Arch Linux

dbear496

Member

Registered: 2022-05-23

Posts: 8

GRUB hangs if pgp module is loaded

I am trying to setup secure boot, and recent versions of grub evidently require a verifier for loading modules when in secure boot. (I suppose this makes sense because otherwise an attacker could load malicious code if they manage to get to the grub shell.) Unfortunately, the pgp verifier module causes grub to hang: after decrypting /boot, it prints `slot "0" opened` and immediately hangs.

I happened to find that if I include the normal module in the --modules list in grub-install, then I get dropped to the grub shell instead of having it hang. But then using insmod causes it to hang, and using the normal command just restarts the grub shell.

This is the grub-install command I used:

grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=GRUB --pubkey=/root/grub.pub --modules="tpm pgp" --disable-shim-lock

I created detached signatures for /boot/vmlinuz-linux and all the modules in /boot/grub/x86_64-efi/ with a rsa2048 signing key for which the public key is /root/grub.pub. I double-checked the signatures with gpg verify, and they're all good.

I am guessing that the pgp verifier itself is hanging when it tries to verify the signature, but I'm not sure why. By this point, I've gotten quite handy at booting from a recovery USB drive.

I have grub version 2:2.14-1 if it matters

Last edited by dbear496 (Yesterday 06:15:22)

-thc

Member

Registered: 2017-03-15

Posts: 1,159

Re: GRUB hangs if pgp module is loaded

How did you arrive at that grub-install command?

I use the command for "measured boot":

grub-install --target=x86_64-efi --efi-directory=/efi --bootloader-id=arch --modules="tpm" --disable-shim-lock /dev/nvme0n1

This requires a "secure-boot-signed" grub EFI executable and signed kernel but checks no modules.

If you want the GPG variant you have to include all modules needed for that. For example:

grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=GRUB --disable-shim-lock --pubkey=/root/grub.pub --modules="pgp gcry_sha512 gcry_dsa"

BTW: The standard Arch linux kernel only supports ECDSA keys (see /proc/config.gz)

Last edited by -thc (Yesterday 07:49:40)

dbear496

Member

Registered: 2022-05-23

Posts: 8

Re: GRUB hangs if pgp module is loaded

I arrived at that grub-install from here because I don't want to use shim-lock. I added the pgp module per this thread.

If you want the GPG variant you have to include all modules needed for that.

I added the gcry_sha512, gcry_dsa, and gcry_rsa modules, and this fixes the hanging issue. But now it dumps me onto a grub shell, and running `normal` just restarts the shell.

BTW: The standard Arch linux kernel only supports ECDSA keys (see /proc/config.gz)

What exactly am I looking for in /proc/config.gz? I don't understand how kernel crypto support would affect which algorithms I can use in grub. The last comment on this thread (by an Arch user) says that grub only supports RSA. The grub source says that RSA and DSA are supported (and not ECDSA).

-thc

Member

Registered: 2017-03-15

Posts: 1,159

Re: GRUB hangs if pgp module is loaded

What exactly am I looking for in /proc/config.gz? I don't understand how kernel crypto support would affect which algorithms I can use in grub. The last comment on this thread (by an Arch user) says that grub only supports RSA. The grub source says that RSA and DSA are supported (and not ECDSA).

My bad - my eyes slid down to a different method. Looking inside config.gz you would've found:

#
# Certificates for signature checking
#
CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
# CONFIG_MODULE_SIG_KEY_TYPE_RSA is not set
CONFIG_MODULE_SIG_KEY_TYPE_ECDSA=y

But that's irrelevant for GRUB.

But now it dumps me onto a grub shell, and running `normal` just restarts the shell.

AFAIK every file GRUB touches must be signed - even the fonts and the config data (grub.cfg).

dbear496

Member

Registered: 2022-05-23

Posts: 8

Re: GRUB hangs if pgp module is loaded

But now it dumps me onto a grub shell, and running `normal` just restarts the shell.

AFAIK every file GRUB touches must be signed - even the fonts and the config data (grub.cfg).

Okay,

find /boot -path /boot/efi -prune -o -type f -not -name *.sig -exec gpg -u grub --yes --detach-sign '{}' \;

fixed it! Thanks for the help.

Though it would be really nice if it would inform me when a file fails verification (and which file failed) instead of silently doing nothing. When a random file in /boot inevitably gets updated, I'd rather not be left scratching my head at the grub shell.

Last edited by dbear496 (Yesterday 13:54:03)

-thc

Member

Registered: 2017-03-15

Posts: 1,159

Re: GRUB hangs if pgp module is loaded

When a random file in /boot inevitably gets updated, I'd rather not be left scratching my head at the grub shell.

That was the reason I scrapped the idea of using the GPG method.