Overview

Grub2 has a number of differences with the original Grub. This is especially relevant for RHEL 7 content.


Grub2’s grub.cfg is now more script than config file.  There are 2 possible config files; /etc/grub2.cfg linked to /boot/grub2/grub.cfg for BIOS mode and /etc/grub2-efi.cfg linked to /boot/efi/EFI/redhat/grub.cfg for EFI mode.  Changes to the source files /etc/default/grub and /etc/grub.d/* are compiled into your grub.cfg by grub2-mkconfig –o </path/to/relevant/grub.cfg>.


What used to be simple kernel appends in grub.conf are now controlled by /etc/default/grub in the variable GRUB_CMDLINE_LINUX for persistent changes.


SSG inconsistency

Much of the work for grub2 has already been done in BIOS mode.  Much of the completed stuff from SSG RHEL/7/dist for Grub2 seems good and supports both BIOS and EFI.  SSG RHEL/7/input lacks consistency with RHEL/7/dist as input is all BIOS mode only.  There are still references to grub.conf to be addressed.


EFI Grub2 is also unaddressed in the Fedora content.


EFI systems could potentially boot from either EFI or Emulated BIOS, complicating matters when both Grub2 configs are discovered.  I'm unaware of a current requirement to boot from one or the other, or to implement Secure Boot (requires EFI).  EFI systems could potentially be evaluated by the presence of the efivarfs mount.  I don’t have a hardware EFI system supporting Emulated BIOS boot to verify this.


# mount | grep efivarfs

efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,nosuid,nodev,noexec,relatime)

# if [ -d /sys/firmware/efi/efivars ]; then echo do EFI stuff; else echo do BIOS stuff; fi


Previously checks were against /etc/grub.conf, now checks have to use either /etc/grub2.cfg or /etc/grub2-efi.cfg.  Additionally checks should reference GRUB_CMDLINE_LINUX to ensure persistent changes exist (or don't).

Further, there appears to be a default reference from grub.cfg to a custom.cfg that can hold additional settings.  Potentially custom.cfg should be checked as well if it exists.  The custom.cfg lives along-side grub.cfg in either /boot/grub2 or /boot/efi/EFI/redhat and is sourced into the main grub.cfg.


Questions for SSG


Affected SSG sections that I can locate:

  1. (bootloader_password) Bootloader password section is BIOS only.

  2. (bootloader_audit_argument) Sections adding audit=1 still point to grub.conf, it should be GRUB_CMDLINE_LINUX in /etc/default/grub for persistence.

  3. (enable_selinux_bootloader) Sections checking for selinux=0 still point to grub.conf, it should be relevant grub2.cfg or grub2-efi.cfg, and GRUB_CMDLINE_LINUX. selinux=0 could potentially be hidden in custom.cfg or grub.d/*.  Perhaps replace this with a check against /proc/cmdline to check if the running kernel was booted selinux=0?

  4. (bootloader_nousb_argument) Sections adding nousb still point to grub.conf, it should be GRUB_CMDLINE_LINUX for persistence.

  5. RHEL/7/inputs/fixes/bash/*grub2_cfg.sh are BIOS only.

  6. RHEL/7/inputs/system/accounts/physical.xml grub2 sections are BIOS only.

  7. PAE-kernel section still lists grub.conf, it's now grub2-set-default / grub2-editenv, further RHEL 7 currently is x86_64 only so there is no PAE-kernel.


Documentation Error

If you tried to secure grub2 with a password earlier there were a couple of typos in the docs from Fedora/Red Hat, this has been corrected.

Fixed https://bugzilla.redhat.com/show_bug.cgi?id=1157161


grub2-mkconfig vs patched kernel

Running grub2-mkconfig as required by these Grub2 sections will cause the system to boot the unpatched release kernel.  Running the following will fix the issue;


CKERN=$(grub2-editenv list | grep saved_entry | cut -d '=' -f2)

DKERN=$(cat /etc/grub2.cfg | grep ^menuentry | grep "${CKERN}" | awk -F"'" '{print $4}')

grub2-set-default "${DKERN}"


Reported https://bugzilla.redhat.com/show_bug.cgi?id=1154430