Skip to content

Instantly share code, notes, and snippets.

@leomp12
Last active January 26, 2019 08:57
Show Gist options
  • Select an option

  • Save leomp12/2b9b823100628438c72fe7563c6ed25e to your computer and use it in GitHub Desktop.

Select an option

Save leomp12/2b9b823100628438c72fe7563c6ed25e to your computer and use it in GitHub Desktop.
Syslinux (Arch) UEFI direct secure boot

Based on Arch Wiki:

I was trying to boot directly to Arch (with no boot manager menu) with UEFI and Secure Boot, systemd-boot doesn't worked because the boot partition was not with the correct UUID and formatting the disk does not appears to be a great solution (rs).

SYSLINUX worked out of the box with PreLoader!

On following sample I've considered that ESP is mounted at /boot and we have a Intel Core processor and Intel Graphics GPU (my laptop case).


Install syslinux package (if not installed) and setup for UEFI:

# mkdir -p /boot/EFI/syslinux
# cp -r /usr/lib/syslinux/efi64/* /boot/EFI/syslinux

Install preloader-signed package for secure boot, then copy EFI files:

# cp /usr/share/preloader-signed/{PreLoader,HashTool}.efi /boot/EFI/syslinux

Copy syslinux.efi default file to loader.efi and create UEFI boot entry:

# cp /boot/EFI/syslinux/syslinux.efi /boot/EFI/syslinux/loader.efi
# efibootmgr --verbose --disk /dev/sdX --part Y --create --label "Syslinux Secure Boot" --loader /EFI/syslinux/PreLoader.efi

As documented by Rodsbooks' Secure Boot, at the first boot with Secure Boot enabled:

  1. "PreLoader should launch, but it will probably complain that it couldn't launch loader.efi. It will then launch HashTool, which is the program that PreLoader uses to store information (hashes) on the programs you authorize."
  2. "In HashTool, select the Enroll Hash option."
  3. Browse to EFI/syslinux and select the loader.efi program file. HashTool asks for confirmation; respond Yes.
  4. Repeat for syslinux.efi and vmlinuz-linux (browse back to root dir) kernel file.
PROMPT 0
TIMEOUT 0
DEFAULT arch
LABEL arch
LINUX ../../vmlinuz-linux
APPEND root=/dev/sdXpW rw resume=/dev/sdXpZ quiet splash i915.enable_fbc=1 i915.fastboot=1
INITRD ../../intel-ucode.img,../../initramfs-linux.img
LABEL poweroff
COM32 poweroff.c32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment