Tjyylli

I am trying to make my own Multiboot-USB-stick with a custom GRUB2 config. I basically followed instructions from https://wiki.archlinux.org/index.php/Multiboot_USB_drive to install GRUB2 on an USB stick in EFI mode:

• Format stick, having one EFI partition (100MB) and a EXT4 partition


• mount partitions to some location


• Executing grub-install --target=x86_64-efi --recheck --removable --efi-directory=/EFI_MOUNTPOINT --boot-directory=/DATA_MOUNTPOINT/boot
  

So I have an EFI-partition including a grub.cfg thats like

search.fs_uuid <uuid> root hdX,gptY 

set prefix=($root)'/boot/grub'

configfile $prefix/grub.cfg

and a boot-partition with just one folder /boot/grub containing

• fonts (folder)


• locale (folder)


• x86_64-efi (folder)


• grubenv (file)

This is working as far as I can write my own grub.cfg into /boot/grub, containing some menuentrys, and I can boot from that entries.
But I cant load any modules. If I enter command-line, e.g. typing

insmod ntfs

does absolutely nothing. There is no sort of error message or something, the module just doesnt get loaded (checked with lsmod). I also tried absolute addressing like

insmod (hdX,gptY)/boot/grub/x86_64-efi/ntfs.mod

with the same result. The path is correct because for example I can cat the .mod-file to standard output.

What I actually can do is to remove modules. E.g.

rmmod btrfs

rmmod btrfs

results in error message just at the second line, so module btrfs gets removed, which is confirmed by lsmod output. But typing (when btrfs already is removed)

insmod btrfs (or absolute addressing like above)

rmmod btrfs

results in an error message at line 2, so the first line obviously had no effect.

Do you have any idea whats going wrong? I even tried to copy the mod-folder to
the EFI-partition, but that didnt do the trick...

Thanks in advance

I have tried several different "multiboot USB" options. I like this one cause it is dynamic, all you have to do is add your ISO files and it will find the new ISO file and add it to the menu. No configuring the GRUB menu. I was have trouble with Linux Mint Debian Edition 3 and but it works with this one. You can always look at his scripts to see how it works.

Good Luck.

here is the site:

https://github.com/mpolitzer/grub-iso-multiboot

Ok, I just found out this is caused by Secure Boot. According to https://forums.opensuse.org/showthread.php/531587-is-GRUB-deliberately-broken-in-openSUSE

If secure-boot is enabled, then grub2-efi internally disables "insmod", so as to prevent secure-boot violations. And "grub2" has been loaded from "grub.efi" in your EFI partition, which already has preloaded the modules normally needed.
Additionally, "linux" is not allowed if secure-boot is enabled -- one must use "linuxefi" (which checks signatures).

And grub-install --help yields

--no-uefi-secure-boot:
do not install an image usable with UEFI Secure Boot, even if the system was currently started using it. This option is only available on EFI.

So if your current machine was started with Secure Boot, grub-install does install that version of GRUB and you cant insert any modules. Strangely enough in my case GRUB had a module "linux" loaded but no module "linuxefi"
. Anyway, here is my updated setup:

• Format stick, having one EFI partition (100MB) and a EXT4 partition (as data partition for everything not related to GRUB)


• Mount EFI partition


• Execute grub-install --target=x86_64-efi --recheck --removable --no-uefi-secure-boot --efi-directory=/EFI_MOUNTPOINT --boot-directory=/EFI_MOUNTPOINT/boot
  

I cant disable Secure Boot on my machine but mark .efi-files as secure. Using that setup (and marking /EFI/BOOT/BOOTX64.EFI as secure in computers EFI) was working for me and GRUB now is fully functional. Using --boot-directory=/DATA_MOUNTPOINT/boot like in my original setup caused GRUB to crash and enter rescue mode.

Considering how common Secure Boot nowadays is I find it pretty annoying to see this behavior is mentioned nowhere in the entire GRUB2 manual.

You can use Super UEFIinSecureBoot Disk which is specifically designed for this case. It contains modified bootloader which not only loads modules in Secure Boot mode, but also hijacks file verification functions to load arbitrary untrusted EFI files.