Grub2 | Secure Boot Bypass and other issues - Update highly recommended

[omano]

Yes you can use any Manjaro ISO in theory. They should all have the manjaro-chroot tool.

[pheiduck]

That’s the point if the Bug is only physical exploitable I think it’s wasted time to reinstall grub?

Btw I use LUKS on my workstation

[annoying_daniel]

My philosophy is that if there’s an update available to a component of my system, then I’ll update it. Maybe that’s why I’ve found myself being on the unstable branch for so long.

[openminded]

You are absolutely right. My goal was to make a stress on certain points.

[linub]

thanks,that’ll save me some download time and bandwidth,
but after reading this thread i think I’ll pass for the moment since i don’t dual boot and in order to install Manjaro i had to disable secure boot anyway.

[michaldybczak]

@omano

My 2 cents: Having the default to NOT ENABLE OS Prober by default is wrong. Manjaro should continue to have OS Prober enabled by default, and make sure an update doesn’t remove a feature that people will need to search for and/or complain about.

If you dual boot with Manjaro, you do not want your access to Windows removed because of an update. This was not properly managed in my opinion.

I still don’t see the connection with the fixed vulnerabilities in GRUB, and the fact that all dual booting users now require to edit their GRUB config and update GRUB to have their other OS showing in GRUB. I don’t understand why the default is now to have OS Prober disabled in GRUB.

My thoughts exactly!

[robin0800]

0001-templates-Properly-disable-the-os-prober-by-default.patch · master ·...

this is part of the commit

Disable os-prober by default due to security reasons.

+GRUB_DISABLE_OS_PROBER="true"

No idea what the security reasons are?

[pheiduck]

Reinstall grub was very easy on my System LUKS / BTRFS:

Need only these 3 steps in Live Env:

~$ su
root:~/ # grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=manjaro --recheck
root:~/ # update-grub
root:~/ # reboot

[omano]

I understand they did it on purpose, but why this doesn’t make sense to me. I’m not a dev OK, but I can’t find a reason to have it disabled by default for security reason, especially if now the reasons are fixed. Maybe a Manjaro staff have more explanation but to me it is wrong.

[rodries]

I cannot access to the page.
Private?

[openminded]

@omano

If he listens he now has no access to his Windows 7 installation, and I will need to go back to fix it

You think he is not able to install Chrome remote desktop or TeamViewer even if you text him how to do it?

[annoying_daniel]

You may want to edit your post a bit more as there’s more items than those 3 steps…especially for a beginner to follow along to. My post was only for self-reference sake as it’s specific to my setup and wasn’t really intended to be copied and pasted by anyone…

Again methinks that a separate thread should be dedicated to it hint hint mods

[omano]

Everything is possible I can even tell him command to write over the phone. He’s 70+ though and not very computer savy. That’s not ideal. Anyway not really the point, it was just one example and there are a lot of people like that.

[openminded]

@omano

this doesn’t make sense to me. I’m not a dev OK, but I can’t find a reason to have it disabled by default for security reason, especially if now the reasons are fixed

Don’t disregard mailing lists, everyone:
https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00120.html

[omano]

I plead guilty, I avoid mailing lists usually Thanks for providing more infos

[realmain]

@pheiduck

Reinstall grub was very easy on my System LUKS / BTRFS:

Need only these 3 steps in Live Env:

~$ su
root:~/ # grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=manjaro --recheck
root:~/ # update-grub
root:~/ # reboot

There are more steps than this

https://wiki.manjaro.org/index.php?title=GRUB/Restore_the_GRUB_Bootloader

[CarlLaFong]

To explain my confusion another way…

I thought the chroot step to install grub was only for users without current access to their Manjaro installation because grub was broken, and a Live CD was needed in order to “hack” into your own computer to fix grub on that machine?

Otherwise grub just needed to be re-installed and updated as root on a working system?

[robin0800]

Saw this from https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00120.html

Currently autogenerating config files for multi-boot environments depends on
-os-prober and has several shortcomings. While fixing it is scheduled for the
-next release

[michaldybczak]

@openminded

New grub = no os-prober by default → no detection of other OSes → Manjaro Grub thinks there’s only Manjaro installed → no Grub menu shown in accordance with “silent Grub” concept. Enabling os-prober makes Grub menu visible just because now it knows there’s also Windows installed.

Another thing that doesn’t make sense here at all is that without os-prober I didn’t even get proper GRUB. So there was no access to GRUB options, different kernels, firmware, emergency mode (whatever it is called) and so on. This all looked like a bug, all black and the small peak window with “Welcome to Grub” and nothing else, nothing actionable. My guess is, those things were there but not visible.

So how did the GRUB look like for you when this new default was on?

For me, it wasn’t just lack of the Windows options, it was simply LACK OF THE WHOLE GRUB OPTIONS. This went horribly wrong. Luckily, restoring os-prober fixed everything. So why without os-prober GRUB didn’t work correctly?

So far it looks we gave some very, very, very wide stretched security threat, almost none existent for most users, as it requires physical access to it and the “fix” that broke user space without warning. It’s like a classical case of fixing a tiny issue by creating a huge one for most users.

I’m a bit worried that Manjaro devs are mostly silent about this. I just hope they are gathering data till they take voice in this matter.

At the moment, the topic here feels like an irony. First, on a rolling release we have no choice, so calling for the update is unnecessary. Second, the update will most likely mess with brake user-space, because dual boots are a common thing, plus the lack of GRUB options like in my case.
The topic should be: URGENT MANUAL INTERVENTION AFTER GRUB UPDATE. So users could get acquainted with the topic and decide what to do and possibly fix GRUB by restoring old behavior, because the computer won’t work correctly without it.

[Falav]

If new grub version was set to hidden, it’s hidden… So black screen until system boots.