Do we need to rerun grub-install every time grub package is upgraded?

maximbaz · 2017-12-28 20:21:59

I've just configured a Secure Boot by signing the bootloader file `/boot/efi/EFI/arch/grubx64.efi`. This file is being generated by running a `$ grub-install` command - I ran it once when I installed the system.

I noticed that upgrading `grub` package doesn't rerun `$ grub-install`, and thus after the upgrade I still have the old `grubx64.efi` file which doesn't have to be re-signed. But isn't this wrong? Shouldn't we rerun `$ grub-install` every time a new version of grub is released?

I noticed that some guides on configuring Secure Boot use `cryptboot` tool that provides a `$ cryptboot upgrade` command, which basically runs `$ pacman -Syu` followed by `$ grub-install` regardless of what has been upgraded. This obviously installs grub way too often than needed.

I'm thinking to create an AUR package that would ship a pacman hook to run the commands below when grub package is upgraded, but I want to get some feedback first on whether my reasoning is correct and this is actually needed.

$ grub-mkconfig -o /boot/grub/grub.cfg
$ grub-install
$ command -v cryptboot-efikeys > /dev/null && cryptboot-efikeys sign /boot/efi/EFI/arch/grubx64.efi

heisenberg · 2017-12-28 20:32:51

I don't think that you need to replace that *.efi file each time you update the configuration (and neither when a newer grub release get's installed).

Last edited by heisenberg (2017-12-28 20:34:52)

maximbaz · 2017-12-28 20:39:05

That sounds good (since I don't need to spend time creating the pacman hook), but I'm curious - why do you think so? Isn't it possible that a new version of grub package might introduce some improvements or security fixes for the *.efi file?

WorMzy · 2017-12-28 20:44:30

Mod note: not an AUR Issue (unless I'm missing something?), moving to NC.

maximbaz · 2017-12-28 20:50:04

Thanks, I was not sure where to post it, chose this section because I am asking about the need to create an AUR package to solve the problem with rerunning grub-install - once I confirm that this is actually a problem that needs to be solved

heisenberg · 2017-12-28 20:52:00

maximbaz wrote:

That sounds good (since I don't need to spend time creating the pacman hook), but I'm curious - why do you think so? Isn't it possible that a new version of grub package might introduce some improvements or security fixes for the *.efi file?

It's unlikely IMHO, but I won't bet my car on anything I said, even above. Wait for an expert

loqs · 2017-12-28 21:05:13

Take a look at https://git.archlinux.org/svntogit/pack … 29f9f276f0 or https://git.archlinux.org/svntogit/pack … 61375f2e1b
If you are affected then you would need to update otherwise you could skip it. If you are being cautious then assuming each update does affect the system and should be applied
seems the safer approach to me however would not automating the signing mean you need to leave the private key without password protection?

maximbaz · 2017-12-28 22:26:52

Thanks, I tend to agree with the approach of being cautious and reinstalling grub on each upgrade - after all, all apps and tools on Arch are always of the latest version, except the grubx64.efi, which is generated once (during OS installation) and stays there forever, and I think people don't reinstall Arch very often so this file does grow old. Let's keep the thread open a little longer, I would be interested to hear others' feedback too.

Regarding the protection of the signing keys, the approach that I found and follow personally is to have /boot on a LUKS-encrypted partition and keep the keys in /boot/efikeys readable by root only, that way I can afford losing the password protection.

Arch Linux

#1 2017-12-28 20:21:59

Do we need to rerun grub-install every time grub package is upgraded?

#2 2017-12-28 20:32:51

Re: Do we need to rerun grub-install every time grub package is upgraded?

#3 2017-12-28 20:39:05

Re: Do we need to rerun grub-install every time grub package is upgraded?

#4 2017-12-28 20:44:30

Re: Do we need to rerun grub-install every time grub package is upgraded?

#5 2017-12-28 20:50:04

Re: Do we need to rerun grub-install every time grub package is upgraded?

#6 2017-12-28 20:52:00

Re: Do we need to rerun grub-install every time grub package is upgraded?

#7 2017-12-28 21:05:13

Re: Do we need to rerun grub-install every time grub package is upgraded?

#8 2017-12-28 22:26:52

Re: Do we need to rerun grub-install every time grub package is upgraded?

Board footer