Page 1 of 1

[SOLVED] How to install linux to USB that will boot in BIOS or UEFI without disabling secure boot

Posted: Sun Jan 12, 2020 5:48 pm
by esaphire3
I am just starting out using Linux and I would like to set up Linux installed on a USB that will be able to boot in bios or uefi without having to disable secure boot. I have seen in a tutorial from pbear viewtopic.php?f=42&t=287353 a method of doing it that requires secure boot to be disabled.
Later down in the comments he says that there is a method for doing it with secure boot, but that you have to manually add some files to the bootloader afterwards.
see post viewtopic.php?p=1732864#p1732864
would anyone be able to give me a clearer explanation how to add those missing files after i install GRUB? I don't fully understand what he is saying to do.

(edit: 3/12 changed to solved and fixed links.)

Re: How to install linux to USB that will boot in BIOS or UEFI without disabling secure boot

Posted: Mon Jan 13, 2020 3:35 am
by pbear
There's a reason I didn't elaborate on this option. It's complicated and not something I actually recommend. Also, I did the original exercise as proof of concept only, without attempting to formulate a comprehensive straight line installation method.

As a courtesy, I tried this evening to reproduce what I did a couple weeks ago. In the process, I bumped up against a problem I've always worked around, which is that one can't install third party software with secure boot enabled. Turns out, using the procedure specified in the installer mucked up my secure boot settings - maybe a bug in the installer, maybe a bug in my UEFI implementation - such that I'm now unable to boot in UEFI the USB drive I created two weeks ago (worked then), nor a freshly-created live ISO. Curiously, I have the problem even with secure boot disabled; only my old hybrid drives will boot in UEFI. Pretty annoying, actually, and a good demonstration of why disabling secure boot is widely recommended.

ETA: Following up, I was able to fix secure boot by reflashing the firmware. With that, the live ISO boots again and so do both secure-boot USB drives I've created (yesterday's and the one from two weeks ago). AFAICT, the problem is that the installer attempted to use MokManager to temporarily disable secure boot, but that went sideways for reasons unknown. On boot, I got an error, "Failed to open \EFI\BOOT\mmx64.efi ... Failed to load image ... Failed to start MokManager ... Something has gone seriously wrong [you think?] ... import_mok_state() failed." Did some research but wasn't making any headway, so went with the quick-and-dirty reflash solution instead. In retrospect, the easiest way to avoid this problem probably would be to disable secure boot in the firmware while doing the installation, then re-enable when done.

Having come this far, I will elaborate on two points. First, as mentioned, if installing in UEFI, the target will be missing a subdirectory for installation of the BIOS bootloader. Originally, I solved that problem by copying the subdirectory from a hybrid boot USB already at hand. This evening, I notice the subdirectory also can be copied from the live ISO. Open File Manager; right-click somewhere blank (i.e., not a file) and select Open as Administrator; from Menu, select View > Extra Pane. In each pane, navigate to /usr/lib/grub, live ISO on the left and target USB on the right; right-click i386-pc in the left pane and select copy to other pane. Close both sessions of File Manager (as administator and as regular user).

Second, for actual installation of the BIOS bootloader, I used something called chroot. I'm not going to try to explain that here. For the time being, just copy these commands one line at a time (use copy and paste). In Terminal in the live session:

Code: Select all

$ sudo mount /dev/sdc3 /mnt # mount root
$ for i in /dev /dev/pts /proc /sys; do sudo mount -B $i /mnt$i; done
$ sudo chroot /mnt
# grub-install /dev/sdc --target=i386-pc
# update-grub
# exit
$ for i in /sys /proc /dev/pts /dev; do sudo umount /mnt$i; done
$ sudo umount /mnt
For context, I assume sdc1 is the BIOS boot partition, sdc2 is the EFI partition and sdc3 is the root partition. Ironically, my UEFI secure boot mishap notwithstanding, the BIOS bootloader installed without a hitch, which I was able to confirm on my BIOS laptop.

