Secure boot for vanilla linux

zvivered · 11-02-2019, 01:20 AM

Hello,

For the past 10 years I installed vanilla x86 (32 or 64) on embedded PCs.

First I boot this PC with knoppix and install legacy grub with: install-grub.

Now I want to do the same but with secured boot.
Can I use legacy grub or should I use grub2 ?

If grub2 is mandatory, can I use knoppix to install it ?

Thank you in advance,
Zvika

hazel · 11-03-2019, 08:40 AM

To use secure boot, you have to have a UEFI chip. A traditional BIOS chip won't do it.
Here's what the developer of rEFInd says about UEFI and grub-legacy:

Quote:

Originally Posted by Roderick Smith

Conditions in which you should almost certainly not use GRUB Legacy include:

You want or need to use Secure Boot. Although you can sign a GRUB Legacy binary, it won't honor Secure Boot settings on the follow-on kernel, which at least partially defeats the point of Secure Boot.

According to Rod, you can use GRUB2 with shim.

zvivered · 11-04-2019, 10:32 AM

Hi hazel,

Thank you very much for your reply.

According to few links I found, secured grub2 can run by bootx64.efi or Shim only.
Am I right ?

Best regards,
Zvika