Re: x86_64: grub-install for secure boot

[Randy Goldenberg]

Instructions for installing Knoppix on a USB stick are available at
https://www.knopper.net/knoppix/knoppix910-en.html.

The article above includes a link to instructions for inserting the
signed checksum of the Linux bootloader in the UEFI firmware,
necessary when booting for the first time.

https://www.knopper.net/knoppix/knoppix-uefi-en.html

I do not use Knoppix and do not know if the information above is
appropriate in your environment.

A Knoppix forum may be a better source of information.

On Fri, Jul 28, 2023 at 9:58 PM Zvi Vered <veredz72@gmail.com> wrote:
>
> Hello,
>
> When  I tried to sign my kernel with mokutil under knoppix (secure
> boot = enabled)
> I got the "EFI variables are not supported on this system" again.
> I found a youtube link explaining how to solve this problem.
> https://www.youtube.com/watch?v=6JhMSKvf6Kw
>
> modprobe efivarfs
> mount -t efivarfs efivarfs /sys/firmware/efi/efivars
>
> After those 2 steps, mokutil worked.
> Unfortunately, I'm not an expert. Can't tell if this is the right
> solution or not.
> According to a few links I found, the cause of the problem is that
> knoppix is booting from a USB stick.
>
> Thank you,
> Zvika
>
>
> On Fri, Jul 28, 2023 at 10:08 PM Pascal Hambourg <pascal@plouf.fr.eu.org> 
> wrote:
> >
> > On 28/07/2023 at 20:13, Zvi Vered wrote:
> > >
> > > You wrote: "Most likely the system was booted in legacy BIOS mode"
> >
> > I don't think so. grub-install would have selected the i386-pc target
> > instead of x86_64-efi.
> >
> > > I booted knoppix with: secure boot=disable
> > > Under this knoppix I ran: grub-install.
> > >
> > > Should I boot the PC with secure boot=enable and then run grub-install ?
> >
> > I do not think it would change anything. As I suggested previously,
> > you'd rather check efivarfs first. If it cannot be mounted, run
> > grub-install with option --force-extra-removable and select to boot from
> > the drive removable media path (not the "debian" boot entry).
> >
>