Skip to content

Add cryptboot-grub-warning script #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add cryptboot-grub-warning script #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions PKGBUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ package() {
cd "$srcdir/$pkgname-$pkgver"
install -Dm755 cryptboot "$pkgdir/usr/bin/cryptboot"
install -Dm755 cryptboot-efikeys "$pkgdir/usr/bin/cryptboot-efikeys"
install -Dm755 cryptboot-grub-warning "$pkgdir/etc/cryptboot-grub-warning"
install -Dm644 cryptboot.conf "$pkgdir/etc/cryptboot.conf"
}

Expand Down
6 changes: 5 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,8 +66,12 @@ Installation
7. Unmount `/boot` partition and EFI System partition:

cryptboot umount

8. Optional: Install cryptboot-grub-warning script to raise an error if running `grub-install` directly instead of `cryptboot update-grub`:

8. Reboot your system, you should be completely secured against evil maid attacks from now on!
ln -s /etc/cryptboot-grub-warning /usr/local/bin/grub-install

9. Reboot your system, you should be completely secured against evil maid attacks from now on!

Usage
-----
Expand Down
2 changes: 1 addition & 1 deletion cryptboot
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@ case "$1" in
grub-mkconfig -o "$BOOT_DIR/grub/grub.cfg"

echo "Reinstalling GRUB to EFI System partition..."
grub-install --target=x86_64-efi --boot-directory="$BOOT_DIR" --efi-directory="$EFI_DIR" --bootloader-id="$EFI_ID_GRUB"
/usr/bin/grub-install --target=x86_64-efi --boot-directory="$BOOT_DIR" --efi-directory="$EFI_DIR" --bootloader-id="$EFI_ID_GRUB"

echo "Signing GRUB with UEFI Secure Boot keys..."
"$EFIKEYS_BIN" sign "$EFI_DIR/$EFI_PATH_GRUB"
Expand Down
10 changes: 10 additions & 0 deletions cryptboot-grub-warning
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
#!/bin/bash

# This file should be placed in your $PATH at a higher precedence than /usr/bin/grub-install (e.g. /usr/local/bin/grub-install)
# to ensure that we always run `cryptboot update-grub` to sign the bootloader after the bootloader file is updated.

red='\033[0;31m'
nc='\033[0m'

echo -e "${red}ERROR:\nRun 'cryptboot update-grub' instead of 'grub-install' to ensure bootloader is signed.\nFailure to sign the bootloader will cause subsequent Secure Boots to fail.${nc}"
exit 1