Foreman » Installer

A change in grub2 build config (package grub2-efi file grubx64.efi) changed the base directory where grub2 tries to find configuration files. It used to be the current directory, now it changed to /EFI/redhat (or /EFI/centos or /EFI/fedora etc). While this works fine for local booting, it breaks our PXE/TFTP provisioning.

We could start building our grub via `grub2-mknetdir` which has options to configure where grub should load configuration files from, but then the bootloader will not be signed and SecureBoot will not be possible.

Therefore I suggest a workaround, let's create a relative symlinks in the TFTP directory (/var/lib/tftpboot) as follows:

• /var/lib/tftpboot/EFI/redhat -> ../../grub2
• /var/lib/tftpboot/EFI/centos -> ../../grub2
• /var/lib/tftpboot/EFI/fedora -> ../../grub2

Unfortunately every distribution or RH clone has their own ESP EFI subdirectory (which is needed for multi-boot systems), therefore we need to create symlinks for all linux distributions we support.

This was reported multiple times, for example:

https://community.theforeman.org/t/provisioning-bare-metal-host-over-uefi-client-requesting-grub-cfg-in-wrong-location/29053
Alternative solution would be start building grub2 via the mknetdir and dropping support for SecureBoot for all network booting completely. This is what we do for Debian anyway because the grub2 there is not signed anyway, so we would start doing the same for Red Hat systems.

Triage: This is high-impact regression, all Red Hat / clones systems are affected.