be4ff60d9c
The GRUB_TIMEOUT was duplicated in the /etc/grub/defaults. Changing the DIB_GRUB_TIMEOUT default to the base image typical default. Note: Hold shift if you want to interact with the grub menu. Change-Id: If4d5ae467706b98d89f9dd6714ef06a5933ccfb3
347 lines
12 KiB
Bash
Executable File
347 lines
12 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Configure grub. Note that the various conditionals here are to handle
|
|
# different distributions gracefully.
|
|
|
|
if [ ${DIB_DEBUG_TRACE:-1} -gt 0 ]; then
|
|
set -x
|
|
fi
|
|
set -eu
|
|
set -o pipefail
|
|
|
|
if [ ${DIB_EXTLINUX:-0} != "0" ]; then
|
|
echo "DIB_EXTLINUX no longer supported"
|
|
exit 1
|
|
fi
|
|
|
|
# Some distros have pre-installed grub in some other way, and want to
|
|
# skip this.
|
|
if [[ -f "/tmp/grub/install" ]]; then
|
|
exit 0
|
|
fi
|
|
|
|
BOOT_DEV=$IMAGE_BLOCK_DEVICE
|
|
# All available devices, handy for some bootloaders...
|
|
declare -A DEVICES
|
|
eval DEVICES=( $IMAGE_BLOCK_DEVICES )
|
|
|
|
DIB_BLOCK_DEVICE=${DIB_BLOCK_DEVICE:-}
|
|
|
|
# Right now we can't use pkg-map to branch by arch, so tag an
|
|
# architecture specific virtual package so we can install the
|
|
# rigth thing based on distribution.
|
|
if [[ "$ARCH" =~ "ppc" ]]; then
|
|
install-packages -m bootloader grub-ppc64
|
|
elif [[ "${DIB_BLOCK_DEVICE}" == "mbr" ||
|
|
"${DIB_BLOCK_DEVICE}" == "gpt" ]]; then
|
|
install-packages -m bootloader grub-pc
|
|
elif [[ "${DIB_BLOCK_DEVICE}" == "efi" ]]; then
|
|
install-packages -m bootloader grub-efi grub-efi-$ARCH
|
|
else
|
|
install-packages -m bootloader grub-pc grub-efi grub-efi-$ARCH
|
|
fi
|
|
|
|
GRUBNAME=$(type -p grub-install) || echo "trying grub2-install"
|
|
if [ -z "$GRUBNAME" ]; then
|
|
GRUBNAME=$(type -p grub2-install)
|
|
fi
|
|
|
|
if type grub2-mkconfig >/dev/null; then
|
|
GRUB_MKCONFIG="grub2-mkconfig"
|
|
else
|
|
GRUB_MKCONFIG="grub-mkconfig"
|
|
fi
|
|
|
|
if [[ ! $($GRUBNAME --version) =~ ' 2.' ]]; then
|
|
echo "Failure: not grub2"
|
|
exit 1
|
|
fi
|
|
|
|
# Ensure BLS entries are updated with default args
|
|
if [[ $($GRUB_MKCONFIG --help) =~ '--update-bls-cmdline' ]]; then
|
|
GRUB_MKCONFIG="$GRUB_MKCONFIG --update-bls-cmdline"
|
|
fi
|
|
|
|
# Some distros keep things in /boot/grub2, others in /boot/grub
|
|
if [ -d /boot/grub2 ]; then
|
|
GRUB_CFG=/boot/grub2/grub.cfg
|
|
GRUBENV=/boot/grub2/grubenv
|
|
else
|
|
# NOTE(ianw) This used to be behind a "-d /boot/grub" but this
|
|
# directory doesn't seem to exist for gentoo at this point;
|
|
# something creates it later. So we just fallback to this
|
|
# unconditionally.
|
|
GRUB_CFG=/boot/grub/grub.cfg
|
|
GRUBENV=/boot/grub/grubenv
|
|
mkdir -p /boot/grub
|
|
fi
|
|
|
|
# When using EFI image-based builds, particularly rhel element
|
|
# based on RHEL>=8.2 .qcow2, we might have /boot/grub2/grubenv
|
|
# as a dangling symlink to /boot/efi because we have extracted
|
|
# it from the root fs, but we didn't populate the separate EFI
|
|
# boot partition from the image. grub2-install calls rename()
|
|
# on this file, so if it's a dangling symlink it errors. Just
|
|
# remove it if it exists.
|
|
if [[ -L $GRUBENV ]]; then
|
|
rm -f $GRUBENV
|
|
fi
|
|
|
|
function append_or_replace {
|
|
local file=$1
|
|
local key=$2
|
|
local value=$3
|
|
|
|
if grep -q "^$key=" "$file"; then
|
|
sed -i "s/^$key=.*/$key=$value/" "$file"
|
|
else
|
|
echo $key=$value >>"$file"
|
|
fi
|
|
}
|
|
|
|
|
|
# NOTE(TheJulia): Explicitly strip out embedded console settings
|
|
# in the source's grub defaults. This prevents re-introduction later.
|
|
# Intentionally matching 'console=ttyS0,115200n8 console=tty0'
|
|
# Also globally matches so it can handle 'console=tty0 stuff console=tty1'
|
|
# ... and also matches
|
|
# 'console=ttyS0,112500n81 console=ttyS1,n8 console=tty0'
|
|
if [[ -f /etc/default/grub ]]; then
|
|
sed -i 's/\<console=[[:alnum:],]*[[:space:]]*//g' /etc/default/grub
|
|
fi
|
|
|
|
append_or_replace /etc/default/grub GRUB_DEVICE "LABEL=${DIB_ROOT_LABEL}"
|
|
append_or_replace /etc/default/grub GRUB_DISABLE_LINUX_UUID true
|
|
append_or_replace /etc/default/grub GRUB_TIMEOUT "${DIB_GRUB_TIMEOUT:-1}"
|
|
append_or_replace /etc/default/grub GRUB_TIMEOUT_STYLE "${DIB_GRUB_TIMEOUT_STYLE:-hidden}"
|
|
if [[ "True" == "${DIB_BOOTLOADER_USE_SERIAL_CONSOLE:-True}" ]]; then
|
|
append_or_replace /etc/default/grub GRUB_TERMINAL \""serial console"\"
|
|
else
|
|
append_or_replace /etc/default/grub GRUB_TERMINAL \"console\"
|
|
fi
|
|
append_or_replace /etc/default/grub GRUB_GFXPAYLOAD_LINUX auto
|
|
|
|
# NOTE(TheJulia): We need to remove any boot entry from the /etc/default/grub
|
|
# file that may already exist, such as what was added by fips being setup on
|
|
# either in the source image or by by an element, as we repack the image.
|
|
# with new filesystems.
|
|
# Matches any element which looks like " boot=" and the associated value
|
|
# in order for us to have a clean starting point to put a value in place,
|
|
# if applicable.
|
|
# Removes entry trailing with a space, or any entry where boot is set as
|
|
# the last argument on the line.
|
|
sed -i 's/\ boot=[0-9A-Za-z/=\-]\+//' /etc/default/grub
|
|
# NOTE(TheJulia): When using FIPS, dracut wants to evaluate
|
|
# the hmac files for the kernel checksum. However, if /boot is
|
|
# located on a separate filesystem from the root filesystem,
|
|
# than this fails. As a result, we need to identify IF /boot
|
|
# is a separate filesystem, and convey this fact as a boot
|
|
# argument so dracut does not halt the system on boot.
|
|
|
|
BOOT_FS=""
|
|
|
|
if [[ -n "${DIB_BOOT_LABEL}" ]]; then
|
|
BOOT_FS=" boot=LABEL=${DIB_BOOT_LABEL}"
|
|
fi
|
|
|
|
# NOTE(TheJulia): While on the subject of FIPS, if there is not an
|
|
# explicit /boot partition, then the fips setup command will return
|
|
# a successful result, but then also tell you to update your grub
|
|
# configuration. This happens specifically with Rocky linux.
|
|
# as such, we check/reconcile the flag into place for the kernel
|
|
# as the utility will return a result code of 1 if the state is
|
|
# inconsistent, i.e. policy in place, but not kernel command line
|
|
# argument.
|
|
|
|
BOOT_FIPS=""
|
|
|
|
if [[ -x /bin/fips-mode-setup ]]; then
|
|
set +e
|
|
fips-mode-setup --is-enabled
|
|
is_fips_enabled=$?
|
|
set -e
|
|
if [ $is_fips_enabled -eq 1 ]; then
|
|
BOOT_FIPS=" fips=1"
|
|
fi
|
|
fi
|
|
|
|
|
|
if [[ "True" == "${DIB_BOOTLOADER_USE_SERIAL_CONSOLE:-True}" ]]; then
|
|
if [[ -n "${DIB_BOOTLOADER_SERIAL_CONSOLE}" ]]; then
|
|
SERIAL_CONSOLE="console=${DIB_BOOTLOADER_SERIAL_CONSOLE}"
|
|
elif [[ "powerpc ppc64 ppc64le" =~ "$ARCH" ]]; then
|
|
# Serial console on Power is hvc0
|
|
SERIAL_CONSOLE="console=hvc0"
|
|
elif [[ "arm64" =~ "$ARCH" ]]; then
|
|
SERIAL_CONSOLE="console=ttyAMA0,115200"
|
|
else
|
|
SERIAL_CONSOLE="console=ttyS0,115200"
|
|
fi
|
|
else
|
|
SERIAL_CONSOLE=""
|
|
fi
|
|
|
|
if [[ -n "${DIB_BOOTLOADER_VIRTUAL_TERMINAL}" ]]; then
|
|
VIRTUAL_TERMINAL="console=${DIB_BOOTLOADER_VIRTUAL_TERMINAL}"
|
|
else
|
|
VIRTUAL_TERMINAL=""
|
|
fi
|
|
|
|
if [[ "True" == "${DIB_NO_TIMER_CHECK:-True}" ]]; then
|
|
NO_TIMER_CHECK="no_timer_check"
|
|
else
|
|
NO_TIMER_CHECK=""
|
|
fi
|
|
|
|
GRUB_CMDLINE_LINUX_DEFAULT="${VIRTUAL_TERMINAL} ${SERIAL_CONSOLE} ${NO_TIMER_CHECK}"
|
|
echo "GRUB_CMDLINE_LINUX_DEFAULT=\"${GRUB_CMDLINE_LINUX_DEFAULT} ${DIB_BOOTLOADER_DEFAULT_CMDLINE}${BOOT_FS}${BOOT_FIPS}\"" >>/etc/default/grub
|
|
|
|
|
|
if [[ "True" == "${DIB_BOOTLOADER_USE_SERIAL_CONSOLE:-True}" ]]; then
|
|
echo 'GRUB_SERIAL_COMMAND="serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1"' >>/etc/default/grub
|
|
fi
|
|
|
|
# os-prober leaks /dev/sda into config file in dual-boot host
|
|
# Disable grub-os-prober to avoid the issue while running
|
|
# grub-mkconfig
|
|
# Setting a flag to track whether the entry is already there in grub config
|
|
PROBER_DISABLED=
|
|
if ! grep -qe "^\s*GRUB_DISABLE_OS_PROBER=true" /etc/default/grub; then
|
|
PROBER_DISABLED=true
|
|
echo 'GRUB_DISABLE_OS_PROBER=true' >> /etc/default/grub
|
|
fi
|
|
|
|
# GRUB_MKCONFIG call needs to happen after we configure
|
|
# /etc/default/grub above. Without this we can set inappropriate
|
|
# root device labels and then images don't boot.
|
|
#
|
|
# This produces a legacy config which both bios and uefi can boot
|
|
# Later we copy the final config to an efi specific location to
|
|
# support uefi specific functionality like secure boot.
|
|
$GRUB_MKCONFIG -o $GRUB_CFG
|
|
|
|
# If we are using BLS, for debugging purposes dump out the kernel
|
|
if [[ -e /boot/loader/entries ]]; then
|
|
grubby --info=ALL
|
|
fi
|
|
|
|
# Remove the fix to disable os_prober
|
|
if [ -n "$PROBER_DISABLED" ]; then
|
|
sed -i '$d' /etc/default/grub
|
|
fi
|
|
|
|
# Fix efi specific instructions in grub config file
|
|
if [ -d /sys/firmware/efi ]; then
|
|
sed -i 's%\(initrd\|linux\)efi /boot%\1 /boot%g' $GRUB_CFG
|
|
fi
|
|
|
|
# when using efi, and having linux16/initrd16, it needs to be replaced
|
|
# by linuxefi/initrdefi. When building images on a non-efi system,
|
|
# the 16 suffix is added to linux/initrd entries, but we need it to be
|
|
# linuxefi/initrdefi for the image to boot under efi
|
|
if [[ ${DIB_BLOCK_DEVICE} == "efi" ]]; then
|
|
sed -i 's%\(linux\|initrd\)16 /boot%\1efi /boot%g' $GRUB_CFG
|
|
fi
|
|
|
|
# Finally copy the grub.cfg and grubenv to the EFI specific dir
|
|
# to support functionality like secure boot. We make a copy because
|
|
# /boot and /boot/efi may be different partitions and uefi looks
|
|
# for a specific partition UUID preventing symlinks from working.
|
|
if [ -n "${EFI_BOOT_DIR:-}" ] && [ -d /boot/efi/$EFI_BOOT_DIR ] ; then
|
|
cp $GRUB_CFG /boot/efi/$EFI_BOOT_DIR/grub.cfg
|
|
if [ -a $GRUBENV ]; then
|
|
cp $GRUBENV /boot/efi/$EFI_BOOT_DIR/grubenv
|
|
fi
|
|
fi
|
|
|
|
# Ensure paths in BLS entries account for /boot being a partition or part of the
|
|
# root partition and perform any required entry removal.
|
|
if [[ -e /boot/loader/entries ]]; then
|
|
pushd /boot/loader/entries
|
|
set +e
|
|
mountpoint /boot
|
|
bootmount=$?
