16

If I use GRUB 2 on a GPT-enabled partition, how does the loader "know" where to find its configuration file and other second stage's files?

Note: I found some mentions about a configuration file which is located in the same folder as GRUB's EFI loader and contains a chained load of "primary" configuration file from the specified partition, but that definitely is not true; there is only one "something.efi" file.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
Sap
  • 914
  • 1
  • 6
  • 20

2 Answers2

14

There are actual several ways this can happen:

  • Load an embedded configuration file.
  • Load a configuration file in the same directory as the GRUB binary.
  • Load a configuration file from a path decided at grub-mkimage (called by grub-install) execution time.

The latter is probably the functionality you are really asking for, and it's a combination of the default configuration file name (grub.cfg), the prefix (default /boot/grub, but it can be explicitly specified to grub-mkimage) and the GRUB partition name for the partition where the prefix is located.

If I run strings /boot/efi/EFI/debian/grubx64.efi | tail -1 on my current workstation, it prints out the stored value: (,gpt2)/boot/grub, telling grubx64.efi to look for its configuration file in /boot/grub on GPT partition 2. The bit before the comma (the GRUB disk device name) gets filled in at runtime based on which disk the grubx64.efi image itself was loaded from.

Dynamically loaded modules will also be searched for under this location, but in an architecture/platform-specific directory - in this case /boot/grub/x86_64-efi.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
unixsmurf
  • 5,852
  • 1
  • 33
  • 40
  • So they make (patch) a now unique loader executable for every installation. But how can they sign it for secure boot in this case? – Sap Feb 09 '16 at 00:10
  • And they also can only use GPT partition indexes, not UIDs. But the indexes aren't constant for GPT. GPT has partition UIDs for such purposes. – Sap Feb 09 '16 at 00:19
  • All Linux distros that support UEFI Secure Boot ship with a utility called "shim", which is itself signed with a key held by UEFI, and in turn manages a local keystore. https://github.com/mjg59/shim No comment on the GPT index really, other than I guess since the expected workflow is to re-run grub-install if you change your partitioning, that would still get resolved. It works the same regardless of partitioning scheme. – unixsmurf Feb 09 '16 at 10:12
  • Secure Boot-signed UEFI GRUB binaries will usually have their prefixes set to just `/efi/`, using the run-time default values for the disk and partition - and those default values are "whatever disk and partition the `grubx64.efi` was loaded from". – telcoM Nov 27 '21 at 12:33
3

For an EFI image, I found that grub-install or grub-mkimage will always embed an early configuration into the resulting EFI binary, regardless of whether or not you have specified the --config FILE option.

If you do not specify the --config FILE option, it will try to embed /boot/grub/x86-64_efi/load.cfg.

This early configuration file looks like this:

search.fs_uuid 8ef704aa-041d-443c-8ce6-71ac7e7f30da root hd0,gpt1
set prefix=($root)'/boot/grub'
configfile $prefix/grub.cfg  # This line seems can be omitted, because
                             # it seems to be the default next action
  • The uuid means the UUID of the file system, not of partition. You can use blkid to list it.
  • The hd0,gpt1 is just a hint.
  • You can change the first line into set root=hd0,gpt1

This default behavior of auto embedding is different from BIOS mode. The latter by default only embeds a prefix string like (,gpt3)/boot without bothering with search.uuid.

I also found that the Ubuntu 18.04 (Bionic Beaver) EFI image embedded an early configuration like build-efi-images

if [ -z "\$prefix" -o ! -e "\$prefix" ]; then
    if ! search --file --set=root /.disk/info; then
        search --file --set=root /.disk/mini-info
    fi
    set prefix=(\$root)/boot/grub
fi
if [ -e \$prefix/$platform/grub.cfg ]; then
    source \$prefix/$platform/grub.cfg
elif [ -e \$prefix/grub.cfg ]; then
    source \$prefix/grub.cfg
else
    source \$cmdpath/grub.cfg
fi

The cmdpath is the directory of the EFI binary, so it will fall back to the grub.cfg file in the same directory of the EFI binary, as you found.

Peter Mortensen
  • 30,738
  • 21
  • 105
  • 131
osexp2000
  • 2,910
  • 30
  • 29