<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=utf-8">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    <meta http-equiv="content-type" content="text/html; charset=utf-8">
    <b style="font-weight:normal;"
      id="docs-internal-guid-080c786f-3f2a-d029-a592-ff113c8a9ace">
      <h3 dir="ltr"
        style="line-height:1;margin-top:12pt;margin-bottom:3pt;"><span
style="font-size:17px;font-family:Arial;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Overview</span></h3>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Grub2
          has a number of differences with the original Grub. This is
          especially relevant for RHEL 7 content.</span></p>
      <br>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Grub2’s
        </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          is now more script than config file.  There are 2 possible
          config files; </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/grub2.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          linked to </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/grub2/grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          for BIOS mode and </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/grub2-efi.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          linked to </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/efi/EFI/redhat/grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          for EFI mode.  Changes to the source files </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/default/grub</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          and </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/grub.d/*</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          are compiled into your </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          by </span><span
style="font-size:16px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub2-mkconfig
          –o &lt;/path/to/relevant/grub.cfg&gt;</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">.</span></p>
      <br>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">What
          used to be simple kernel appends in </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.conf</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          are now controlled by </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/default/grub</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          in the variable </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">GRUB_CMDLINE_LINUX</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          for persistent changes.</span></p>
      <br>
      <h3 dir="ltr"
        style="line-height:1;margin-top:12pt;margin-bottom:3pt;"><span
style="font-size:17px;font-family:Arial;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">SSG
          inconsistency</span></h3>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Much
          of the work for grub2 has already been done in BIOS mode.
           Much of the completed stuff from SSG </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">RHEL/7/dist</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          for Grub2 seems good and supports both BIOS and EFI.  SSG </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">RHEL/7/input</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          lacks consistency with </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">RHEL/7/dist</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          as </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">input</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          is all BIOS mode only.  There are still references to </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.conf</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          to be addressed.</span></p>
      <br>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">EFI
          Grub2 is also unaddressed in the Fedora content.</span></p>
      <br>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">EFI
          systems could potentially boot from either EFI or Emulated
          BIOS, complicating matters when both Grub2 configs are
          discovered.  I'm unaware of a current requirement to boot from
          one or the other, or to implement Secure Boot (requires EFI).
           EFI systems could potentially be evaluated by the presence of
          the efivarfs mount.  I don’t have a hardware EFI system
          supporting Emulated BIOS boot to verify this.</span></p>
      <br>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:15px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">#
          mount | grep efivarfs</span></p>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:15px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">efivarfs
          on /sys/firmware/efi/efivars type efivarfs
          (rw,nosuid,nodev,noexec,relatime)</span></p>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:15px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">#
          if [ -d /sys/firmware/efi/efivars ]; then echo do EFI stuff;
          else echo do BIOS stuff; fi</span></p>
      <br>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Previously
          checks were against </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/grub.conf,</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          now checks have to use either </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/grub2.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          or </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/grub2-efi.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">.
           Additionally checks should reference </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">GRUB_CMDLINE_LINUX</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          to ensure persistent changes exist (or don't).</span></p>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
        </span></p>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Further,
          there appears to be a default reference from </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          to a </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">custom.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          that can hold additional settings.  Potentially </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">custom.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          should be checked as well if it exists.  The </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">custom.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          lives along-side </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          in either </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/grub2</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          or </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/efi/EFI/redhat</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
          and is sourced into the main </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">.</span></p>
      <br>
      <h3 dir="ltr"
        style="line-height:1;margin-top:12pt;margin-bottom:3pt;"><span
style="font-size:17px;font-family:Arial;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Questions
          for SSG</span></h3>
      <ul style="margin-top:0pt;margin-bottom:0pt;">
        <li dir="ltr"
          style="list-style-type:disc;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
          24px;">
          <p dir="ltr"
            style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">When
              should the symbolic links </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/grub2.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              and </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/grub2-efi.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              be used? Config checks, REGEX?</span></p>
        </li>
        <li dir="ltr"
          style="list-style-type:disc;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
          24px;">
          <p dir="ltr"
            style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">When
              should the real files </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/grub2/grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              and </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/boot/efi/EFI/redhat/grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              be used? Permission/SE Context checks?</span></p>
        </li>
        <li dir="ltr"
          style="list-style-type:disc;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
          24px;">
          <p dir="ltr"
            style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">When
              should </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/default/grub</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              : </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">GRUB_CMDLINE_LINUX</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              be referenced? Append operations?</span></p>
        </li>
        <li dir="ltr"
          style="list-style-type:disc;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
          24px;">
          <p dir="ltr"
            style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Should
            </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/grub.d/*</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              be checked for anything, or just the resulting </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">?</span></p>
        </li>
        <li dir="ltr"
          style="list-style-type:disc;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
          24px;">
          <p dir="ltr"
            style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Should
            </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">custom.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              be checked for “hidden” settings?</span></p>
        </li>
        <li dir="ltr"
          style="list-style-type:disc;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
          24px;">
          <p dir="ltr"
            style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">In
              systems that may support both BIOS Grub2 and EFI Grub2 do
              we need to check both when both exist, or attempt to
              discover which boot mode we're using?</span></p>
        </li>
      </ul>
      <br>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Affected
          SSG sections that I can locate:</span></p>
      <ol style="margin-top:0pt;margin-bottom:0pt;">
        <li dir="ltr"
          style="list-style-type:decimal;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
          24px;">
          <p dir="ltr"
            style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">(bootloader_password)
              Bootloader password section is BIOS only.</span></p>
        </li>
        <li dir="ltr"
          style="list-style-type:decimal;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
          24px;">
          <p dir="ltr"
            style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">(bootloader_audit_argument)
              Sections adding </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">audit=1</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              still point to </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.conf</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">,
              it should be </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">GRUB_CMDLINE_LINUX</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              in </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/etc/default/grub</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              for persistence.</span></p>
        </li>
        <li dir="ltr"
          style="list-style-type:decimal;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
          24px;">
          <p dir="ltr"
            style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">(enable_selinux_bootloader)
              Sections checking for </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">selinux=0</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              still point to </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.conf</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">,
              it should be relevant </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub2.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              or </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub2-efi.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">,
              and </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">GRUB_CMDLINE_LINUX.</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
            </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">selinux=0</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              could potentially be hidden in </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">custom.cfg</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              or </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.d/*</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">.
