Strange Error Message Issued Before Display of Themed Grub Menu

[Stephen Morris]

Hi,
     I am getting the following error message displayed before the 
display of the grub boot menu, can someone explain to me what this means 
and why it is occurring in F37 when it was never produced in F36, and 
what I need to do to rectify it?

                 error: ../../grub-core/kern/efi/sb.c:169:prohibited by 
secure boot policy

regards,
Steve

[stan]

On Mon, 21 Nov 2022 18:54:49 +1100
Stephen Morris <samorris(a)netspace.net.au&gt; wrote:

>  Hi,
>       I am getting the following error message displayed before the 
>  display of the grub boot menu, can someone explain to me what this
>  means and why it is occurring in F37 when it was never produced in
>  F36, and what I need to do to rectify it?
>  
>                   error: ../../grub-core/kern/efi/sb.c:169:prohibited
>  by secure boot policy 
I am running f37 and have nothing like sb.c or grub-core on my system.
I am guessing that those are some customization that you have installed
yourself?  If so, my thought would be that the efi boot process
security has been tightened, and that those are not included in the
allowed boot policy.  There seems to be an initiative to tighten the
efi boot procedure so that it is verifiably unalterable from repo to
the running system.  This includes writing a 'measure' for all involved
files and ensuring they pass a check of that 'measure' before they are
used.  I don't know how far this initiative has progressed, but you
might be seeing some fallout from that.

[Stephen Morris]

On 22/11/22 02:25, stan via users wrote:
>  On Mon, 21 Nov 2022 18:54:49 +1100
>  Stephen Morris <samorris(a)netspace.net.au&gt; wrote:
>
> > Hi,
> >       I am getting the following error message displayed before the
> > display of the grub boot menu, can someone explain to me what this
> > means and why it is occurring in F37 when it was never produced in
> > F36, and what I need to do to rectify it?
> >
> >                   error: ../../grub-core/kern/efi/sb.c:169:prohibited
> > by secure boot policy
>  I am running f37 and have nothing like sb.c or grub-core on my system.
>  I am guessing that those are some customization that you have installed
>  yourself?  If so, my thought would be that the efi boot process
>  security has been tightened, and that those are not included in the
>  allowed boot policy.  There seems to be an initiative to tighten the
>  efi boot procedure so that it is verifiably unalterable from repo to
>  the running system.  This includes writing a 'measure' for all involved
>  files and ensuring they pass a check of that 'measure' before they are
>  used.  I don't know how far this initiative has progressed, but you
>  might be seeing some fallout from that. 
Those are not things I have installed
myself as far as I am aware, they 
are a standard part of the grub environment installed as part of the 
fedora environment install.
 From what I can see on the net this error is not unusual in Fedora and 
Ubuntu and seems to be related to signing keys not being in the secure 
boot shim, but I haven't found detailed instructions on how to get them 
in there for grub, I've got detailed instructions for the akmod nvidia 
drivers on how to rectify the secure boot issues with compiling those. 
 From what I can see around this issue on the net, around logic that is 
in that code, I would be guessing that sb.c is something that is 
installed in systems where full secureboot is active, as there seemed to 
be specifications in there on thing that were and weren't allowed in 
secure boot, but I didn't understand what linux components were being 
referenced by that logic.
These issues seem to be tied to the fact that F37 is now booting with 
Grub and not with what F36 was booting with (possibly systemd?), and in 
F37 the grub-gfxmode statement in /etc/default/grub that worked fine in 
F36 does not work in F37 even though the associated statements are added 
to grub.cfg, they seem to be being ignored (I'm thinking about raising 
another thread on this issue).

regards,
Steve
>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[stan]

On Tue, 22 Nov 2022 09:12:00 +1100
Stephen Morris <samorris(a)netspace.net.au&gt; wrote:

