boot/grub2: Add disable shim lock config option
PATCH 1/1 boot/grub2: Add disable shim lock config option
When using Secure Boot without SHIM, grub2 can run into issues where it is expecting SHIM to be present, resulting in a "shim_lock protocol not found" error. This can be fixed by passing the --disable-shim-lock flag to grub-mkimage.
See https://www.gnu.org/software/grub/manual/grub/html_node/UEFI-secure-boot-and-shim.html
Signed-off-by Matt Silva <[email protected]>
--- boot/grub2/Config.in | 6 ++++++ boot/grub2/grub2.mk | 2 ++ 2 files changed, 8 insertions(+)
boot/grub2/Config.in +6 -0
@@ -160,6 +160,12 @@ config BR2_TARGET_GRUB2_BUILTIN_CONFIG_EFI device and other configuration parameters, but however menu entries cannot be described in this embedded configuration. +config BR2_TARGET_GRUB2_DISABLE_SHIM_LOCK + bool "disable shim lock" + depends on !BR2_TARGET_SHIM + help + Disable shim lock verifier + endif # BR2_TARGET_GRUB2_HAS_EFI_BOOT config BR2_TARGET_GRUB2_INSTALL_TOOLS
boot/grub2/grub2.mk +2 -0
@@ -183,6 +183,8 @@ define GRUB2_INSTALL_IMAGES_CMDS -p "$(GRUB2_PREFIX_$(tuple))" \ $(if $(GRUB2_BUILTIN_CONFIG_$(tuple)), \ -c $(GRUB2_BUILTIN_CONFIG_$(tuple))) \ + $(if $(BR2_TARGET_GRUB2_DISABLE_SHIM_LOCK), \ + --disable-shim-lock) \ $(GRUB2_BUILTIN_MODULES_$(tuple)) $(INSTALL) -D -m 0644 boot/grub2/grub.cfg $(GRUB2_CFG_$(tuple)) $(if $(findstring $(GRUB2_PLATFORM_$(tuple)), pc), \
Signature · 6 lines
2.47.1 _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot