Rubin Shrestha
Rubin Shrestha
Blog

GRUB2’s ntfs.mod failed to read NTFS partition in secure boot

by |Published

I’m trying to boot Windows PE in GRUB2 for my USB installers stick with secure boot enabled using MokManager. After I trying to boot into WinPE, it results in this error:

error: commands/search.c:grub_search_fs_uuid:371:no such device: 2C4DC288194A0C62
error: kern/fs.c:grub_fs_probe:122:unknown filesystem

The error says no device with the UUID 2C4DC288194A0C62 was found, although lsblk -f clearly shows it:

NAME        FSTYPE FSVER LABEL    UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sda                                                                                   
|-sda1      vfat   FAT32 EFI      15EC-4594                             821.5M    20% /boot
|-sda2      ntfs         Win11PE  297C7E0D204DD7A7                                    
|-sda3      ntfs         Win10PE  2C4DC288194A0C62                                    
|-sda4      swap   1     Swap     b8fa4a47-c11b-4895-a329-8c5dc2416974                [SWAP]
|-sda5      ext4   1.0   Root     1f25e3e8-1d22-4a32-9bd8-630a247a1bb1   34.1G    53% /
`-sda6      ext4   1.0   ISOs     eb3ccac3-1d49-4445-b779-924d20513162

It is very weird that essential modules like linux, ext2, ... still work normally. I suspect those modules was signed with key, but ntfs.mod doesn’t.

My GRUB2 entry for WinPE:

menuentry "Windows 10 Preinstall Environment" {
    insmod part_gpt
    insmod ntfs
    insmod chain
    set root='hd0,gpt3'
    if [ x$feature_platform_search_hint = xy ]; then
        search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt3 --hint-efi=hd0,gpt3 --hint-baremetal=usb0,gpt3 2C4DC288194A0C62
    else
        search --no-floppy --fs-uuid --set=root 2C4DC288194A0C62
    fi
    echo "Loading Win10 PE ..."
    chainloader /efi/boot/bootx64.efi
}

I’m preloading the following GRUB modules, based on Ubuntu’s script

GRUB_MODULES="
all_video
bli
boot
cat
chain
configfile
cpuid
echo
efifwsetup
ext2
fat
font
gettext
gfxmenu
gfxterm
gfxterm_background
gzio
halt
help
iso9660
jpeg
keystatus
loadenv
loopback
linux
ls
lsefi
lsefimmap
lsefisystab
lssal
minicmd
normal
ntfs
part_msdos
part_gpt
play
png
probe
reboot
regexp
search
search_fs_uuid
search_fs_file
search_label
serial
sleep
smbios
squash4
test
tpm
true
video
"

For now, the only workaround I’ve found is to disable Secure Boot in the BIOS, but this is inconvenient to do every time, and some games require Secure Boot to remain enabled.

Question: Is there a way for GRUB2 to recognize NTFS partition in secure boot

You may also like