>  > On Mon, 21 Nov 2022 18:54:49 +1100
>  > Stephen Morris <samorris(a)netspace.net.au&gt; wrote:
>  >  
>  >> Hi,
>  >>       I am getting the following error message displayed before the
>  >> display of the grub boot menu, can someone explain to me what this
>  >> means and why it is occurring in F37 when it was never produced in
>  >> F36, and what I need to do to rectify it?
>  >>
>  >>                   error:
>  >> ../../grub-core/kern/efi/sb.c:169:prohibited by secure boot policy
>  >>   
[snip]
>  These issues seem to be tied to the fact that F37 is now booting with
>
>  Grub and not with what F36 was booting with (possibly systemd?), and
>  in F37 the grub-gfxmode statement in /etc/default/grub that worked
>  fine in F36 does not work in F37 even though the associated
>  statements are added to grub.cfg, they seem to be being ignored (I'm
>  thinking about raising another thread on this issue). 
I think you are correct that this is related to the changes to grub
boot.  I did a search, and the only relevant thing I came up with for
sb.c was:

https://elixir.bootlin.com/linux/latest/source/fs/ubifs/sb.c

It has something to do with writing architecture to the disk.

The relevant link for grub-core seems to be

https://ask.fedoraproject.org/t/grub-core-error-you-need-to-load-the-kern...

and seems to have something to do with tpm.

[Samuel Sieb]

On 11/21/22 14:12, Stephen Morris wrote:
>  These issues seem to be tied to the fact that F37 is now booting with
>
>  Grub and not with what F36 was booting with (possibly systemd?), and in  
It has been grub for a very long time.

>  F37 the grub-gfxmode statement in /etc/default/grub that worked fine
> in 
>  F36 does not work in F37 even though the associated statements are added 
>  to grub.cfg, they seem to be being ignored (I'm thinking about raising 
>  another thread on this issue). 
Now that I've tried looking it up, what is this "grub-gfxmode" statement 
that you're referring to?  It's not an actual grub command.

[Lester M Petrie]

On 11/23/22 02:24, Samuel Sieb wrote:
>  On 11/21/22 14:12, Stephen Morris wrote: F37 the grub-gfxmode 
>  statement in /etc/default/grub that worked fine in F36 does not work 
>  in F37 even though the associated statements are added to grub.cfg, 
>  they seem to be being ignored (I'm thinking about raising another 
>  thread on this issue).
>
>  Now that I've tried looking it up, what is this "grub-gfxmode" 
>  statement that you're referring to?  It's not an actual grub command.
>  _______________________________________________ 

I am still running F36, but I get the message

error: ../../grub-core/commands/terminal.c:138 terminal 'gfxterm' isn't 
found.

right before the grub selection menu is displayed, but mode setting 
seems to still work.

[Stephen Morris]

On 24/11/22 05:35, Lester M Petrie wrote:
>  On 11/23/22 02:24, Samuel Sieb wrote:
> > On 11/21/22 14:12, Stephen Morris wrote: F37 the grub-gfxmode 
> > statement in /etc/default/grub that worked fine in F36 does not work 
> > in F37 even though the associated statements are added to grub.cfg, 
> > they seem to be being ignored (I'm thinking about raising another 
> > thread on this issue).
> >
> > Now that I've tried looking it up, what is this "grub-gfxmode" 
> > statement that you're referring to?  It's not an actual grub command.
> > _______________________________________________
>
>
>  I am still running F36, but I get the message
>
>  error: ../../grub-core/commands/terminal.c:138 terminal 'gfxterm' 
>  isn't found.
>
>  right before the grub selection menu is displayed, but mode setting 
>  seems to still work.
>  
Mode setting isn't working for me in F37 where it did in F36. I'm 
specifying to set the graphics resolution to 4K, so it is immediately 
obvious when it doesn't do it.
With you gfxterm issue you may want to do some searches on the net for 
that as I think that is an indication you are missing a package, as I am 
telling grub to use a gfxterminal in /etc/default/grub and that is 
working fine in F37 and also worked fine in F36.

regards,
Steve

>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

[Stephen Morris]