|
|
|
|
for entry in *; do
|
|
if [[ $bootmount -eq 0 ]]; then
|
|
sed -i "s| /boot/vmlinuz| /vmlinuz|" $entry
|
|
sed -i "s| /boot/initramfs| /initramfs|" $entry
|
|
else
|
|
sed -i "s| /vmlinuz| /boot/vmlinuz|" $entry
|
|
sed -i "s| /initramfs| /boot/initramfs|" $entry
|
|
fi
|
|
done
|
|
set -e
|
|
popd
|
|
|
|
# Since we are already aware we're using BLS, we can go ahead and
|
|
# do any cleanup to disable embedded serial console settings if they
|
|
# already exist.
|
|
if [[ "True" != "${DIB_BOOTLOADER_USE_SERIAL_CONSOLE:-True}" ]] && [[ "${VIRTUAL_TERMINAL}" == "" ]]; then
|
|
# NOTE(TheJulia): This removes any console arguments and allows grub
|
|
# to use it's default. It will also remove any embedded consoles in
|
|
# source images, which may be highly desirable if your running
|
|
# interrupt sensitive workloads, such as NFV workloads.
|
|
grubby --update-kernel ALL --remove-args=console
|
|
fi
|
|
# Print resulting grubby output for debug purposes
|
|
grubby --info=ALL
|
|
fi
|
|
|
|
if [[ ! "$ARCH" =~ "ppc" ]] && [[ -z "${DIB_BLOCK_DEVICE}" ]]; then
|
|
echo "WARNING: No bootloader installation will occur."
|
|
echo "To install a bootloader ensure you have included a block-device-* element"
|
|
exit 0
|
|
fi
|
|
|
|
echo "Installing GRUB2..."
|
|
|
|
# We need --force so grub does not fail due to being installed on the
|
|
# root partition of a block device.
|
|
GRUB_OPTS="--force "
|
|
|
|
if [[ "$ARCH" =~ "ppc" ]] ; then
|
|
# For PPC (64-Bit regardless of Endian-ness), we use the "boot"
|
|
# partition as the one to point grub-install to, not the loopback
|
|
# device. ppc has a dedicated PReP boot partition.
|
|
# For grub2 < 2.02~beta3 this needs to be a /dev/mapper/... node after
|
|
# that a dev/loopXpN node will work fine.
|
|
$GRUBNAME --modules="part_msdos" $GRUB_OPTS ${DEVICES[boot]} --no-nvram
|
|
else
|
|
# This set of modules is sufficient for all installs (mbr/gpt/efi)
|
|
modules="part_msdos part_gpt lvm"
|
|
|
|
if [[ ${DIB_BLOCK_DEVICE} == "mbr" || ${DIB_BLOCK_DEVICE} == "gpt" ]]; then
|
|
if [[ ! "x86_64 amd64" =~ ${ARCH} ]]; then
|
|
echo "*** ${ARCH} is not supported by mbr/gpt"
|
|
fi
|
|
$GRUBNAME --modules="$modules biosdisk" --target=i386-pc \
|
|
$GRUB_OPTS $BOOT_DEV
|
|
elif [[ ${DIB_BLOCK_DEVICE} == "efi" ]]; then
|
|
# We need to manually set the target if it's different to
|
|
# the host. Setup for EFI
|
|
case $ARCH in
|
|
"x86_64"|"amd64")
|
|
# This call installs grub for BIOS compatability
|
|
# which makes portable EFI/BIOS images.
|
|
$GRUBNAME --modules="$modules" --target=i386-pc $BOOT_DEV
|
|
# Set the x86_64 specific efi target for the generic
|
|
# installation below.
|
|
GRUB_OPTS="--target=x86_64-efi"
|
|
;;
|
|
# At this point, we don't need to override the target
|
|
# for any other architectures.
|
|
esac
|
|
# If we don't have a distro specific dir with presigned efi targets
|
|
# we install a generic one.
|
|
if [ ! -d /boot/efi/$EFI_BOOT_DIR ]; then
|
|
echo "WARNING: /boot/efi/$EFI_BOOT_DIR does not exist, UEFI secure boot not supported"
|
|
# This tells the EFI install to put the EFI binaries into
|
|
# the generic /BOOT directory and avoids trying to update
|
|
# nvram settings.
|
|
extra_options="--removable"
|
|
$GRUBNAME --modules="$modules" $extra_options $GRUB_OPTS $BOOT_DEV
|
|
fi
|
|
fi
|
|
fi
|