Bug#1095049: grub2: cmdline is broken when chainloader is in secureboot state due to peimage

[joseph]

Package: grub2
Version: 2.12-5
Severity: normal

Dear Maintainer,

In grub2, used peimage and chainloader modules.
In Secure Boot Off state, cmdline is passed to linux by chainloader.
However, in Secure Boot On state, cmdline is broken.

See https://github.com/jclab-joseph/shim-cmdline-bug
There are also reproducible scripts and captured images.


-- System Information:
Debian Release: trixie/sid
  APT prefers noble-updates
  APT policy: (500, 'noble-updates'), (500, 'noble-security'), (500, 'noble'), (100, 'noble-backports')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.8.0-47-generic (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_USER, TAINT_OOT_MODULE
Locale: LANG=ko_KR.UTF-8, LC_CTYPE=ko_KR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages grub2 depends on:
ii  grub-common  2.12-1ubuntu7
ii  grub-pc      2.12-1ubuntu7

grub2 recommends no packages.

grub2 suggests no packages.