Details
-
Type:
Task
-
Status: Done
-
Priority:
(None)
-
Resolution: Fixed
-
Affects Version/s: None
-
Fix Version/s: Secure boot mender-convert/x86
-
Sprint:MEN Sprint 156, MEN Sprint 157, MEN Sprint 158
-
Story Points:21
-
Epic Link:
-
Backlog:yes
-
Days in progress:29
Description
mender-convert: Integrate with grub-mkconfig and grub-install
Integrate with both grub-mkconfig and grub-install when using mender-convert, so that running either will not break Mender. Having done some research on this, this is what I've found:
grub-mkconfig
grub-mkconfig makes the /boot/grub/grub.cfg file, which resides on each rootfs partition. This is good, since it allows the boot script to be updated with rootfs updates.
The main difficulty lies in getting the generation scripts, particularly /etc/grub.d/10_linux, to use the root devices that are set by Mender during the early detection of mender_boot_part. I managed to get the kernel root= argument set to a variable by setting these two variables in /etc/default/grub:
GRUB_DEVICE='$mender_boot_part' GRUB_DISABLE_LINUX_UUID=true
However, there are still some other references to root partitions that don't go through that mechanism. One possibility is to override the grub_probe function, which I've confirmed is possible. However, it's a fairly complex function, so we'd have to support all the arguments it takes.
grub-install
grub-install makes the /boot/efi/EFI/ubuntu/grub.cfg, which is a small stub which is supposed to chain load /boot/grub/grub.cfg. This one has been shown to be a bit problematic, since grub-install is a binary tool, which doesn't have a lot of customization. I think this one is going to be tricky, but maybe there is something that can be done with package triggers, that we can rewrite it after grub has been updated for example (see /usr/share/doc/dpkg-dev/triggers.txt.gz).
Or we could perhaps use triggers to replace the grub-install tool entirely, though that is slightly evil.
Conclusion
I'm cautiously optimistic that it's possible to achieve this without changing anything upstream, but it's by no means a guarantee, and more research is needed here. The story points are estimated based on us succeeding in doing this on our own, but this could grow if we find out that we have to patch upstream.