               Perhaps replace this with a check against </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">/proc/cmdline</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              to check if the running kernel was booted </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">selinux=0</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">?</span></p>
        </li>
        <li dir="ltr"
          style="list-style-type:decimal;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
          24px;">
          <p dir="ltr"
            style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">(bootloader_nousb_argument)
              Sections adding </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">nousb</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              still point to </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.conf</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">,
              it should be </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">GRUB_CMDLINE_LINUX</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              for persistence.</span></p>
        </li>
        <li dir="ltr"
          style="list-style-type:decimal;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
          24px;">
          <p dir="ltr"
            style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">RHEL/7/inputs/fixes/bash/*grub2_cfg.sh</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              are BIOS only.</span></p>
        </li>
        <li dir="ltr"
          style="list-style-type:decimal;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
          24px;">
          <p dir="ltr"
            style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">RHEL/7/inputs/system/accounts/physical.xml</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              grub2 sections are BIOS only.</span></p>
        </li>
        <li dir="ltr"
          style="list-style-type:decimal;font-size:13px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;margin-left:
          24px;">
          <p dir="ltr"
            style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">PAE-kernel
              section still lists </span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:italic;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub.conf</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">,
              it's now </span><span
style="font-size:16px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub2-set-default</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">
              / </span><span
style="font-size:16px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub2-editenv</span><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">,
              further RHEL 7 currently is x86_64 only so there is no
              PAE-kernel.</span></p>
        </li>
      </ol>
      <br>
      <h3 dir="ltr"
        style="line-height:1;margin-top:12pt;margin-bottom:3pt;"><span
style="font-size:17px;font-family:Arial;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Documentation
          Error</span></h3>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">If
          you tried to secure grub2 with a password earlier there were a
          couple of typos in the docs from Fedora/Red Hat, this has been
          corrected.</span></p>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Fixed
        </span><a
          href="https://bugzilla.redhat.com/show_bug.cgi?id=1157161"
          style="text-decoration:none;"><span
style="font-size:13px;font-family:Calibri;color:#0000ff;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:underline;vertical-align:baseline;white-space:pre-wrap;">https://bugzilla.redhat.com/show_bug.cgi?id=1157161</span></a></p>
      <br>
      <h3 dir="ltr"
        style="line-height:1;margin-top:12pt;margin-bottom:3pt;"><span
style="font-size:17px;font-family:Arial;color:#000000;background-color:transparent;font-weight:bold;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub2-mkconfig
          vs patched kernel</span></h3>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Running
          grub2-mkconfig as required by these Grub2 sections will cause
          the system to boot the unpatched release kernel.  Running the
          following will fix the issue;</span></p>
      <br>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">CKERN=$(grub2-editenv
          list | grep saved_entry | cut -d '=' -f2)</span></p>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">DKERN=$(cat
          /etc/grub2.cfg | grep ^menuentry | grep "${CKERN}" | awk -F"'"
          '{print $4}')</span></p>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Consolas;color:#000000;background-color:#d9d9d9;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">grub2-set-default
          "${DKERN}"</span></p>
      <br>
      <p dir="ltr"
        style="line-height:1;margin-top:0pt;margin-bottom:0pt;"><span
style="font-size:16px;font-family:Calibri;color:#000000;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Reported
        </span><a
          href="https://bugzilla.redhat.com/show_bug.cgi?id=1154430"
          style="text-decoration:none;"><span
style="font-size:13px;font-family:Calibri;color:#1155cc;background-color:transparent;font-weight:normal;font-style:normal;font-variant:normal;text-decoration:underline;vertical-align:baseline;white-space:pre-wrap;">https://bugzilla.redhat.com/show_bug.cgi?id=1154430</span></a></p>
    </b><br class="Apple-interchange-newline">
    <meta charset="utf-8">
  </body>
</html>