# Does Mender Support TrustedGrub?

**URL:** <https://hub.mender.io/t/does-mender-support-trustedgrub/2012>\
**Category:** General Discussions\
**Tags:** secure-booting, grub, uefi, trustedgrub\
**Created:** [June 5, 2020, 7:21am UTC](https://hub.mender.io/t/does-mender-support-trustedgrub/2012 "2020-06-05T07:21:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sash](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@Sash](https://hub.mender.io/u/Sash)\
**Post date:** [June 5, 2020, 7:21am UTC](https://hub.mender.io/t/does-mender-support-trustedgrub/2012/1 "2020-06-05T07:21:02Z")

</div>

Traversing through [docs.mender.io](http://docs.mender.io), I could see w.r.t. mender-convert does have Grub 2.04.

Here am wondering whether Mender support TrustedGrub (tgrub) which does supporting feature of Trusted Platform Module?

Thanks  
Sashank

---

<div class="post-metadata">

**Author:** ![kacf](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/kacf/32/146_2.png) [@kacf](https://hub.mender.io/u/kacf)\
**Post date:** [June 5, 2020, 12:59pm UTC](https://hub.mender.io/t/does-mender-support-trustedgrub/2012/2 "2020-06-05T12:59:57Z")

</div>

Mender does not support TrustedGrub at the moment. If it’s based on Grub, I imagine it would not be very hard to integrate with it though. Let us know if you attempt it!

---

<div class="post-metadata">

**Author:** ![Sash](https://avatars.discourse-cdn.com/v4/letter/s/c6cbf5/32.png) [@Sash](https://hub.mender.io/u/Sash)\
**Post date:** [June 11, 2020, 8:06am UTC](https://hub.mender.io/t/does-mender-support-trustedgrub/2012/3 "2020-06-11T08:06:02Z")

</div>

Thank you @kacf. How about mender supporting Trusted Boot (TBoot)?  
Is there any product which has implemented Secure OTA?

Regards,  
Sashank

---

<div class="post-metadata">

**Author:** ![kacf](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/kacf/32/146_2.png) [@kacf](https://hub.mender.io/u/kacf)\
**Post date:** [June 11, 2020, 8:21am UTC](https://hub.mender.io/t/does-mender-support-trustedgrub/2012/4 "2020-06-11T08:21:46Z")

</div>

There is no support for TBoot at the moment. This would require porting  
to a brand new boot loader, and I suspect there is significantly more  
effort involved than for a GRUB derivative. I know some users have used  
Secure Boot via GRUB, perhaps @drewmoseley has more information about this.

---

<div class="post-metadata">

**Author:** ![drewmoseley](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/drewmoseley/32/47_2.png) [@drewmoseley](https://hub.mender.io/u/drewmoseley)\
**Post date:** [June 11, 2020, 5:36pm UTC](https://hub.mender.io/t/does-mender-support-trustedgrub/2012/5 "2020-06-11T17:36:21Z")

</div>

I have partially implement EFI Secure Boot on Intel platforms. I got pulled off of that project so at some point I need to revisit it and clean up my patches for submission upstream.

Note that this was specifically for a Yocto-based setup but similar work should be feasible for binary distros with the caveat that you may need to ensure the root filesystem is read-only if you are using dm-verity or some such to verify the filesystem.