Rework grub2 default static config #841

champtar · 2025-02-07T14:29:59Z

Rework grub2 default static config

Add support for GRUB2_PASSWORD in user.cfg (partially fix https://issues.redhat.com/browse/RHEL-78299)
include dropins instead of sourcing them, this should help updating config in the future
add multiple small dropins to match classic grub2 installs

openshift-ci · 2025-02-07T14:30:10Z

Hi @champtar. Thanks for your PR.

I'm waiting for a coreos member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

champtar · 2025-02-10T15:39:51Z

Can someone with CI / FCOS knowledge chime in ? I think 10_blscfg and other configs.d are not copied in the continuous-integration/jenkins/pr-merge test, is this expected ? ie does FCOS overwrite the full folder, or we are just testing the binary and not the full rpm ?
c9s CI works ok / I can see the new files being used.

champtar · 2025-02-24T15:48:28Z

@cgwalters any opinions on this PR ?

champtar · 2025-03-13T14:15:33Z

Anyone ?

champtar · 2025-03-14T18:48:02Z

@HuijingHei maybe ?

cgwalters

So sorry for the delay on review here! I really value your contributions overall. You've chosen to work on some thorny problems, which is good but for this particular code we're highly subject to regressions.

Overall though, I see no issues in this so far, and probably what we need to do is just try to land it and maybe put it in Rawhide and soak for a bit.

Actually after landing here in git main it will appear in the bootc base-images-dev and we have CI coverage of that.

cgwalters · 2025-03-14T19:42:49Z

/ok-to-test

cgwalters · 2025-03-14T19:43:26Z

That all said it does look quite likely related that the upgrade test failed here https://jenkins-coreos-ci.apps.ocp.fedoraproject.org/job/bootupd/job/PR-841/6/artifact/tmp/console.txt

champtar · 2025-03-14T20:30:48Z

That all said it does look quite likely related that the upgrade test failed here https://jenkins-coreos-ci.apps.ocp.fedoraproject.org/job/bootupd/job/PR-841/6/artifact/tmp/console.txt

See my previous comment #841 (comment), I bet the failing test only copy the new binary and not the new configs.d

champtar · 2025-03-15T03:00:16Z

My ci fix is ignored, should I move it to another PR that we merge first, then rebase on top ?

cgwalters · 2025-03-15T13:05:44Z

My ci fix is ignored, should I move it to another PR that we merge first, then rebase on top ?

ci: also install grub config and systemd unit looks correct to me and would indeed make sense to aim to land as a distinct PR.

champtar · 2025-03-16T00:13:32Z

#879 need to be merged first then I can rebase on top

HuijingHei · 2025-03-17T06:44:27Z

LGTM, and I tried using bootc, and check the new created grub.cfg includes:

# Other package code will be injected from here

### BEGIN 01_grub2_password.cfg ###
# Keep the comment for grub2-set-password
### BEGIN /etc/grub.d/01_users ###
if [ -f ${prefix}/user.cfg ]; then
  source ${prefix}/user.cfg
  if [ -n "${GRUB2_PASSWORD}" ]; then
    set superusers="root"
    export superusers
    password_pbkdf2 root ${GRUB2_PASSWORD}
  fi
fi
### END 01_grub2_password.cfg ###

### BEGIN 10_blscfg.cfg ###
blscfg
### END 10_blscfg.cfg ###

### BEGIN 14_menu_show_once.cfg ###
if [ "${menu_show_once_timeout}" ]; then
  set timeout_style=menu
  set timeout="${menu_show_once_timeout}"
  unset menu_show_once_timeout
  save_env menu_show_once_timeout
fi
### END 14_menu_show_once.cfg ###

### BEGIN 30_uefi-firmware.cfg ###
if [ "$grub_platform" = "efi" ]; then
        menuentry 'UEFI Firmware Settings' $menuentry_id_option 'uefi-firmware' {
                fwsetup
        }
fi
### END 30_uefi-firmware.cfg ###

### BEGIN 41_custom.cfg ###
if [ -f $prefix/custom.cfg ]; then
  source $prefix/custom.cfg
fi
### END 41_custom.cfg ###

The steps are:
Containerfile:

FROM quay.io/fedora/fedora-bootc:41
RUN rm -f /usr/libexec/bootupd && \
    rm -f /usr/bin/bootupctl
COPY bootupd/bootupd/usr /usr

Use bootc install to install grub.cfg:

# sudo podman build -t bootc-test .

# sudo truncate -s 10G disk.raw
# sudo podman run \
            --rm \
            -ti \
            --privileged \
            --pid=host \
            --security-opt label=disable \
            -v /var/lib/containers:/var/lib/containers \
            -v /dev:/dev \
            -v .:/output \
            bootc-test:latest \
            env BOOTC_BOOTLOADER_DEBUG=1 bootc install to-disk --filesystem xfs --skip-fetch-check --generic-image --via-loopback /output/disk.raw
# sudo losetup -fP disk.raw
# sudo mount -t xfs /dev/loop0p3 /mnt
# cat /mnt/boot/grub2/grub.cfg

HuijingHei · 2025-03-17T10:07:38Z

Need to fix CI first.

champtar · 2025-03-17T12:22:22Z

Need to fix CI first.

In console.txt boot seems ok (https://jenkins-coreos-ci.apps.ocp.fedoraproject.org/job/bootupd/job/PR-841/8/artifact/tmp/console.txt), but kola qemuexec timeout (https://jenkins-coreos-ci.apps.ocp.fedoraproject.org/blue/rest/organizations/jenkins/pipelines/bootupd/branches/PR-841/runs/8/log/?start=0)
comparing with a sucessfull boot, ignition.firstboot kargs is missing, but ignition.platform.id=qemu is present

champtar · 2025-03-17T12:35:55Z

Ok I'm actually breaking ignition because 40_coreos-ignition.cfg is now after blscfg

[2025-03-17T02:47:25.147Z] Added 01_grub2_password.cfg
[2025-03-17T02:47:25.147Z] Added 10_blscfg.cfg
[2025-03-17T02:47:25.147Z] Added 14_menu_show_once.cfg
[2025-03-17T02:47:25.147Z] Added 30_uefi-firmware.cfg
[2025-03-17T02:47:25.147Z] Added 40_coreos-ignition.cfg
[2025-03-17T02:47:25.147Z] Added 41_custom.cfg
[2025-03-17T02:47:25.147Z] Added 70_coreos-user.cfg

champtar · 2025-03-17T13:29:09Z

Reordered the files a bit to see if it fixes, if yes I'll need to change ignition.cfg to 40_ignition.cfg
BTW 70_coreos-user.cfg is not needed for a long time I think

champtar · 2025-03-17T14:25:28Z

Jenkins seems to be broken right now

cgwalters · 2025-03-18T16:05:44Z

/ok-to-test

champtar · 2025-03-18T17:26:58Z

PR for greenboot: fedora-iot/greenboot#214

champtar · 2025-03-18T17:58:59Z

On a legacy grub install we have:

00_header (load_env / ...)
01_users (user.cfg / GRUB2_PASSWORD)
08_fallback_counting
10_linux (blscfg ++)
10_reset_boot_success (goes with 08_fallback_counting)
12_menu_auto_hide (goes with 08_fallback_counting)
14_menu_show_once
20_linux_xen
20_ppc_terminfo
30_os-prober
30_uefi-firmware (must be after blscfg as we want to firmware menu to be last)
35_fwupd (no equivalent)
40_custom
41_custom (source custom.cfg)

Before this PR we have

grub-static-pre.cfg (bootuuid.cfg / load_env / console.cfg / menuentry_id_option / all_video)
40_coreos-ignition.cfg
greenboot.cfg
grub-static-post.cfg (timeout / user.cfg / blscfg)

After all the PRs we should have:

grub-static-pre.cfg (bootuuid.cfg / load_env / console.cfg / menuentry_id_option / all_video) + timeout
01_grub2_password.cfg (user.cfg / GRUB2_PASSWORD)
08_greenboot.cfg (== 08_fallback_counting + 10_reset_boot_success)
40_coreos-ignition.cfg or 40_ignition.cfg
50_blscfg.cfg (blscfg / == 10_linux)
60_menu_show_once.cfg (== 14_menu_show_once)
70_uefi-firmware.cfg (== 30_uefi-firmware)
80_custom.cfg (== 41_custom)

So the ordering related to blscfg is preserved (can break ignition and uefi-firmware), user.cfg + timeout are way sooner but this match legacy grub install

How do we want to go forward with this PR ?

champtar · 2025-03-18T18:47:22Z

As no one is using ignition-ignition-grub (coreos/ignition#2037 (comment)), should we just rename to 05_ignition.cfg and same in fedora-coreos-config, so we can keep the numbering the same as in legacy grub ?

champtar · 2025-03-19T13:52:08Z

I went ahead and opened a PR to rename to 05_ignition.cfg: coreos/fedora-coreos-config#3406

champtar · 2025-03-19T13:54:15Z

(draft until coreos/fedora-coreos-config#3406 lands)

src/grub2/configs.d/14_menu_show_once.cfg

src/grub2/configs.d/01_grub2_password.cfg

dustymabe · 2025-03-19T17:51:06Z

As no one is using ignition-ignition-grub (coreos/ignition#2037 (comment)), should we just rename to 05_ignition.cfg and same in fedora-coreos-config, so we can keep the numbering the same as in legacy grub ?

let's assume the rename to 05_ignition.cfg lands.. what will the new order (like what you detailed in #841 (comment)) look like?

champtar · 2025-03-19T21:11:26Z

As no one is using ignition-ignition-grub (coreos/ignition#2037 (comment)), should we just rename to 05_ignition.cfg and same in fedora-coreos-config, so we can keep the numbering the same as in legacy grub ?

let's assume the rename to 05_ignition.cfg lands.. what will the new order (like what you detailed in #841 (comment)) look like?

@dustymabe I would remove the last commit, so that would be:

grub-static-pre.cfg (bootuuid.cfg / load_env / console.cfg / menuentry_id_option / all_video) + timeout
01_grub2_password.cfg (user.cfg / GRUB2_PASSWORD)
05_ignition.cfg
08_greenboot.cfg (== 08_fallback_counting + 10_reset_boot_success)
10_blscfg.cfg (blscfg / == 10_linux)
14_menu_show_once.cfg (== 14_menu_show_once)
30_uefi-firmware.cfg (== 30_uefi-firmware)
41_custom.cfg (== 41_custom)

dustymabe · 2025-03-20T02:54:10Z

at the top of each of the files should we mention the legacy version of GRUB config they correspond to?

champtar · 2025-03-20T16:53:42Z

Now waiting for coreos/fedora-coreos-config#3407

dustymabe · 2025-03-20T17:36:45Z

Now waiting for coreos/fedora-coreos-config#3407

Merged

user.cfg, despite his name, is usually used to store GRUB2_PASSWORD variable: - grub2-set-password utility overwrite the whole file - security scanners look at the content of user.cfg https://github.com/ComplianceAsCode/content/blob/47fd3bcded59116ade8ea09eb396f363e37813d4/linux_os/guide/system/bootloader-grub2/uefi/grub2_uefi_password/oval/shared.xml Copy the content of the legacy /etc/grub.d/01_users as 01_users.cfg, and add 41_custom.cfg to source custom.cfg for people in need of custom configs. This gets us closer to classic grub2-mkconfig behaviour.

Both features were added 13 years ago. feature_menuentry_id was added in rhboot/grub2@d9bef9b feature_all_video_module was added in rhboot/grub2@22c7ce8

In classic install timeout setting is at the end of 00_header, being at the end of grub-static-pre.cfg is equivalent. This allow to overide the timeout setting using configs.d. While at it remove the feature_timeout_style check as the feature was added 12 years ago in rhboot/grub2@8f236c1

This allows to add menu entries after the BLS entries, for exemple 'UEFI Firmware Settings'.

This will make updating config easier as there will be no need to cleanup dropins files in /boot/grub2/.

champtar · 2025-03-20T19:32:38Z

Waiting for fedora-iot/greenboot#214,
but this can be reviewed again / tested again

HuijingHei · 2025-03-21T07:39:46Z

Use bootc to build image, and verify with the patch that grub password works. Let me know if other tests are needed.

Build container image with bootupd

# cat Containerfile
FROM quay.io/fedora/fedora-bootc:41
RUN rm -f /usr/libexec/bootupd && \
    rm -f /usr/bin/bootupctl
COPY bootupd/bootupd/usr /usr

# sudo podman build -t bootc-test .

Build image using bootc

# sudo truncate -s 10G disk.raw
# sudo podman run --rm --privileged -v /var/lib/containers/storage:/var/lib/containers/storage --security-opt label=type:unconfined_t --pid=host -v /var/lib/containers:/var/lib/containers -v /dev:/dev -v $PWD:/output bootc-test:latest env BOOTC_BOOTLOADER_DEBUG=1 bootc install to-disk --filesystem "xfs" --karg=console=tty0 --karg=console=ttyS0,115200n8  --skip-fetch-check --root-ssh-authorized-keys /output/id_rsa.pub --generic-image --via-loopback /output/disk.raw

Using libvirt to start image:

sudo virt-install \
    --name fedora-bootc \
    --cpu host-model \
    --vcpus 4 \
    --memory 4096 \
    --import --disk disk.raw,format=qcow2 \
    --os-variant fedora-eln \
    --autoconsole text \
    --boot menu=on,useserial=on

Manually run grub2-setpassword and reboot, check that if want to edit grub menu that requires password.

# ls /usr/lib/bootupd/grub2-static/configs.d
01_users.cfg  10_blscfg.cfg  14_menu_show_once.cfg  30_uefi-firmware.cfg  41_custom.cfg

openshift-ci bot added the needs-ok-to-test label Feb 7, 2025

champtar force-pushed the grub2-password branch 2 times, most recently from 25c7a37 to 8710963 Compare February 8, 2025 02:35

champtar changed the title ~~Add GRUB2_PASSWORD support, source custom.cfg~~ Rework grub default static config Feb 8, 2025

champtar changed the title ~~Rework grub default static config~~ Rework grub2 default static config Feb 8, 2025

champtar force-pushed the grub2-password branch 3 times, most recently from faddad9 to 74ff55c Compare February 8, 2025 04:21

cgwalters approved these changes Mar 14, 2025

View reviewed changes

openshift-ci bot added ok-to-test and removed needs-ok-to-test labels Mar 14, 2025

champtar force-pushed the grub2-password branch from 74ff55c to e422843 Compare March 15, 2025 00:56

champtar force-pushed the grub2-password branch from e422843 to ca96bf5 Compare March 17, 2025 02:31

champtar mentioned this pull request Mar 18, 2025

Bootupd grub2 static ordering fedora-iot/greenboot#214

Open

champtar marked this pull request as draft March 19, 2025 13:53

openshift-ci bot added the do-not-merge/work-in-progress label Mar 19, 2025

dustymabe reviewed Mar 19, 2025

View reviewed changes

src/grub2/configs.d/14_menu_show_once.cfg Outdated Show resolved Hide resolved

dustymabe reviewed Mar 19, 2025

View reviewed changes

src/grub2/configs.d/01_grub2_password.cfg Outdated Show resolved Hide resolved

champtar added 6 commits March 20, 2025 13:39

grub2: remove outdated checks

3934030

Both features were added 13 years ago. feature_menuentry_id was added in rhboot/grub2@d9bef9b feature_all_video_module was added in rhboot/grub2@22c7ce8

grub2: move blscfg to configs.d

39d3599

This allows to add menu entries after the BLS entries, for exemple 'UEFI Firmware Settings'.

grubconfigs: include dropins instead of sourcing

a01079c

This will make updating config easier as there will be no need to cleanup dropins files in /boot/grub2/.

grub2: add 'UEFI Firmware Settings' menuentry

683eb9d

champtar force-pushed the grub2-password branch from 23a3c83 to 07b984f Compare March 20, 2025 17:39

champtar marked this pull request as ready for review March 20, 2025 17:40

openshift-ci bot removed the do-not-merge/work-in-progress label Mar 20, 2025

grub2: add support for menu_show_once_timeout

Loading
Loading status checks…

741e9a5

champtar force-pushed the grub2-password branch from 07b984f to 741e9a5 Compare March 20, 2025 18:09

HuijingHei approved these changes Mar 21, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Rework grub2 default static config #841

Rework grub2 default static config #841

champtar commented Feb 7, 2025 •

edited

Loading

openshift-ci bot commented Feb 7, 2025

champtar commented Feb 10, 2025

champtar commented Feb 24, 2025

champtar commented Mar 13, 2025

champtar commented Mar 14, 2025

cgwalters left a comment

cgwalters commented Mar 14, 2025

cgwalters commented Mar 14, 2025

champtar commented Mar 14, 2025

champtar commented Mar 15, 2025

cgwalters commented Mar 15, 2025

champtar commented Mar 16, 2025

HuijingHei commented Mar 17, 2025

HuijingHei commented Mar 17, 2025

champtar commented Mar 17, 2025

champtar commented Mar 17, 2025

champtar commented Mar 17, 2025

champtar commented Mar 17, 2025

cgwalters commented Mar 18, 2025

champtar commented Mar 18, 2025

champtar commented Mar 18, 2025

champtar commented Mar 18, 2025 •

edited

Loading

champtar commented Mar 19, 2025

champtar commented Mar 19, 2025

dustymabe commented Mar 19, 2025

champtar commented Mar 19, 2025

dustymabe commented Mar 20, 2025

champtar commented Mar 20, 2025

dustymabe commented Mar 20, 2025

champtar commented Mar 20, 2025

HuijingHei commented Mar 21, 2025

Rework grub2 default static config #841

Are you sure you want to change the base?

Rework grub2 default static config #841

Conversation

champtar commented Feb 7, 2025 • edited Loading

openshift-ci bot commented Feb 7, 2025

champtar commented Feb 10, 2025

champtar commented Feb 24, 2025

champtar commented Mar 13, 2025

champtar commented Mar 14, 2025

cgwalters left a comment

Choose a reason for hiding this comment

cgwalters commented Mar 14, 2025

cgwalters commented Mar 14, 2025

champtar commented Mar 14, 2025

champtar commented Mar 15, 2025

cgwalters commented Mar 15, 2025

champtar commented Mar 16, 2025

HuijingHei commented Mar 17, 2025

HuijingHei commented Mar 17, 2025

champtar commented Mar 17, 2025

champtar commented Mar 17, 2025

champtar commented Mar 17, 2025

champtar commented Mar 17, 2025

cgwalters commented Mar 18, 2025

champtar commented Mar 18, 2025

champtar commented Mar 18, 2025

champtar commented Mar 18, 2025 • edited Loading

champtar commented Mar 19, 2025

champtar commented Mar 19, 2025

dustymabe commented Mar 19, 2025

champtar commented Mar 19, 2025

dustymabe commented Mar 20, 2025

champtar commented Mar 20, 2025

dustymabe commented Mar 20, 2025

champtar commented Mar 20, 2025

HuijingHei commented Mar 21, 2025

champtar commented Feb 7, 2025 •

edited

Loading

champtar commented Mar 18, 2025 •

edited

Loading