*
Overview
Grub2 has a number of differences with the original Grub. This is
especially relevant for RHEL 7 content.
Grub2’s grub.cfgis now more script than config file. There are 2
possible config files; /etc/grub2.cfglinked to /boot/grub2/grub.cfgfor
BIOS mode and /etc/grub2-efi.cfglinked to
/boot/efi/EFI/redhat/grub.cfgfor EFI mode. Changes to the source files
/etc/default/gruband /etc/grub.d/*are compiled into your grub.cfgby
grub2-mkconfig –o </path/to/relevant/grub.cfg>.
What used to be simple kernel appends in grub.confare now controlled by
/etc/default/grubin the variable GRUB_CMDLINE_LINUXfor persistent changes.
SSG inconsistency
Much of the work for grub2 has already been done in BIOS mode. Much of
the completed stuff from SSG RHEL/7/distfor Grub2 seems good and
supports both BIOS and EFI. SSG RHEL/7/inputlacks consistency with
RHEL/7/distas inputis all BIOS mode only. There are still references to
grub.confto be addressed.
EFI Grub2 is also unaddressed in the Fedora content.
EFI systems could potentially boot from either EFI or Emulated BIOS,
complicating matters when both Grub2 configs are discovered. I'm
unaware of a current requirement to boot from one or the other, or to
implement Secure Boot (requires EFI). EFI systems could potentially be
evaluated by the presence of the efivarfs mount. I don’t have a
hardware EFI system supporting Emulated BIOS boot to verify this.
# mount | grep efivarfs
efivarfs on /sys/firmware/efi/efivars type efivarfs
(rw,nosuid,nodev,noexec,relatime)
# if [ -d /sys/firmware/efi/efivars ]; then echo do EFI stuff; else echo
do BIOS stuff; fi
Previously checks were against /etc/grub.conf,now checks have to use
either /etc/grub2.cfgor /etc/grub2-efi.cfg. Additionally checks should
reference GRUB_CMDLINE_LINUXto ensure persistent changes exist (or don't).
Further, there appears to be a default reference from grub.cfgto a
custom.cfgthat can hold additional settings. Potentially
custom.cfgshould be checked as well if it exists. The custom.cfglives
along-side grub.cfgin either /boot/grub2or /boot/efi/EFI/redhatand is
sourced into the main grub.cfg.
Questions for SSG
*
When should the symbolic links /boot/grub2.cfgand
/boot/grub2-efi.cfgbe used? Config checks, REGEX?
*
When should the real files /boot/grub2/grub.cfgand
/boot/efi/EFI/redhat/grub.cfgbe used? Permission/SE Context checks?
*
When should /etc/default/grub: GRUB_CMDLINE_LINUXbe referenced?
Append operations?
*
Should /etc/grub.d/*be checked for anything, or just the resulting
grub.cfg?
*
Should custom.cfgbe checked for “hidden” settings?
*
In systems that may support both BIOS Grub2 and EFI Grub2 do we need
to check both when both exist, or attempt to discover which boot
mode we're using?
Affected SSG sections that I can locate:
1.
(bootloader_password) Bootloader password section is BIOS only.
2.
(bootloader_audit_argument) Sections adding audit=1still point to
grub.conf, it should be GRUB_CMDLINE_LINUXin /etc/default/grubfor
persistence.
3.
(enable_selinux_bootloader) Sections checking for selinux=0still
point to grub.conf, it should be relevant grub2.cfgor grub2-efi.cfg,
and GRUB_CMDLINE_LINUX.selinux=0could potentially be hidden in
custom.cfgor grub.d/*. Perhaps replace this with a check against
/proc/cmdlineto check if the running kernel was booted selinux=0?
4.
(bootloader_nousb_argument) Sections adding nousbstill point to
grub.conf, it should be GRUB_CMDLINE_LINUXfor persistence.
5.
RHEL/7/inputs/fixes/bash/*grub2_cfg.share BIOS only.
6.
RHEL/7/inputs/system/accounts/physical.xmlgrub2 sections are BIOS only.
7.
PAE-kernel section still lists grub.conf, it's now
grub2-set-default/ grub2-editenv, further RHEL 7 currently is x86_64
only so there is no PAE-kernel.
Documentation Error
If you tried to secure grub2 with a password earlier there were a couple
of typos in the docs from Fedora/Red Hat, this has been corrected.
Fixed
https://bugzilla.redhat.com/show_bug.cgi?id=1157161
grub2-mkconfig vs patched kernel
Running grub2-mkconfig as required by these Grub2 sections will cause
the system to boot the unpatched release kernel. Running the following
will fix the issue;
CKERN=$(grub2-editenv list | grep saved_entry | cut -d '=' -f2)
DKERN=$(cat /etc/grub2.cfg | grep ^menuentry | grep "${CKERN}" | awk
-F"'" '{print $4}')
grub2-set-default "${DKERN}"
Reported
https://bugzilla.redhat.com/show_bug.cgi?id=1154430
*