On 23/11/22 18:24, Samuel Sieb wrote:
>  On 11/21/22 14:12, Stephen Morris wrote:
> > These issues seem to be tied to the fact that F37 is now booting with 
> > Grub and not with what F36 was booting with (possibly systemd?), and in 
>
>  It has been grub for a very long time. 
I know the boot menus have been grub for a
long time, but when I was 
investigating the issue I've been having with the grub menus I found an 
article that was saying that a change in F37 was to boot with grub 
instead of, I thought it said, Systemd?
> > F37 the grub-gfxmode statement in /etc/default/grub that worked fine 
> > in F36 does not work in F37 even though the associated statements are 
> > added to grub.cfg, they seem to be being ignored (I'm thinking about 
> > raising another thread on this issue).
>
>  Now that I've tried looking it up, what is this "grub-gfxmode" 
>  statement that you're referring to?  It's not an actual grub command.
Sorry, I wrote if slightly wrong, it's GRUB_GFXMODE. It is a statement 
put in /etc/default/grub that specifies the display resolution to 
display the grub boot menus in. I have it set to 3840x2160 (for a 4K 
monitor), and when I run grub2-mkconfig to build the config file in 
/boot/grub2/grub.cfg, grub2-mkconfig inserts a statement to set that 
resolution into grub.cfg and also adds a statement in each of the kernel 
specification blocks to set gfxpayload to keep. Those statements were 
honoured in F36 and are being ignored since the upgrade to F37.
Also I did comment out the GRUB_GFXMODE statement in /etc/default/grub, 
and rebuilt grub.cfg, but that has made no difference to the production 
of the sb.c message. If this message is because grub keys need to be 
added to the secure boot shim (as seems to be indicated from what I've 
seen on the net), do you know of any documentation that will tell me how 
to do that? I've got documentation that tells me how to do it for the 
akmod nvidia drivers but nothing else.

regards,
Steve

>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: 
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives: 
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it: 
>  https://pagure.io/fedora-infrastructure/new_issue

[Samuel Sieb]

On 11/20/22 23:54, Stephen Morris wrote:
>       I am getting the following error message displayed before the 
>  display of the grub boot menu, can someone explain to me what this means 
>  and why it is occurring in F37 when it was never produced in F36, and 
>  what I need to do to rectify it?
>  
>                   error: ../../grub-core/kern/efi/sb.c:169:prohibited by 
>  secure boot policy 
That's not a file you'll find on your system.  That's just identifying 
where in the grub code that the error message is coming from.  As you 
say the grub-gfxmode command isn't working now, I would assume that's 
what is causing the error message because it's not allowed with secure 
boot enabled.  You most likely have to stay with the graphics mode that 
is initialized by the BIOS.

[Stephen Morris]

On 23/11/22 12:04, Samuel Sieb wrote:
>  On 11/20/22 23:54, Stephen Morris wrote:
> >      I am getting the following error message displayed before the 
> > display of the grub boot menu, can someone explain to me what this 
> > means and why it is occurring in F37 when it was never produced in 
> > F36, and what I need to do to rectify it?
> >
> >                  error: ../../grub-core/kern/efi/sb.c:169:prohibited 
> > by secure boot policy
>
>  That's not a file you'll find on your system.  That's just identifying 
>  where in the grub code that the error message is coming from.  As you 
>  say the grub-gfxmode command isn't working now, I would assume that's 
>  what is causing the error message because it's not allowed with secure 
>  boot enabled.  You most likely have to stay with the graphics mode 
>  that is initialized by the BIOS. 
Thanks Samuel. Are you saying that grub command is
not allowed if F37 
because F37 is now booting via grub with full secure boot enabled, 
whereas with the way F36 booted that grub command was honoured and the 
menus and theme were displayed in that resolution with full secure boot 
enabled?

regards,
Steve

>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: 
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives: 
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it: 
>  https://pagure.io/fedora-infrastructure/new_issue

[Samuel Sieb]

On 11/22/22 22:45, Stephen Morris wrote:
>  On 23/11/22 12:04, Samuel Sieb wrote:
> > On 11/20/22 23:54, Stephen Morris wrote:
> >>      I am getting the following error message displayed before the 
> >> display of the grub boot menu, can someone explain to me what this 
> >> means and why it is occurring in F37 when it was never produced in 
> >> F36, and what I need to do to rectify it?
> >>
> >>                  error: ../../grub-core/kern/efi/sb.c:169:prohibited 
> >> by secure boot policy
> >
> > That's not a file you'll find on your system.  That's just identifying 
> > where in the grub code that the error message is coming from.  As you 
> > say the grub-gfxmode command isn't working now, I would assume that's 
> > what is causing the error message because it's not allowed with secure 
> > boot enabled.  You most likely have to stay with the graphics mode 
> > that is initialized by the BIOS.
>  Thanks Samuel. Are you saying that grub command is not allowed if F37 
>  because F37 is now booting via grub with full secure boot enabled, 
>  whereas with the way F36 booted that grub command was honoured and the 
>  menus and theme were displayed in that resolution with full secure boot 
>  enabled? 
That was just a guess and I think it was wrong now.  I checked the 
source and that error message is related to file loading.  I would have 
to see your config file to make a guess about what file it was trying to 
load.

