[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH v2 05/22] docs/grub: Document signing grub under UEFI

From: Stefan Berger
Subject: Re: [PATCH v2 05/22] docs/grub: Document signing grub under UEFI
Date: Mon, 12 Jul 2021 08:44:38 -0400
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0

On 6/30/21 4:40 AM, Daniel Axtens wrote:
Before adding information about how grub is signed with an appended
signature scheme, it's worth adding some information about how it
can currently be signed for UEFI.

Signed-off-by: Daniel Axtens <>

Reviewed-by: Stefan Berger <>

  docs/grub.texi | 22 +++++++++++++++++++++-
  1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/docs/grub.texi b/docs/grub.texi
index f8b4b3b21a7f..2ffc3b417312 100644
--- a/docs/grub.texi
+++ b/docs/grub.texi
@@ -5795,6 +5795,7 @@ environment variables and commands are listed in the same 
  * Secure Boot Advanced Targeting::   Embedded information for generation 
number based revocation
  * Measured Boot::                    Measuring boot components
  * Lockdown::                         Lockdown when booting on a secure setup
+* Signing GRUB itself::              Ensuring the integrity of the GRUB core 
  @end menu
@node Authentication and authorisation
@@ -5873,7 +5874,7 @@ commands.
GRUB's @file{core.img} can optionally provide enforcement that all files
  subsequently read from disk are covered by a valid digital signature.
-This document does @strong{not} cover how to ensure that your
+This section does @strong{not} cover how to ensure that your
  platform's firmware (e.g., Coreboot) validates @file{core.img}.
If environment variable @code{check_signatures}
@@ -6035,6 +6036,25 @@ be restricted and some operations/commands cannot be 
  The @samp{lockdown} variable is set to @samp{y} when the GRUB is locked down.
  Otherwise it does not exit.
+@node Signing GRUB itself
+@section Signing GRUB itself
+To ensure a complete secure-boot chain, there must be a way for the code that
+loads GRUB to verify the integrity of the core image.
+This is ultimately platform-specific and individual platforms can define their
+own mechanisms. However, there are general-purpose mechanisms that can be used
+with GRUB.
+@section Signing GRUB for UEFI secure boot
+On UEFI platforms, @file{core.img} is a PE binary. Therefore, it can be signed
+with a tool such as @command{pesign} or @command{sbsign}. Refer to the
+suggestions in @pxref{UEFI secure boot and shim} to ensure that the final
+image works under UEFI secure boot and can maintain the secure-boot chain. It
+will also be necessary to enrol the public key used into a relevant firmware
+key database.
  @node Platform limitations
  @chapter Platform limitations

reply via email to

[Prev in Thread] Current Thread [Next in Thread]