22 Support shim fallback bootchain by olivercalder · Pull Request #106 · canonical/pc-gadget

olivercalder · 2023-09-25T05:41:21Z

This PR adds fallback shim and grub EFI assets to EFI/ubuntu/, while leaving non-fallback assets in EFI/BOOT/.

This is part of larger work on the snapd side to explicitly set EFI boot variables on install, thus no longer relying on default EFI boot behavior, which can be affected by such things as attaching external media.

The corresponding snapd PR is:

boot,bootloader: add support for shim fallback and setting EFI boot variables on install snapd#13205

For those internal to Canonical, the spec related to this work can be found at:

https://docs.google.com/document/d/1s-XJ56Ur6mQdJ3gVtWdJs12odgknM_2nqQ72RzWUDho

This is a revival of previous PRs which sought to add shim fallback support:

Similar changes should be ported to core24, and perhaps backported to core20 as well (likely not core18 or core16, though).

Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

The fallback grub EFI asset is already in EFI/ubuntu/, but the non-fallback grub asset should be in EFI/BOOT/ as well. The sources for these grub assets are identical. This corresponds to work in snapd PR #13205. See the following for more details: - canonical/snapd#13205 Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

valentindavid · 2023-09-25T11:56:41Z

        content:
          - source: grubx64.efi
-            target: EFI/boot/grubx64.efi
+            target: EFI/BOOT/grubx64.efi


This is right.

I was a bit confused on why we still need this. But shim is configured to boot \grubx64.efi (DEFAULT_LOADER). And generate_path_from_image_path from shim considers paths that do not start with \EFI\ to be relative.

I wonder if it would be better to sort these content entries by target directory. So it is easier to see what goes in EFI\BOOT and what goes in EFI\ubuntu.

Thanks, good to know. I totally agree about sorting, I'll fix that in a moment.

@alfonsosanchezbeato do you think grub${arch}.efi is required in EFI/BOOT/ because of this?

Afaict if the fallback binary is in EFI\boot, it will get run instead of grub, and even if it does not find any CSV file, grub*.efi will not be invoked, so I don't see it necessary. @valentindavid please correct if I am getting something wrong here.

You are right. This is how it seems documented.

valentindavid · 2023-09-25T11:56:57Z

+            target: EFI/BOOT/BOOTX64.efi
+          - source: fbx64.efi
+            target: EFI/BOOT/fbx64.efi
+          - source: mmx64.efi


I think the mok manager should also go in EFI\ubuntu.

Sounds good. I don't really know what the mok manager is used for, and there was some consternation about adding it in the past: #56 (comment)

It's not one of the boot assets added by the snapd PR #13205 (https://github.com/snapcore/snapd/pull/13205/files#diff-dca334c34d6acf0ce9fb49a95fb836caafe064f7fd2eda43a2185d6d9c7e20e5R464-R476), so I'm not sure if it's something we actually need to add.

What do you think?

I would love to have it. The mok keys can be used to sign your own kernels. But it can also be used by anything that uses the secondary trusted keyring in the kernel: kernel modules, signed dm-verity, etc.

Also there is no security argument here, because there is a signed efi that anyone can install manually. We are just making it more annoying to install it for legitimate users.

If it causes some issues and would delay this PR, you do not have to add it.

But for sure, if we add it in EFI\BOOT, it should also go in EFI\ubuntu. It feels very weird to have it in only one. That would be, you can install machine owner keys, but only if in the bios, you force to boot the default efi bootloader (EFI\BOOT\bootx64.efi) instead of the configured BootOrder.

To sum up. Either add EFI\ubuntu\mmx64.efi or remove EFI\BOOT\mmx64.efi.

Probably we can live with MokManager only in EFI\ubuntu, as we have seen that grub will not ever run from EFI\boot if we have fbx64.efi. As MM is called either when shim tries to run grub but it has not a valid signature or when the OS modifies EFI variables related to the MoK - and the OS is expected to have been started by grub in EFI\ubuntu.

Sounds correct.

Makes sense. I've removed it now, thanks!

Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

mwhudson · 2023-09-26T03:03:04Z

This doesn't build because fb$arch.efi and mm$arch.efi get deleted in snapcraft.yaml, is that expected?

alfonsosanchezbeato

This should be proposed to branch 24 first as it is quite a risky change. There should be also an assumes in snapcraft.yaml for the snapd version that will contain the changes needed for this to happen. Before that this PR cannot be merged.

alfonsosanchezbeato · 2023-09-26T14:51:04Z

+            target: EFI/BOOT/fbx64.efi
          - source: grubx64.efi
-            target: EFI/boot/grubx64.efi
+            target: EFI/BOOT/grubx64.efi


Are we sure we need grub in EFI/BOOT? Afaiu reading shim code, shim would never run it if it finds EFI/BOOT/fbx64.efi

I think you are right.

…hanged" This reverts commit faf0d0e. Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

The only grub which should ever be run is `EFI/ubuntu/grub${arch}.efi`. In no case should `EFI/BOOT/grub${arch}.efi` ever be executed. The possible boot patterns are: 1. If EFI boot variables are set correctly, boot the desired asset correctly (namely, `EFI/ubuntu/shim${arch}.efi`). 2. If the system supports fallback, then `EFI/BOOT/fb${arch}.efi` is run, which searches for `BOOT${arch}.CSV`, finds it in `EFI/ubuntu/`, and thus boots the corresponding assets in `EFI/ubuntu/`. 3. If fallback is not supported, the system directly boots `EFI/BOOT/BOOT${arch}.efi`. Thus, `EFI/BOOT/grub${arch}.efi` should never be run, so it should be removed. Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

Since there is no grub binary in `EFI/boot/`, there is no need for mok manager binaries in `EFI/boot/` either. Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

xnox and others added 4 commits September 25, 2023 00:20

Implement shim fallback support.

348f495

Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

Implement shim fallback support for aa64.

39cdb82

Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

Bump ubuntu-seed edition number to 3, as content layout has changed

faf0d0e

Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

olivercalder mentioned this pull request Sep 25, 2023

gadget: move efi files in ubuntu-seed to EFI/ubuntu and rename boot*efi to shim*.efi #105

Closed

valentindavid reviewed Sep 25, 2023

View reviewed changes

olivercalder mentioned this pull request Sep 26, 2023

boot,bootloader: add support for shim fallback and setting EFI boot variables on install canonical/snapd#13205

Closed

sort EFI assets alphabetically by target

1b0e168

Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

alfonsosanchezbeato reviewed Sep 26, 2023

View reviewed changes

olivercalder added 6 commits September 26, 2023 09:58

Revert "Bump ubuntu-seed edition number to 3, as content layout has c…

3077f1d

…hanged" This reverts commit faf0d0e. Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

set up fb${arch}.efi, mm${arch}.efi, and BOOT${arch}.CSV correctly

a6086ea

Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

assume snapd 2.61 for handling assets in /EFI/ubuntu

0176fdc

Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

add mm${arch}.efi to /EFI/ubuntu as well as /EFI/BOOT

1336934

Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

Removed mok manager from EFI/boot/

efb4ecf

Since there is no grub binary in `EFI/boot/`, there is no need for mok manager binaries in `EFI/boot/` either. Signed-off-by: Oliver Calder <oliver.calder@canonical.com>

olivercalder changed the title ~~Support shim fallback bootchain~~ 22 Support shim fallback bootchain Oct 5, 2023

olivercalder mentioned this pull request Oct 5, 2023

24 Support shim fallback bootchain #107

Open

LaiderLai mentioned this pull request Jan 31, 2024

Algin with stock Ubuntu desktop boot assets layout #109

Merged

Conversation

olivercalder commented Sep 25, 2023

Uh oh!

valentindavid Sep 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mwhudson commented Sep 26, 2023

Uh oh!

alfonsosanchezbeato left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

valentindavid Sep 25, 2023 •

edited

Loading

alfonsosanchezbeato left a comment •

edited

Loading