Boot issue after installking Kicksecure

kinoe · October 2, 2024, 10:53am

I also do have this issue even without running kicksecure fom ventoy!
I installed kicksecure onto usb flash drive following word for word the official installation tutorial to install kicksecure iso to usb flash drive. Booting after installation works, but afterwards I shutdown, unplugged the flash drive and booted the linux host on the hardware, kicksecure boots only to grub bash line.

arraybolt3 · October 2, 2024, 3:15pm

Are you using the latest Kicksecure ISO? Some of the earlier ISOs could have this issue, but it should be fixed in the latest ISO.

Patrick · October 2, 2024, 4:35pm

Then I don’t recommend mixing it into the ventoy related forum thread.
(Install on usb don't boot)

What exactly did you do?
Write ISO to USB?
Boot the ISO.
So far so good?
Then installed Kicksecure to internal harddrive?
Fails to boot after installation?

kinoe · October 3, 2024, 6:51am

Thanks for taking an interest.
-I followed the instructions here: Live Mode for Kicksecure
-Version: Kicksecure-Xfce-17.2.3.7.iso copied to flash drive by balenaEtcher
-Booted and installed to another 64GB USB flash drive with luks encryption
-Booted that new installed Kicksecure 64GB USB flash drive, installed Whonix and shut down - so far so good
But after running the host system (Arch Linux) once, without flash drive plugged in, the replugged Kicksecure flash drive merely boots to Grub bash line!
I managed to boot it by the help of Super-Grub2-disk, which finds the Grub entry and boots from it.
Journalctl is reporting a Swap File Creator error but I’m not sure its relevant.
In Kicksecure again I did as follows:

sudo apt-get full-upgrade
sudo apt-get full-upgrade --target-release=bookworm-fasttrack
whonix-xfce-installer-cli

and to fix the boot issue I kinda fiddled around, maybe made it worse:

dpkg-query -W -f='${db:Status-Status}' dracut '=> installed
dpkg-query -W -f='${db:Status-Status}' initramfs-tools ' => not-installed
sudo apt install --reinstall dracut grub-live
sudo dracut --hostonly --force
sudo update-grub => no errors

Here is the /etc/default/grub:

GRUB_DEFAULT=0
GRUB_TIMEOUT=5
GRUB_DISTRIBUTOR='Kicksecure'
GRUB_CMDLINE_LINUX_DEFAULT='quiet rd.luks.uuid=82fbd4c5-b874-4c81-9a30-7aad4eb2aee4'
GRUB_CMDLINE_LINUX=""

kinoe · October 5, 2024, 5:43am

I’ll try the approach distro-morphing.

kinoe · October 5, 2024, 9:54am

Quite the same problem with morphed debian into kicksecure! It doesn’t seem to be the hardware, because booting other OS from usb flash drive is possible
I don’t know what I’m missing.
Edit: Trying to boot, the boot partition (first one) isn’t recognized apparently: Only partition 2 shows up!

kinoe · October 7, 2024, 4:06pm

No feedback of any kind???

arraybolt3 · October 8, 2024, 3:43am

When you’re dropped to the grub command line, can you run ls and show the output? I’m wondering if maybe you’re in a situation where the Linux kernel and your BIOS can read your disk, but GRUB can’t.

kinoe · October 8, 2024, 7:06am

Thanks for taking an interest. Here is the output of Grub cmd line ls:

As you can see Grub lists the boot partition hd0,gpt2! So I don’t know why it does not boot it.

And here are the boot methods that are detected by Super Grub2 Disk:

kinoe · October 8, 2024, 7:35am

I really don’t know what is going on here: After booting Kicksecure several times with the aid of Super Grub Disk, an entry for Kicksecure showed up in the Grub menu, meaning Partition 2 (hd0, gpt2) is detected! But after running the host OS, the entry to Kicksecure is gone again, whats left is: UEFI: USB, Partition 1 thats leading to the Grub cmd line only.

EDIT: Tried booting on another Laptop ends up with the same result: No entry for Partition 2 and choosing Partition 1 ends with Grub cmd line

EDIT2: During boot resp. boot attempt of Kicksecure (with Super Grub Disk resp. without it) shows an error for a split second:

error: no such device: /.disk/info.
error: no such device: /.disk/mini-info.

Don’t know if thats relevant

Does Kicksecure (configure Grub2 to) boot by uuid or by labels? In fstab its uuid.

arraybolt3 · October 8, 2024, 3:02pm

The GRUB “errors” aren’t really issues, GRUB is looking for files that are sometimes present on ISO files that aren’t present on your particular ISO file (the Super Grub Disk one).

Kicksecure boots by UUIDs in the GRUB config file.

