Enabling UEFI Secure Boot on your Platform

If you have not seen how to setup your own EFITOOL, please click this link (Howto?) and setup before coming to this post. It would make more sense once you have the EFITOOL compiled on your Linux OS.

1. Boot system to EFI Shell:

Go to BIOS setup menu

Select CSM -> Video to UEFI only. //If your screen blank out, try use direct Graphic cable without converter

Click Disable CSM mode

Save and reboot

Look for Secure Boot mode

Check what mode it is: 

If it is in User mode, go to Disable Auto Provisioning and Clear all existing keys.

Save and reboot.

Now it should report as Setup mode.

Boot to UEFI shell.

fs3:   //or what your USB drive initialized to

2. Run Lockdown.efi.

or
3. Now on your platform update the variables, remembering to do PK last because

an update to PK usually puts the platform into secure mode

UpdateVars db db.auth

UpdateVars KEK KEK.auth

UpdateVars PK PK.auth

And you should now be running in secure mode with your own keys.

How to compile EFITOOLS to 32bits instead of 64bits?

What is EFITOOLS?
This is an UEFI tool that able to help you to load your PK, KEK, DB keys into the Firmware and enabled Secure Boot on your Computer.
It is also able to help you create the Private and Public Keys of PK, KEK and DB.

Why Compile 32bits Version instead of 64bits?
When you want to boot 32bit OS, you'll need 32bit UEFI BIOS. Since you are running 32bit UEFI BIOS, you can only execute EFI or binaries that are compile for 32bit.

Steps to compile 32bit version of EFITools:

1) Requirement:
32bit OS(32bit version) 64bit OS (64bit version) Fedora /Ubuntu / Linux based OS
In our example we will use Fedora 32bit. You can use 64bit OS to compile for 32bit version, however, my guide does not include that.

2) Download required dependancy and libraries needed:

a) Get the GNU-EFI library:: CMD ::
           Method 1: sudo yum install gnu-efi
           Method 2: git clone https://github.com/vathpela/gnu-efi
                            cd into the directory
                            make
                            sudo make install
                         
b) Get the sbsigntool ::CMD ::
          Method 1: git clone https://github.com/wmarone/sbsigntool
                           cd into the directory
                           ./autogen.sh
                           ./configure          //Notice, they might be some dependency missing, need installation
                           make
                           sudo make install

c) Get some libraries needed
           sudo yum install pkgconfig
           sudo yum install perl-CPAN
           sudo yum install perl-File-Slurp
           sudo yum install help2man

3) Above are similar across 32bits version and 64bits version, however, below will be 32bit focus only.

     There will be an error in the lib/security_policy.c as there are asm code in the security policy and so far I can't find a workaround for it.

        vim lib/Makefile

        Delete the security_policy.o from the FILES = line

        Add the bolded two lines

        clean:

        rm -f lib.a

        rm -f $(LIBFILES)

        rm -f lib-efi.a

        rm -f $(EFILIBFILES)

         vim Makefile

         Delete the PreLoader.efi from the EFIFILES = line, as this file required the security_policy.c library

4) Compile all the necessary files by doing make

         make clean && make 

         //It should complete with no error and undefine symbols

5) Now create a USB drive image:

        ./mkusb * * usb_drive_image.img

6) Open the System in Fedora application and plug in a USB pendrive

    Click Restore Image on the drive and select the usb_drive_image.img

Congratulation, you have successfully created your own signed application with PK, KEK, DB keys.

Next - > See Enabling UEFI Secure Boot on your Platform

Missing gnu-efi

Error when include -lgnu-efi library?

To do any EFI compilation, you'll need the gnu-efi library installed.

1. git clone https://github.com/vathpela/gnu-efi
2. cd into the directory
3. make
4. sudo make install

or better if you using Fedora
1. sudo yum install gnu-efi


After all that, check in the directory /usr/local/lib, ensure the libefi.a and libgnuefi.a is there.
If not, when you compile using the string -lgnu-efi and -lefi, it'll complain library not found.

How to install and git openssl?

Need to generate Public and Private key?
Do some encryption?

First you need to install Openssl!!

1. git clone https://github.com/openssl/openssl
2. cd to the new directory created
• view (vi) INSTALL (For instruction how to install)
3. Basically command needed is:
• ./config
• make
• make test
• make install

If you encounter issue when installing sbsigntool in the next step that:

Probably you need to do the following as well:

• sudo yum install openssl-devel-1.0.0i-1.fc17.i686

If got error on libcrypto not found:

Check using: pkg-config --libs libcrypto

• Good Result: -lcrypto
• Bad Result -
  Package libcrypto was not found in the pkg-config search path.
  Perhaps you should add the directory containing `libcrypto.pc' to the PKG_CONFIG_PATH environment variable
  No package 'libcrypto' found

Solution:

• Try CMD: locate libcrypto
• Need to have: 
• /usr/local/ssl/lib/libcrypto.a
• /usr/local/ssl/lib/pkgconfig/libcrypto.pc
• /usr/lib64/pkgconfig/libcrypto.pc
• /usr/lib64/libcrypto.so
• /usr/lib/libcrypto.so

     

How to compile your own Grub

How to get and build/compile your own GRUB?

First, get the GRUB from the GNU site:
ftp://ftp.gnu.org/gnu/grub/grub-2.00.tar.gz

Then copy to your linux machine and unzip it:

1. zcat grub-2.00.tar.gz | tar -xvf -cd grub-2.00/
2. cd grub-2.00/
3. ./configure
• Here will require to install those missing package
• FEDORA: sudo yum install <pkg> 
• i.e. bison, flex and more
4. After configure passes all criteria
5. make install

How to get a GRUB.efi for UEFI Shell launch

1. sudo yum install grub-efi
2. Copy grub file from: /boot/efi/EFI/redhat/grub.efi

How to use dos2unix, with example for the whole folder

If you always copy files from Window OS to Linux Based OS, and do compilation, you will always hit into this issue.
Where some weird error would occur, and it might complaint some weird symbol or text.

This is because when you copy from Window to Linux, the file format might not changed, depends on which tools you used to do the transfer.

Best way to ensure not to encounter any strange or weird issue due to Window file's format. Do the following command after you have FTP or copied the files over.

find . -type f -exec dos2unix {} \;

This will do recursive conversion of everything in the current folder and all its sub-folders.

If you just want to convert specific folders only. Replace the <folder> with your folder's name. Example below:

find <folder> -type f -exec dos2unix {} \;

i.e.  find myfolder -type f -exec dos2unix {} \;

That's it. Happy Coding.