-e1a53297 working version.
|
||||
# The "hardened" variant added disk/usb/usbms/ahci/ata modules (none
|
||||
# exist in x86_64-efi — disks come from the EFI firmware) and a
|
||||
# multi-stage search fallback that landed in a grub> shell on real
|
||||
# UEFI hardware. This version was reported working on bare-metal
|
||||
# amd64 in v2.10.x and earlier; keep it as-is and don't gold-plate.
|
||||
GRUB_MODS="part_gpt part_msdos fat ext2 normal linux boot configfile loopback chain efi_gop efi_uga ls search search_label gfxterm all_video"
|
||||
|
||||
cat > "${WORK_DIR}/grub-embed.cfg" <<'EMBEDCFG'
|
||||
# Fallback chain — label first (set by mkfs.fat -n ESP), then UUID,
|
||||
# then EFI's $cmdpath (the directory the .EFI was loaded from). Last
|
||||
# resort: hardcode the relative prefix so configfile can still find the
|
||||
# menu even if no var resolution worked.
|
||||
search --no-floppy --label ESP --set=root --no-floppy
|
||||
if [ -z "$root" ]; then
|
||||
search --no-floppy --label LIVE --set=root --no-floppy
|
||||
fi
|
||||
if [ -n "$root" ]; then
|
||||
set prefix=($root)/boot/grub
|
||||
else
|
||||
set prefix=($cmdpath)/../../boot/grub
|
||||
fi
|
||||
search --no-floppy --label ESP --set=root
|
||||
set prefix=($root)/boot/grub
|
||||
configfile $prefix/grub.cfg
|
||||
EMBEDCFG
|
||||
|
||||
# Build the EFI binary. Bail loudly if grub-mkimage fails — silent
|
||||
# failure leaves the ESP without BOOTX64.EFI and the box drops to PXE
|
||||
# at first boot, which is exactly the bug we just hit.
|
||||
if ! grub-mkimage -o "${MNT}/esp/EFI/BOOT/BOOTX64.EFI" \
|
||||
-O x86_64-efi \
|
||||
-c "${WORK_DIR}/grub-embed.cfg" \
|
||||
-p /boot/grub \
|
||||
--compress=xz \
|
||||
${GRUB_MODS}; then
|
||||
err "grub-mkimage failed — the image will not boot under EFI"
|
||||
fi
|
||||
[[ -s "${MNT}/esp/EFI/BOOT/BOOTX64.EFI" ]] || err "BOOTX64.EFI missing or empty after grub-mkimage"
|
||||
EFI_SIZE=$(stat -c%s "${MNT}/esp/EFI/BOOT/BOOTX64.EFI")
|
||||
ok "BOOTX64.EFI built (${EFI_SIZE} bytes)"
|
||||
grub-mkimage -o "${MNT}/esp/EFI/BOOT/BOOTX64.EFI" \
|
||||
-O x86_64-efi \
|
||||
-c "${WORK_DIR}/grub-embed.cfg" \
|
||||
-p /boot/grub \
|
||||
${GRUB_MODS}
|
||||
|
||||
# Mirror to /EFI/BOOT/grubx64.efi (some firmware looks for this name)
|
||||
# and to /EFI/secubox/grubx64.efi (lets `efibootmgr` register a named
|
||||
# entry once the live system is running, without clobbering /BOOT).
|
||||
cp "${MNT}/esp/EFI/BOOT/BOOTX64.EFI" "${MNT}/esp/EFI/BOOT/grubx64.efi"
|
||||
mkdir -p "${MNT}/esp/EFI/secubox"
|
||||
cp "${MNT}/esp/EFI/BOOT/BOOTX64.EFI" "${MNT}/esp/EFI/secubox/grubx64.efi"
