Project

General

Profile

Actions

Bug #37562

closed

Improved "EFI local chainloading" on SecureBoot enabled hosts not working for all distribution

Added by Jan Loeser 4 months ago. Updated about 2 months ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Category:
Unattended installations
Target version:
-
Difficulty:
Triaged:
Yes
Fixed in Releases:
Found in Releases:

Description

We introduced the following to Foreman:

https://github.com/theforeman/foreman/pull/10126

The assumption was that `exit 1` in GRUB2 triggers a boot from the next
bootdevice by the firmware and that the `chainloader` command is not
working at all when SecureBoot is enabled (`lockdown=y`).

These assumptions seems to be wrong. It looks like that distribution
vendors patch GRUB2 differently which results in different behavior
affecting these assumptions. Some support `chainloader` command, some do
simply end up in the BIOS menu when using `exit 1`.

As an alternative we can do a "chainload light" and only load the GRUB2
configuration file from local disk. This means that the PXE booted GRUB2
boots the actual kernel from local disk.

For successful SecureBoot verification, the following changes are
required:

https://github.com/theforeman/foreman/pull/9864

The proposed solution would also work when SecureBoot is disabled,
however to avoid side effects I propose to only boot next device if
SecureBoot is enabled (GRUB2 variable `lockdown=y` [2]).

Actions #1

Updated by The Foreman Bot 4 months ago

  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/foreman/pull/10207 added
Actions #2

Updated by The Foreman Bot 3 months ago

  • Fixed in Releases 3.12.0 added
Actions #3

Updated by Jan Loeser 3 months ago

  • Status changed from Ready For Testing to Closed
Actions #4

Updated by Ewoud Kohl van Wijngaarden about 2 months ago

  • Category set to Unattended installations
  • Triaged changed from No to Yes
Actions

Also available in: Atom PDF