[Stephen Morris]

On 23/11/22 18:22, Samuel Sieb wrote:
>  On 11/22/22 22:45, Stephen Morris wrote:
> > On 23/11/22 12:04, Samuel Sieb wrote:
> >> On 11/20/22 23:54, Stephen Morris wrote:
> >>>      I am getting the following error message displayed before the 
> >>> display of the grub boot menu, can someone explain to me what this 
> >>> means and why it is occurring in F37 when it was never produced in 
> >>> F36, and what I need to do to rectify it?
> >>>
> >>>                  error: 
> >>> ../../grub-core/kern/efi/sb.c:169:prohibited by secure boot policy
> >>
> >> That's not a file you'll find on your system.  That's just 
> >> identifying where in the grub code that the error message is coming 
> >> from.  As you say the grub-gfxmode command isn't working now, I 
> >> would assume that's what is causing the error message because it's 
> >> not allowed with secure boot enabled. You most likely have to stay 
> >> with the graphics mode that is initialized by the BIOS.
> > Thanks Samuel. Are you saying that grub command is not allowed if F37 
> > because F37 is now booting via grub with full secure boot enabled, 
> > whereas with the way F36 booted that grub command was honoured and 
> > the menus and theme were displayed in that resolution with full 
> > secure boot enabled?
>
>  That was just a guess and I think it was wrong now.  I checked the 
>  source and that error message is related to file loading.  I would 
>  have to see your config file to make a guess about what file it was 
>  trying to load. 
Thanks Samuel, I've attached my grub.cfg file. If it is failing
to load 
a module, would there be some sort of error message in boot.log, and if 
so what would I need to search for to find it, or is this happening too 
early in the boot sequence to make that file?
I did find a net article that seemed to be from the developer, that 
seemed to be his spec for the source code changes he was doing, but I 
didn't understand the sections of the code to seemed to be relevant to 
what was denied under secure boot. I'm not sure if I could find that 
article again.

regards,
Steve

>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: 
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives: 
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it: 
>  https://pagure.io/fedora-infrastructure/new_issue

[Stephen Morris]

On 23/11/22 18:22, Samuel Sieb wrote:
>  On 11/22/22 22:45, Stephen Morris wrote:
> > On 23/11/22 12:04, Samuel Sieb wrote:
> >> On 11/20/22 23:54, Stephen Morris wrote:
> >>>      I am getting the following error message displayed before the 
> >>> display of the grub boot menu, can someone explain to me what this 
> >>> means and why it is occurring in F37 when it was never produced in 
> >>> F36, and what I need to do to rectify it?
> >>>
> >>>                  error: 
> >>> ../../grub-core/kern/efi/sb.c:169:prohibited by secure boot policy
> >>
> >> That's not a file you'll find on your system.  That's just 
> >> identifying where in the grub code that the error message is coming 
> >> from.  As you say the grub-gfxmode command isn't working now, I 
> >> would assume that's what is causing the error message because it's 
> >> not allowed with secure boot enabled. You most likely have to stay 
> >> with the graphics mode that is initialized by the BIOS.
> > Thanks Samuel. Are you saying that grub command is not allowed if F37 
> > because F37 is now booting via grub with full secure boot enabled, 
> > whereas with the way F36 booted that grub command was honoured and 
> > the menus and theme were displayed in that resolution with full 
> > secure boot enabled?
>
>  That was just a guess and I think it was wrong now.  I checked the 
>  source and that error message is related to file loading.  I would 
>  have to see your config file to make a guess about what file it was 
>  trying to load. 
I bookmarked an article under Windows in Firefox but the bookmark
is not 
showing up under linux, that specifies the error is being produced by 
the "loadfont" statement in grub.cfg, and occurs because of the 
statements  GRUB_TERMINAL_OUTPUT=gfxterm and GRUB_GFXMODE=3840x2160 
being in /etc/default/grub and a particular version of grub2-efi, where 
grub2-efi in a secure boot environment requires the default grub unicode 
font or any font being loaded by any grub theme to be self signed. The 
article specifies that there is potentially a fix in the testing 
repositories for F35, F36 and F37, but is suggesting the updated package 
may not be suitable for public consumption yet. An alternative offered 
to fix the issue is to downgrade grub2\*.
I could try the updates and see what happens.
The link to the bugzilla article is below.

