diff mbox series

[1/1] boot/grub2: Add disable shim lock config option

Message ID 20250111191324.4615-1-dev@matt-silva.com
State New
Headers show
Series [1/1] boot/grub2: Add disable shim lock config option | expand

Commit Message

Matt Silva Jan. 11, 2025, 7:13 p.m. UTC 
When using Secure Boot without SHIM, grub2 can run into issues where it
is expecting SHIM to be present, resulting in a "shim_lock protocol not
found" error. This can be fixed by passing the `--disable-shim-lock`
flag to `grub-mkimage`.

See https://www.gnu.org/software/grub/manual/grub/html_node/UEFI-secure-boot-and-shim.html

Signed-off-by: Matt Silva <dev@matt-silva.com>
---
 boot/grub2/Config.in | 6 ++++++
 boot/grub2/grub2.mk  | 2 ++
 2 files changed, 8 insertions(+)
diff mbox series

Patch

diff --git a/boot/grub2/Config.in b/boot/grub2/Config.in
index e1f2fc105e..44dcbae881 100644
--- a/boot/grub2/Config.in
+++ b/boot/grub2/Config.in
@@ -160,6 +160,12 @@  config BR2_TARGET_GRUB2_BUILTIN_CONFIG_EFI
 	  device and other configuration parameters, but however menu
 	  entries cannot be described in this embedded configuration.
 
+config BR2_TARGET_GRUB2_DISABLE_SHIM_LOCK
+	bool "disable shim lock"
+	depends on !BR2_TARGET_SHIM
+	help
+	  Disable shim lock verifier
+
 endif # BR2_TARGET_GRUB2_HAS_EFI_BOOT
 
 config BR2_TARGET_GRUB2_INSTALL_TOOLS
diff --git a/boot/grub2/grub2.mk b/boot/grub2/grub2.mk
index 0896029322..1bb9904686 100644
--- a/boot/grub2/grub2.mk
+++ b/boot/grub2/grub2.mk
@@ -183,6 +183,8 @@  define GRUB2_INSTALL_IMAGES_CMDS
 			-p "$(GRUB2_PREFIX_$(tuple))" \
 			$(if $(GRUB2_BUILTIN_CONFIG_$(tuple)), \
 				-c $(GRUB2_BUILTIN_CONFIG_$(tuple))) \
+			$(if $(BR2_TARGET_GRUB2_DISABLE_SHIM_LOCK), \
+				--disable-shim-lock) \
 			$(GRUB2_BUILTIN_MODULES_$(tuple))
 		$(INSTALL) -D -m 0644 boot/grub2/grub.cfg $(GRUB2_CFG_$(tuple))
 		$(if $(findstring $(GRUB2_PLATFORM_$(tuple)), pc), \