Development of System Image Creation and Bootstrapping Tools

Kicksecure ™

Download

On Computer USB Installation Debian morph to Kicksecure Windows (VM) Linux (VM) Mac (VM) VirtualBox (VM) KVM (VM) Qubes (VM) More options Source Code

About

Overview Features Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

• Image Creation
• Image Formats
• Boot Process

Installing GRUB onto a disk image is a bit of a black art.

Installing GRUB onto a disk image is a bit of a black art. I haven't found any good documentation for it. This plugin is written based on de-ciphering the build_openstack_image script. Here is an explanation of what I _THINK_ is happening.Lars Wirzenius, Debian Developer

The crucial command is grub-install. It needs a ton of options to work correctly: see below in the code for the list, and the manpage for an explanation of what each of them means. We will be running grub-install in a chroot so that we use the version in the Debian version we're installing, rather than the host system, which might be any Debian version.

To run grub-install in a chroot, we need to set up the chroot in various ways. Firstly, we need to tell grub-install which device file the image has. We can't just give it the image file itself, since it isn't inside the chroot, so instead we arrange to have a loop block device that covers the whole image file, and we bind mount /dev into the chroot so the device is available.

grub-install seems to also require /proc and /sys so we bind mount /sys into the chroot as well. /proc is already mounted otherwise.

We install the UEFI version of GRUB, and for that we additionally bind mount the EFI partition in the image. Oh yeah, you MUST have one.

We also make sure the right GRUB package is installed in the chroot, before we run grub-install.

Further, there's some configuration tweaking we need to do. See the code. Don't ask me why they're necessary.

For cleanliness, we also undo any bind mounts into the chroot. Don't want to leave them in case they cause trouble.

Note that this is currently assuming that UEFI and either the amd64 (a.k.a. x86_64) or arm64 (a.k.a. aarch64) architectures are being used. These should probably not be hardcoded. Patch welcome.Lars Wirzenius, Debian Developer

Example projects to demonstrate technical challanges:

• Systemd developers did not implement since 2022 mkosi ISO support (closed ticket but not implemented, the actual missing ticket to implement is repart: Support booting via CD-ROM).
• Nobody answered Build a bootable non-UEFI ARM64 image (e.g. Raspbian for RPi 4B) with mkosi?
• grml-debootstrap did not implement Rasberry PI (RPI) support since 2018.

Kicksecure A secure by default operating system with the latest security research in place.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Kicksecure is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Kicksecure we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2024 ENCRYPTED SUPPORT LP

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!