https://bugzilla.redhat.com/show_bug.cgi?id=2144113

regards,
Steve

>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: 
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives: 
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it: 
>  https://pagure.io/fedora-infrastructure/new_issue

[Stephen Morris]

On 23/11/22 18:22, Samuel Sieb wrote:
>  On 11/22/22 22:45, Stephen Morris wrote:
> > On 23/11/22 12:04, Samuel Sieb wrote:
> >> On 11/20/22 23:54, Stephen Morris wrote:
> >>>      I am getting the following error message displayed before the 
> >>> display of the grub boot menu, can someone explain to me what this 
> >>> means and why it is occurring in F37 when it was never produced in 
> >>> F36, and what I need to do to rectify it?
> >>>
> >>>                  error: 
> >>> ../../grub-core/kern/efi/sb.c:169:prohibited by secure boot policy
> >>
> >> That's not a file you'll find on your system.  That's just 
> >> identifying where in the grub code that the error message is coming 
> >> from.  As you say the grub-gfxmode command isn't working now, I 
> >> would assume that's what is causing the error message because it's 
> >> not allowed with secure boot enabled. You most likely have to stay 
> >> with the graphics mode that is initialized by the BIOS.
> > Thanks Samuel. Are you saying that grub command is not allowed if F37 
> > because F37 is now booting via grub with full secure boot enabled, 
> > whereas with the way F36 booted that grub command was honoured and 
> > the menus and theme were displayed in that resolution with full 
> > secure boot enabled?
>
>  That was just a guess and I think it was wrong now.  I checked the 
>  source and that error message is related to file loading.  I would 
>  have to see your config file to make a guess about what file it was 
>  trying to load. 
Following on from my previous mail, I tried the identified fix for
F37, 
which updated a number of grub packages, rebuilt grub.cfg and rebooted, 
and the fix has made things significantly worse. There are now a lot 
more messages produced including the original one, the resolution is 
still ignored and the graphics terminal has been disabled. I'm not sure 
if I can take a photo of the messages as they disappear significantly 
quicker than before.
I'll not try to downgrade grub to back the fix out.

regards,
Steve

>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: 
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives: 
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it: 
>  https://pagure.io/fedora-infrastructure/new_issue

[Stephen Morris]

On 23/11/22 18:22, Samuel Sieb wrote:
>  On 11/22/22 22:45, Stephen Morris wrote:
> > On 23/11/22 12:04, Samuel Sieb wrote:
> >> On 11/20/22 23:54, Stephen Morris wrote:
> >>>      I am getting the following error message displayed before the 
> >>> display of the grub boot menu, can someone explain to me what this 
> >>> means and why it is occurring in F37 when it was never produced in 
> >>> F36, and what I need to do to rectify it?
> >>>
> >>>                  error: 
> >>> ../../grub-core/kern/efi/sb.c:169:prohibited by secure boot policy
> >>
> >> That's not a file you'll find on your system.  That's just 
> >> identifying where in the grub code that the error message is coming 
> >> from.  As you say the grub-gfxmode command isn't working now, I 
> >> would assume that's what is causing the error message because it's 
> >> not allowed with secure boot enabled. You most likely have to stay 
> >> with the graphics mode that is initialized by the BIOS.
> > Thanks Samuel. Are you saying that grub command is not allowed if F37 
> > because F37 is now booting via grub with full secure boot enabled, 
> > whereas with the way F36 booted that grub command was honoured and 
> > the menus and theme were displayed in that resolution with full 
> > secure boot enabled?
>
>  That was just a guess and I think it was wrong now.  I checked the 
>  source and that error message is related to file loading.  I would 
>  have to see your config file to make a guess about what file it was 
>  trying to load. 
I backed the fix out and disabled the testing repository, which
backed 
grub out to 2.06.63. I did a further backout which backed grub out to 
2.06.58 which supposedly doesn't have the issue, but a rebuild of 
grub.cfg and reboot still displayed the message, still ignored the 
specified resolution and ignored the gfxterm specification because it is 
still not displaying the theme. I could try switching to the breeze them 
with is supplied in the repositories.
After the boot, I issued sudo dnf upgrade --refresh grub2\* to reinstall 
the offending grub version, but that installed grub 2.06.67, which was 
the version in the testing repositories, so it looks like it has been 
migrated to the "stable" repositories even though the bugzilla entry was 
indicating they may not be up to scratch. Having gone back to this 
version of grub it looks like the message is being produced for all 6 
fonts the theme is loading.
Does anyone have any ideas on how to sign the fonts?