To be clear, are you dual-booting Kicksecure alongside another Linux distro? If so, you probably need to enable os-prober on your primary distro. To do that:

Run sudo nano /etc/default/grub on the main OS, then find the line that looks like #GRUB_DISABLE_OS_PROBER=false and uncomment it by removing the # from the start. Then press Ctrl+S to save, then Ctrl+X to exit. (It’s possible that you’ll find that this line is already uncommented, in which case you can just close the file and proceed to the next step.)
Run sudo update-grub to regenerate the GRUB menu.
On your next reboot you should see an entry for Kicksecure in the boot menu. Boot into Kicksecure and repeat this process there so that in the event Kicksecure’s GRUB takes over, you can still see and boot your main OS.

kinoe · October 8, 2024, 3:38pm

Thanks for the answer. I’m not dual-booting Kicksecure, rather installed it on usb flash drive.
I tried to boot it on a host system which uses itself Grub2 and on another which boots by systemdboot. On both Laptops the boot partition of Kicksecure is only detected as long as the host system has not been booted!

And here’s the partition table of the flash drive as gparted displays it:

german ‘nicht zugeteilt’ means not allocated

arraybolt3 · October 8, 2024, 4:23pm

Installing Kicksecure to a USB flash drive is basically the same as dual-booting from the hardware’s perspective, so the solution mentioned earlier has a pretty good chance of working.

Another possible option is to use your computer’s built-in boot menu rather than GRUB’s boot menu. Most systems have a key you can press during early boot (usually it’s Esc though sometimes it can be F2, F7, or something else) that will show you a list of operating systems you can boot from. If Kicksecure is in that list, or if your USB drive shows up in that list, try selecting it to boot from.

kinoe · October 8, 2024, 5:31pm

Run sudo nano /etc/default/grub on the main OS, then find the line that looks like #GRUB_DISABLE_OS_PROBER=false and uncomment it by removing the # from the start. Then press Ctrl+S to save, then Ctrl+X to exit. (It’s possible that you’ll find that this line is already uncommented, in which case you can just close the file and proceed to the next step.)

Run sudo update-grub to regenerate the GRUB menu.

→ unfortunately it doesn’t fix the issue

Another possible option is to use your computer’s built-in boot menu rather than GRUB’s boot menu. Most systems have a key you can press during early boot (usually it’s Esc though sometimes it can be F2, F7, or something else) that will show you a list of operating systems you can boot from. If Kicksecure is in that list, or if your USB drive shows up in that list, try selecting it to boot from.

→ in fact that is the way I boot all OSs installed on usb flash drive in the first place anyway The thing is, Kicksecures boot partition doesn’t show up in that list, as mentioned above

arraybolt3 · October 8, 2024, 5:47pm

Ah, ok. I thought the entry was missing from the GRUB boot menu, which is how I got confused.

I think I can reproduce your issue here. Somehow your UEFI firmware isn’t picking up a Kicksecure boot entry, meaning the only option you have in your list is just the USB drive’s boot entry. Booting from that results in Kicksecure’s fallback bootloader being invoked, and due to a bug in Kicksecure this simply drops you to a GRUB shell.

To fix the problem, you should be able to use efibootmgr within Kicksecure to add a Kicksecure boot entry to the list that will work properly. Based on the screenshots you’ve sent, the proper command to do this should be:

sudo efibootmgr -c -d /dev/sda -p 1 -L 'Kicksecure' -l 'EFI\Kicksecure\shimx64.efi'

The other bug (where the fallback bootloader doesn’t work) needs to be solved and is something I’ll likely be looking into in the near future.

kinoe · October 8, 2024, 6:32pm

Thank you a lot. That fixed it! Even rebooting Kicksecure after running host OS shows the entry! Thanks again arraybolt3!

arraybolt3 · October 8, 2024, 6:34pm

Nice! Glad it’s up-and-running now

Patrick · October 9, 2024, 6:59am

EFI BIOS bug? Can be debugged? Unfixable from our side?

Since that seems to have fixed it, it seems calamares is not executing that command or something going wrong during it?

So we’d need the calamares installer log, see what’s happening there, then compare with this command?

Any chance you could provide (that part) of the calamares installer log? @kinoe

arraybolt3 · October 9, 2024, 3:37pm

It could very well be an EFI BIOS bug, as the entry is picked up properly when I do an install into a UEFI-enabled virtual machine here. But yes, the installer log would be helpful if it still exists.

kinoe · October 11, 2024, 4:42am

Sadly the issue reappeared after some restarts: No Partition 2 listed in the efi boot menu.
So I booted with the help of SuperGrubDisk and reexecuted:

sudo efibootmgr -c -d /dev/sda -p 1 -L 'Kicksecure' -l 'EFI\Kicksecure\shimx64.efi'
BootCurrent: 0009
Timeout: 0 seconds
BootOrder: 0001,0008,0009,0000,0007
Boot0000* Linux Boot Manager
Boot0007* UEFI OS
Boot0008* UEFI:  USB, Partition 1
Boot0009* UEFI: Intenso, Partition 2
Boot0001* Kicksecure

That “fixed” it for the time being. But I suppose that the boot entry will disappear again in a little while.
@Patrick I didn’t keep the installation log -pity! I intend to install Kicksecure on an USB flash drive tomorrow once again just for the sake of getting that log for you.