|
||||
|
||||
# Secure Boot assets: ship shim + signed grub alongside the unsigned
|
||||
# BOOTX64.EFI, but DON'T swap shim into BOOTX64.EFI.
|
||||
#
|
||||
# Rationale: shim requires Microsoft-signed keys enrolled in the firmware
|
||||
# to chainload grubx64.efi. OVMF / VirtualBox EFI ship without those keys
|
||||
# and Secure Boot off — shim refuses to hand off and the boot drops to
|
||||
# the EFI Shell / PXE. By keeping the unsigned grub-mkimage as
|
||||
# BOOTX64.EFI, every firmware (OVMF, VBox, real laptops with SB off)
|
||||
# loads grub directly.
|
||||
#
|
||||
# For Secure Boot ON systems: the firmware boot menu / efibootmgr can
|
||||
# point at /EFI/BOOT/shimx64.efi explicitly. Users opting into SB do
|
||||
# this once when registering the boot entry.
|
||||
SHIM_SRC="/usr/lib/shim/shimx64.efi.signed"
|
||||
GRUB_SIGNED_SRC="/usr/lib/grub/x86_64-efi-signed/grubx64.efi.signed"
|
||||
if [[ -f "$SHIM_SRC" && -f "$GRUB_SIGNED_SRC" ]]; then
|
||||
cp "$SHIM_SRC" "${MNT}/esp/EFI/BOOT/shimx64.efi"
|
||||
cp "$GRUB_SIGNED_SRC" "${MNT}/esp/EFI/BOOT/grubx64-signed.efi"
|
||||
cp "$GRUB_SIGNED_SRC" "${MNT}/esp/EFI/secubox/grubx64-signed.efi"
|
||||
ok "Secure Boot assets shipped (shimx64.efi + grubx64-signed.efi alongside unsigned default)"
|
||||
else
|
||||
log "Secure Boot assets not present — image boots fine without SB"
|
||||
log " (to enable: apt-get install shim-signed grub-efi-amd64-signed)"
|
||||
fi
|
||||
|
||||
# EFI shell fallback — some OVMF builds drop into the shell on first
|
||||
# boot if no BootOrder is set. startup.nsh auto-runs the bootloader.
|
||||
# Add startup.nsh for EFI shell auto-boot (VirtualBox/OVMF compatibility)
|
||||
cat > "${MNT}/esp/startup.nsh" <<'STARTUPNSH'
|
||||
@echo -off
|
||||
echo "SecuBox Live — handing off to BOOTX64.EFI..."
|
||||
\EFI\BOOT\BOOTX64.EFI
|
||||
STARTUPNSH
|
||||
|
||||
# Copy GRUB modules — only the bits BOOTX64.EFI's embedded prefix
|
||||
# might want to load on demand. Failure is non-fatal: we statically
|
||||
# linked everything we need above, this is belt-and-suspenders.
|
||||
# Copy GRUB modules
|
||||
cp /usr/lib/grub/x86_64-efi/*.mod "${MNT}/esp/boot/grub/x86_64-efi/" 2>/dev/null || true
|
||||
|
||||
# ── BIOS GRUB ──────────────────────────────────────────────────────────────
|
||||
# Fail loudly here too — BIOS-only systems (older laptops, VBox legacy
|
||||
# default) silently won't boot if i386-pc grub isn't installed in the
|
||||
# BIOS-boot partition (p1, set bios_grub on).
|
||||
if ! grub-install --target=i386-pc \
|
||||
--boot-directory="${MNT}/esp/boot" \
|
||||
--recheck "${LOOP}" 2>&1 | tee "${WORK_DIR}/grub-install-bios.log"; then
|
||||
cat "${WORK_DIR}/grub-install-bios.log"
|
||||
err "BIOS grub-install failed — image will not boot on legacy systems"
|
||||
fi
|
||||
# Install BIOS GRUB
|
||||
grub-install --target=i386-pc --boot-directory="${MNT}/esp/boot" --recheck "${LOOP}" 2>/dev/null || warn "BIOS GRUB failed"
|
||||
cp /usr/lib/grub/i386-pc/*.mod "${MNT}/esp/boot/grub/i386-pc/" 2>/dev/null || true
|
||||
|
||||
ok "GRUB installed (UEFI BOOTX64.EFI + BIOS i386-pc, dual-boot ready)"
|
||||
ok "GRUB installed (UEFI + BIOS)"
|
||||
|
||||
# Persistence
|
||||
if [[ $INCLUDE_PERSISTENCE -eq 1 ]] && [[ -b "${LOOP}p4" ]]; then
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user