regards,
Steve

>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: 
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives: 
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it: 
>  https://pagure.io/fedora-infrastructure/new_issue

[Stephen Morris]

On 27/11/22 15:25, Stephen Morris wrote:
>  On 23/11/22 18:22, Samuel Sieb wrote:
> > On 11/22/22 22:45, Stephen Morris wrote:
> >> On 23/11/22 12:04, Samuel Sieb wrote:
> >>> On 11/20/22 23:54, Stephen Morris wrote:
> >>>>      I am getting the following error message displayed before the 
> >>>> display of the grub boot menu, can someone explain to me what this 
> >>>> means and why it is occurring in F37 when it was never produced in 
> >>>> F36, and what I need to do to rectify it?
> >>>>
> >>>>                  error: 
> >>>> ../../grub-core/kern/efi/sb.c:169:prohibited by secure boot policy
> >>>
> >>> That's not a file you'll find on your system.  That's just 
> >>> identifying where in the grub code that the error message is coming 
> >>> from.  As you say the grub-gfxmode command isn't working now, I 
> >>> would assume that's what is causing the error message because it's 
> >>> not allowed with secure boot enabled. You most likely have to stay 
> >>> with the graphics mode that is initialized by the BIOS.
> >> Thanks Samuel. Are you saying that grub command is not allowed if 
> >> F37 because F37 is now booting via grub with full secure boot 
> >> enabled, whereas with the way F36 booted that grub command was 
> >> honoured and the menus and theme were displayed in that resolution 
> >> with full secure boot enabled?
> >
> > That was just a guess and I think it was wrong now.  I checked the 
> > source and that error message is related to file loading.  I would 
> > have to see your config file to make a guess about what file it was 
> > trying to load.
>  I backed the fix out and disabled the testing repository, which backed 
>  grub out to 2.06.63. I did a further backout which backed grub out to 
>  2.06.58 which supposedly doesn't have the issue, but a rebuild of 
>  grub.cfg and reboot still displayed the message, still ignored the 
>  specified resolution and ignored the gfxterm specification because it 
>  is still not displaying the theme. I could try switching to the breeze 
>  them with is supplied in the repositories.
>  After the boot, I issued sudo dnf upgrade --refresh grub2\* to 
>  reinstall the offending grub version, but that installed grub 2.06.67, 
>  which was the version in the testing repositories, so it looks like it 
>  has been migrated to the "stable" repositories even though the 
>  bugzilla entry was indicating they may not be up to scratch. Having 
>  gone back to this version of grub it looks like the message is being 
>  produced for all 6 fonts the theme is loading.
>  Does anyone have any ideas on how to sign the fonts? 
I have now found from playing
around with these settings and loading the 
grub breeze theme that came from the fedora repositories, that the fonts 
used by that theme are not signed to secure boot's satisfaction either. 
I am also raising in another thread the observations that with grub2 
2.06.67 grub has gone back to using /boot/efi/EFI/fedora/grub.cfg 
instead of /boot/grub2/grub.cfg.

regards,
Steve

>  regards,
>  Steve
>
> > _______________________________________________
> > users mailing list -- users(a)lists.fedoraproject.org
> > To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
> > Fedora Code of Conduct: 
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives: 
> > https://lists.fedoraproject.org/archives/list/[e-mail]
> > Do not reply to spam, report it: 
> > https://pagure.io/fedora-infrastructure/new_issue
>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: 
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives: 
>  https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it: 
>  https://pagure.io/fedora-infrastructure/new_issue