Don't know whether that's enough to get you over the hump, but it's what I've got. Frankly, the simpler solution would be to let go of secure boot.

Re: How to install linux to USB that will boot in BIOS or UEFI without disabling secure boot

Posted: Tue Jan 14, 2020 12:23 am
by esaphire3
Thank you I will try it when I have time and post back what happens.
Just to be clear, I will need to set up two boot partitions, one for BIOS and one for UEFI, and I should put the BIOS partition at the beginning before the UEFI partition? I'm assuming I should make it the same size as the UEFI partition? Also with the flags do I need to set flags on the BIOS boot partition?

The reason I want it installed with
secure boot is mainly to be able to use it in any computer any where without having to get into the boot setting to disable secure boot, as often times you will will find a computer with the boot settings locked but USB boot still enabled. Additionally, even if USB boot is disabled, there is a simple workaround to go through Windows and set it to boot from a USB on the restart, but that will not work unless the USB is compatible with secure boot.

Re: How to install linux to USB that will boot in BIOS or UEFI without disabling secure boot

Posted: Tue Jan 14, 2020 3:21 am
by pbear
For partitions and flags, see the original Hybrid Install instructions. For installation in UEFI, see the original Unflag/Reflag instructions; use the Something Else method. It's from there, after installation and still booted in the live session, that you install the BIOS bootloader.

You've decided to tackle something difficult. If you want it to work, you're going to have to do some work.

As for secure boot, no-USB-boot is default everywhere and not waivable in any enterprise environment I've seen. You're expected to carry your own computer.
Family and friends generally will let you change boot order, but they'll also let you modify secure boot. You just want this cuz it sounds cool. Knock yourself out.

Re: How to install linux to USB that will boot in BIOS or UEFI without disabling secure boot

Posted: Tue Jan 14, 2020 6:30 pm
by esaphire3
Figured as such but just wanted to confirm before trying it and finding out that I wasted my time.
I wasted much time trying to get it installed correctly on a USB before I found your tutorial. I have some previous experience with Linux, but until now I was only using it live and decided that it's finally time to make an install, I ran into that UEFI bug and felt like I was banging my head against a brick wall until I came across your tutorial.
I also had another slight bug while installing it of not getting option to install to external drive, (see my post viewtopic.php?p=1742102#p1742102)it seems to be I'm not the only to have had such an issue.

Re: How to install linux to USB that will boot in BIOS or UEFI without disabling secure boot

Posted: Tue Jan 14, 2020 6:46 pm
by esaphire3
pbear wrote:As for secure boot, no-USB-boot is default everywhere and not waivable in any enterprise environment I've seen. You're expected to carry your own computer.
Family and friends generally will let you change boot order, but they'll also let you modify secure boot. You just want this cuz it sounds cool. Knock yourself out.
I am in this as a hobby in my spare time, and yes, everything about Linux is cool.
I do happen to have a specific reason why I want it to be bootable in BIOS or UEFI without disabling secure boot.
I wrote previously that there is a workaround in the event that USB boot is disabled and the BIOS is locked.
You boot into windows, and then select restart while holding down the shift key, and it should give you the option to boot from USB on the restart, as far as I know this works even if USB boot is disabled in the BIOS, as it is not using whatever bootloader is installed on your USB rather it is doing it thru the windows boot manager. However, windows will usually only detect the OS on the USB, and give you the option to boot from it, if the USB is compatible with secure boot.

Re: How to install linux to USB that will boot in BIOS or UEFI without disabling secure boot

Posted: Wed Jan 29, 2020 3:46 pm
by esaphire3
I installed it as per your instructions and it works beautifully. Thanks.

Re: How to install linux to USB that will boot in BIOS or UEFI without disabling secure boot

Posted: Wed Jan 29, 2020 4:16 pm
by pbear
Well done and you're welcome. Happy Minting!