Arch Linux

berol

Member

Registered: 2024-08-31

Posts: 2

creating a secure boot arch usb

hello, im new to the community. i have spent hours now trying to figure out how to get arround this error. im following an archlinux.org guide on how to create a bootable arch linux usb that can boot in secure boot as im unable to change my uefi settings but im stuck on square one. any help would be much appreciated. heres the error:

sudo osirrox -indev archlinux-2024.08.01-x86_64.iso     -extract_boot_images ./  -extract /ARCH/EFI/BOOT/BOOTx64.EFI grubx64.efi         -extract /shellx64.EFI shellx64.EFI      -extract /arch/boot/x86_64/vmlinuz-linux vmlinuz-linux
xorriso 1.5.6 : RockRidge filesystem manipulator, libburnia project.

Drive current: -indev 'archlinux-2024.08.01-x86_64.iso'
Drive access : shared:readonly
Media current: stdio file, overwriteable
Media status : is blank
Media summary: 0 sessions, 0 data blocks, 0 data, 38.8g free
xorriso : FAILURE : Cannot determine attributes of (ISO) source file '/ARCH/EFI/BOOT/BOOTx64.EFI' : No such file or directory
xorriso : aborting : -abort_on 'FAILURE' encountered 'FAILURE'

d_fajardo

Member

Registered: 2017-07-28

Posts: 1,687

Re: creating a secure boot arch usb

how to create a bootable arch linux usb that can boot in secure boot

That would be impossible as you're asking what secure boot is supposed to secure you from, unless the image is signed.  Everything in secure boot happens in the firmware and you sign it with something the firmware recognises. Refer to these:
https://wiki.archlinux.org/title/Unifie … ecure_Boot
https://wiki.archlinux.org/title/Unifie … _repacking

berol

Member

Registered: 2024-08-31

Posts: 2

Re: creating a secure boot arch usb

ik, im following the guide on from the second link, however im getting a file no such file or directory error. where should i place the iso in order for xorriso to find it?

cryptearth

Member

Registered: 2024-02-03

Posts: 2,167

Re: creating a secure boot arch usb

as im unable to change my uefi settings

what hardware you're using? have you consulted the manual? have you contacted the oem?
usually if you can't find a setting to disable secureboot or if it's disabled you first have to set a bios password - then often the secureboot option appears/become active and you should be able to disable it
l don't know any consumer product which denies access to that setting
if, however, you use something designed for industrial/commercial use not intented to be serviced/accessed by the customer like sales systems or anything public then these systems are designed to actively deny the use of random boot media and to protect against the very thing you want to try to accomplish ... although we seen doom running on atms - something that shouldn't be possible but is due to the design flaw of such oems put all the trust in the hardware as in "as long as noone can access these ports we don't have to secure them"

d_fajardo

Member

Registered: 2017-07-28

Posts: 1,687

Re: creating a secure boot arch usb

where should i place the iso in order for xorriso to find it

I believe ISO needs tobe mounted? But should be accesible from anywhere really as long as readable file system. You can specify the path through xorrisofs, Refer to the man page for xorrisofs.

scdbackup

Member

Registered: 2013-05-30

Posts: 75

Re: creating a secure boot arch usb

Hi,

the reason for the error message is that file /ARCH/EFI/BOOT/BOOTx64.EFI
was not found in the ISO.

The example in
  https://wiki.archlinux.org/title/Unifie … _repacking
copies out /EFI/BOOT/BOOTx64.EFI (without leading "/ARCH").
This surplus "/ARCH" probably causes the error message that the file
BOOTx64.EFI is not found in the ISO.

The example uses a different xorriso command -cpx which resembles more
the GNU/Linux shell command "cp" by accepting multiple source files and
one destination directory. That way, the extracted files get the same
names (e.g. BOOTx64.EFI) on disk as in the ISO.

Your command tries to copy BOOTx64.EFI to grubx64.efi, which would later
in the example lead to problems because of wrong name.

Further: "sudo" is not needed for extracting files from the ISO.

I just tried in an empty disk directory (with the ISO located in
the parent directory):

osirrox -indev ../archlinux-2023.12.01-x86_64.iso -extract_boot_images ./ -cpx /arch/boot/x86_64/vmlinuz-linux /EFI/BOOT/BOOTx64.EFI /EFI/BOOT/BOOTIA32.EFI /shellx64.efi /shellia32.efi ./

and got no error but these files in the directory:

BOOTIA32.EFI          eltorito_img1_bios.img  mbr_part2_efi.img  systemarea.img
BOOTx64.EFI           eltorito_img2_uefi.img  shellia32.efi      vmlinuz-linux
eltorito_catalog.img  mbr_code_isohybrid.img  shellx64.efi

If you do this with the already extracted boot images in the disk
directory you will get a new error message:

xorriso : FAILURE : -extract_boot_images: File already exists on disk: '.../eltorito_catalog.img' : No such file or directory

The part "No such file or directory" is a misleading bug in xorriso.
(The error number of a previous system call sneaked into the message.)
Correct is the part "File already exists on disk".

So better make sure your disk directory is empty before the xorriso run.

I hope this brings you back on track.

Have a nice day

Thomas