2

Out of curiosity, I'm trying out systemd-boot on my laptop which has UEFI with secure boot. The default GRUB installation is working fine.

For systemd-boot, most searches lead to this page. This involves installing systemd-boot with bootctl, creating loader.conf, creating a kernel postinst zz-update-systemd-boot script. Everything looks fine till here though I don't understand why systemd-boot doesn't have an ext4 fs driver to access the kernels. Anyway, as expected this fails to boot because of secure boot.

The secure boot section of this page has the PreLoader.efi & HashTool.efi setup. After following the steps, the system boot shows the systemd-boot menu but after choosing Ubuntu this error is thrown:

EFI stub: UEFI Secure Boot is enabled.

As far as I understand, the PreLoader is a signed binary that is accepted by UEFI. This then loads the loader.efi (renamed systemd-bootx64.efi) whose hash was enrolled. This loads the vmlinuz kernel whose hash was also enrolled. So, it appears that the secure chain is fine but boot still fails. It appears that Canonical's signature to the kernel does not play a role here.

How to get this working and have I understood the secure aspects correctly?

1 Answer 1

1

I followed a variation of the page you refer to, minus the Secure Boot options.

Unfortunately, once the changes are made, Ubuntu's linux-generic, linux-headers-generic, and linux-image-generic insist on installing GRUB in addition to the systemd-boot installation, and set GRUB as the default boot option at each apt update of the kernel.

As a result, the box no longer boots using systemd-boot at the next reboot. So what seems to be needed is a final command to run efibootmgr to re-set the boot order to use "ubuntu" again.

To prevent this hassle, I think Ubuntu's linux-generic, linux-headers-generic, and linux-image-generic DEB packages should be configured to accept either GRUB or systemd-boot as accepted bootloaders, rather than forcibly installing GRUB.

4
  • Thanks for your experience - I can imagine the hassle when grub is assumed! However, I'm looking for this to work with secure boot.
    – rubpa
    Dec 10, 2020 at 6:14
  • @Glen, with a bit of APT trickery you can block Ubuntu's behavior. Create the new file /etc/apt/preferences.d/no-boot-loaders and copy the text I've put in pastebin.com/dqVrTtw1. This prevents the installation of GRUB and LILO, thus leaving your preferred boot loader alone.
    – OAreaMan
    Dec 22, 2020 at 6:05
  • Thanks @OAreaMan, but that approach prevented automated kernel updates, so I used another approach shown in pastebin.com/Aq4UfvWc
    – Glen
    Dec 23, 2020 at 13:47
  • 1
    grub is recommends not depends, just use --no-install-recommends or exclude grub in configuration
    – Wang
    Oct 19, 2022 at 22:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .