<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<b style="font-weight:normal;"
id="docs-internal-guid-080c786f-3f2a-d029-a592-ff113c8a9ace">
<h3 dir="ltr"
style="line-height:1;margin-top:12pt;margin-bottom:3pt;"><span
style="font-size:17px;font-family:Arial;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Overview</span></h3>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Grub2
has a number of differences with the original Grub. This is
especially relevant for RHEL 7 content.</span></p>
<br>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Grub2’s
</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
is now more script than config file. There are 2 possible
config files; </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/grub2.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
linked to </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/grub2/grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
for BIOS mode and </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/grub2-efi.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
linked to </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/efi/EFI/redhat/grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
for EFI mode. Changes to the source files </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/default/grub</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
and </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/grub.d/*</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
are compiled into your </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
by </span><span
style="font-size:16px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub2-mkconfig
–o </path/to/relevant/grub.cfg></span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">.</span></p>
<br>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">What
used to be simple kernel appends in </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.conf</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
are now controlled by </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/default/grub</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
in the variable </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">GRUB_CMDLINE_LINUX</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
for persistent changes.</span></p>
<br>
<h3 dir="ltr"
style="line-height:1;margin-top:12pt;margin-bottom:3pt;"><span
style="font-size:17px;font-family:Arial;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">SSG
inconsistency</span></h3>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Much
of the work for grub2 has already been done in BIOS mode.
Much of the completed stuff from SSG </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">RHEL/7/dist</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
for Grub2 seems good and supports both BIOS and EFI. SSG </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">RHEL/7/input</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
lacks consistency with </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">RHEL/7/dist</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
as </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">input</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
is all BIOS mode only. There are still references to </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.conf</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
to be addressed.</span></p>
<br>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">EFI
Grub2 is also unaddressed in the Fedora content.</span></p>
<br>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">EFI
systems could potentially boot from either EFI or Emulated
BIOS, complicating matters when both Grub2 configs are
discovered. I'm unaware of a current requirement to boot from
one or the other, or to implement Secure Boot (requires EFI).
EFI systems could potentially be evaluated by the presence of
the efivarfs mount. I don’t have a hardware EFI system
supporting Emulated BIOS boot to verify this.</span></p>
<br>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:15px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">#
mount | grep efivarfs</span></p>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:15px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">efivarfs
on /sys/firmware/efi/efivars type efivarfs
(rw,nosuid,nodev,noexec,relatime)</span></p>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:15px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">#
if [ -d /sys/firmware/efi/efivars ]; then echo do EFI stuff;
else echo do BIOS stuff; fi</span></p>
<br>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Previously
checks were against </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/grub.conf,</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
now checks have to use either </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/grub2.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
or </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/grub2-efi.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">.
Additionally checks should reference </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">GRUB_CMDLINE_LINUX</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
to ensure persistent changes exist (or don't).</span></p>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
</span></p>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Further,
there appears to be a default reference from </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
to a </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">custom.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
that can hold additional settings. Potentially </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">custom.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
should be checked as well if it exists. The </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">custom.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
lives along-side </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
in either </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/grub2</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
or </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/efi/EFI/redhat</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
and is sourced into the main </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">.</span></p>
<br>
<h3 dir="ltr"
style="line-height:1;margin-top:12pt;margin-bottom:3pt;"><span
style="font-size:17px;font-family:Arial;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Questions
for SSG</span></h3>
<ul style="margin-top:0pt;margin-bottom:0pt;">
<li dir="ltr"
style="list-style-type:disc;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
24px;">
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">When
should the symbolic links </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/grub2.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
and </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/grub2-efi.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
be used? Config checks, REGEX?</span></p>
</li>
<li dir="ltr"
style="list-style-type:disc;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
24px;">
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">When
should the real files </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/grub2/grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
and </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/efi/EFI/redhat/grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
be used? Permission/SE Context checks?</span></p>
</li>
<li dir="ltr"
style="list-style-type:disc;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
24px;">
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">When
should </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/default/grub</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
: </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">GRUB_CMDLINE_LINUX</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
be referenced? Append operations?</span></p>
</li>
<li dir="ltr"
style="list-style-type:disc;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
24px;">
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Should
</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/grub.d/*</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
be checked for anything, or just the resulting </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">?</span></p>
</li>
<li dir="ltr"
style="list-style-type:disc;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
24px;">
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Should
</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">custom.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
be checked for “hidden” settings?</span></p>
</li>
<li dir="ltr"
style="list-style-type:disc;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
24px;">
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">In
systems that may support both BIOS Grub2 and EFI Grub2 do
we need to check both when both exist, or attempt to
discover which boot mode we're using?</span></p>
</li>
</ul>
<br>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Affected
SSG sections that I can locate:</span></p>
<ol style="margin-top:0pt;margin-bottom:0pt;">
<li dir="ltr"
style="list-style-type:decimal;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
24px;">
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">(bootloader_password)
Bootloader password section is BIOS only.</span></p>
</li>
<li dir="ltr"
style="list-style-type:decimal;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
24px;">
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">(bootloader_audit_argument)
Sections adding </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">audit=1</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
still point to </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.conf</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">,
it should be </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">GRUB_CMDLINE_LINUX</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
in </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/default/grub</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
for persistence.</span></p>
</li>
<li dir="ltr"
style="list-style-type:decimal;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
24px;">
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">(enable_selinux_bootloader)
Sections checking for </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">selinux=0</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
still point to </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.conf</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">,
it should be relevant </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub2.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
or </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub2-efi.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">,
and </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">GRUB_CMDLINE_LINUX.</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">selinux=0</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
could potentially be hidden in </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">custom.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
or </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.d/*</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">.
Perhaps replace this with a check against </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/proc/cmdline</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
to check if the running kernel was booted </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">selinux=0</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">?</span></p>
</li>
<li dir="ltr"
style="list-style-type:decimal;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
24px;">
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">(bootloader_nousb_argument)
Sections adding </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">nousb</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
still point to </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.conf</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">,
it should be </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">GRUB_CMDLINE_LINUX</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
for persistence.</span></p>
</li>
<li dir="ltr"
style="list-style-type:decimal;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
24px;">
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">RHEL/7/inputs/fixes/bash/*grub2_cfg.sh</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
are BIOS only.</span></p>
</li>
<li dir="ltr"
style="list-style-type:decimal;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
24px;">
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">RHEL/7/inputs/system/accounts/physical.xml</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
grub2 sections are BIOS only.</span></p>
</li>
<li dir="ltr"
style="list-style-type:decimal;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
24px;">
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">PAE-kernel
section still lists </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.conf</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">,
it's now </span><span
style="font-size:16px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub2-set-default</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
/ </span><span
style="font-size:16px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub2-editenv</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">,
further RHEL 7 currently is x86_64 only so there is no
PAE-kernel.</span></p>
</li>
</ol>
<br>
<h3 dir="ltr"
style="line-height:1;margin-top:12pt;margin-bottom:3pt;"><span
style="font-size:17px;font-family:Arial;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Documentation
Error</span></h3>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">If
you tried to secure grub2 with a password earlier there were a
couple of typos in the docs from Fedora/Red Hat, this has been
corrected.</span></p>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Fixed
</span><a
href="https://bugzilla.redhat.com/show_bug.cgi?id=1157161"
style="text-decoration:none;"><span
style="font-size:13px;font-family:Calibri;color:#0000ff;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:underline;vertical-align:baseline;white-space:pre-wrap;">https://bugzilla.redhat.com/show_bug.cgi?id=1157161</span></a></p>
<br>
<h3 dir="ltr"
style="line-height:1;margin-top:12pt;margin-bottom:3pt;"><span
style="font-size:17px;font-family:Arial;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub2-mkconfig
vs patched kernel</span></h3>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Running
grub2-mkconfig as required by these Grub2 sections will cause
the system to boot the unpatched release kernel. Running the
following will fix the issue;</span></p>
<br>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">CKERN=$(grub2-editenv
list | grep saved_entry | cut -d '=' -f2)</span></p>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">DKERN=$(cat
/etc/grub2.cfg | grep ^menuentry | grep "${CKERN}" | awk -F"'"
'{print $4}')</span></p>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub2-set-default
"${DKERN}"</span></p>
<br>
<p dir="ltr"
style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Reported
</span><a
href="https://bugzilla.redhat.com/show_bug.cgi?id=1154430"
style="text-decoration:none;"><span
style="font-size:13px;font-family:Calibri;color:#1155cc;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:underline;vertical-align:baseline;white-space:pre-wrap;">https://bugzilla.redhat.com/show_bug.cgi?id=1154430</span></a></p>
</b><br class="Apple-interchange-newline">
<meta charset="utf-8">
</body>
</html>