Add Memtest86+ to Grub with Secureboot

memtest86_grub_sb.md

This guide covers installing Memtest86+, sigining it to boot under secureboot, and adding it's entry to grub2.
Parts of this guide may be OS specific to Fedora 44 KDE.

0. Create a MOK pair for signing

Make a directory to store them.

mkdir ~/.module-signing 
cd ~/.module-signing

Generate the keys

sudo openssl req -new -x509 -newkey rsa:2048 -keyout ~/.module-signing/MOK.priv -out ~/.module-signing/MOK.der -nodes -days 36500

Convert the DER to PEM

openssl x509 -in ~/.module-signing/MOK.der -inform DER -outform PEM -out ~/.module-signing/MOK.pem

Enroll the MOK key.

mokutil --import ~/.module-signing/MOK.der

You will need to set a password, reboot, enroll new key, and answer questions or enter the password you set.

1. Install signing tools and memtest86+

sudo dnf install sbsigntools memtest86+

2. Sign Memtest

sudo sbsign --key ~/.module-signing/MOK.priv --cert ~/.module-signing/MOK.pem /boot/memtest86+x64.efi --output /boot/memtest86+x64.efi.signed

3. Verify that the signing worked.

sudo sbverify --cert ~/.module-signing/MOK.pem /boot/memtest86+x64.efi.signed

4. Install the signed efi executable.

sudo install -Dm755 /boot/memtest86+x64.efi.signed /boot/efi/EFI/fedora/memtest86+x64.efi

5. Add the boot entry to Grub.

sudo tee -a /etc/grub.d/40_custom >/dev/null <<'EOF'
menuentry 'Memtest86+ (signed)' {
	insmod part_gpt
	insmod fat
	insmod chain
	search --no-floppy --file --set=root /EFI/fedora/memtest86+x64.efi
	chainloader /EFI/fedora/memtest86+x64.efi
}
EOF

5. Remake the Grub config.

sudo grub2-mkconfig -o /boot/grub2/grub.cfg

6. Reboot and select Memtest86+ (signed) from the Grub menu.

Can't get the Grub menu to show up?

Edit the grub config.

sudo nano /etc/default/grub

• Make sure GRUB_TIMEOUT=5 (or is some positive integer)
• Add/set GRUB_TIMEOUT_STYLE=menu

Check for Grub env vars:

sudo grub2-editenv list

Remove menu_auto_hide from Grub's env.

sudo grub2-editenv - unset menu_auto_hide