<story><title>Grub2 security update renders system unbootable</title><url>https://bugzilla.redhat.com/show_bug.cgi?id=1861977</url></story><parent_chain><item><author>dijit</author><text>systemd-boot (AKA, gummiboot) is leaner, for sure- much in the same way a bicycle is leaner than a truck.&lt;p&gt;It might surprise you to know this but systemd-boot does not support, among other things: &amp;quot;BIOS&amp;quot;&amp;#x2F;MBR boot, EXT4, XFS, mdraid, LUKS (hidden boot), OPAL (aka hardware FDE, self-encrypting drives) or even btrfs!&lt;p&gt;mdraid being pretty critical to a lot of server work.&lt;p&gt;Then there&amp;#x27;s the topic of altering bootloaders for distro&amp;#x27;s which value stability, it wouldn&amp;#x27;t happen in a point release.</text></item><item><author>kd913</author><text>I will state the same comment as last time.&lt;p&gt;Can distros maybe consider moving to systemd-boot at some point? Systemd is already built in and can handle things like mounting pretty easily and simply.&lt;p&gt;It is a hell of a lot leaner than grub, doesn&amp;#x27;t use a billion superfluous modules. That and it is a lot easier to prevent tampering compared with the cumbersome nonsense that is grub passwords.&lt;p&gt;Oh and it enables distros to gather accurate boot times and enables booting into UEFI direct from the desktop.&lt;p&gt;It works with secureboot&amp;#x2F;shim&amp;#x2F;Hashtool. Also each distro has it&amp;#x27;s bootloader entries in separate folders to avoid accidental conflicts.</text></item></parent_chain><comment><author>vetinari</author><text>&amp;gt; systemd-boot does not support, among other things: &amp;quot;BIOS&amp;quot;&amp;#x2F;MBR boot,&lt;p&gt;That&amp;#x27;s a feature :). Unless your firmware doesn&amp;#x27;t have UEFI support (I&amp;#x27;m looking at you, Gen8 Proliants...), you should use UEFI.&lt;p&gt;&amp;gt; EXT4, XFS, mdraid, LUKS (hidden boot),&lt;p&gt;It doesn&amp;#x27;t support ANY filesystem (does it defer to builtin UEFI filesystem drivers?); it loads kernel and initramfs from the EFI partition itself. You can then have whatever you want compiled in.&lt;p&gt;Grub, on the other hand, has read-only drivers, so it will load your kernel and initramfs from any &amp;#x2F;boot partion you want (except zfs pool with some features enabled).&lt;p&gt;&amp;gt; OPAL (aka hardware FDE, self-encrypting drives)&lt;p&gt;Now this could be a problem, however, normal UEFI has to work somehow.&lt;p&gt;&amp;gt; mdraid being pretty critical to a lot of server work.&lt;p&gt;Many servers boot from internal sd-card or usb, and if they have local drives, they are put into use when whatever system from the sd-card or usb boots.</text></comment>
<story><title>Grub2 security update renders system unbootable</title><url>https://bugzilla.redhat.com/show_bug.cgi?id=1861977</url></story><parent_chain><item><author>dijit</author><text>systemd-boot (AKA, gummiboot) is leaner, for sure- much in the same way a bicycle is leaner than a truck.&lt;p&gt;It might surprise you to know this but systemd-boot does not support, among other things: &amp;quot;BIOS&amp;quot;&amp;#x2F;MBR boot, EXT4, XFS, mdraid, LUKS (hidden boot), OPAL (aka hardware FDE, self-encrypting drives) or even btrfs!&lt;p&gt;mdraid being pretty critical to a lot of server work.&lt;p&gt;Then there&amp;#x27;s the topic of altering bootloaders for distro&amp;#x27;s which value stability, it wouldn&amp;#x27;t happen in a point release.</text></item><item><author>kd913</author><text>I will state the same comment as last time.&lt;p&gt;Can distros maybe consider moving to systemd-boot at some point? Systemd is already built in and can handle things like mounting pretty easily and simply.&lt;p&gt;It is a hell of a lot leaner than grub, doesn&amp;#x27;t use a billion superfluous modules. That and it is a lot easier to prevent tampering compared with the cumbersome nonsense that is grub passwords.&lt;p&gt;Oh and it enables distros to gather accurate boot times and enables booting into UEFI direct from the desktop.&lt;p&gt;It works with secureboot&amp;#x2F;shim&amp;#x2F;Hashtool. Also each distro has it&amp;#x27;s bootloader entries in separate folders to avoid accidental conflicts.</text></item></parent_chain><comment><author>Spivak</author><text>I feel like you&amp;#x27;re making this sound worse than it actually is&lt;p&gt;* systemd-boot doesn&amp;#x27;t support those filesystems as the &amp;#x2F;boot partition, all of those things for your &amp;#x2F; are totally fine. For most people having your &amp;#x2F;boot partition be XFS vs FAT32 is firmly in the &amp;quot;who cares?&amp;quot; realm.&lt;p&gt;* Nobody really supports OPAL, even grub. The only reliable solution is using &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;sedutil&amp;#x2F;sedutil&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;sedutil&amp;#x2F;sedutil&lt;/a&gt; to unlock the disk and then soft reboot into any normal bootloader.&lt;p&gt;* You can do mdraid, you just have to stick the metadata at the end of the drive rather than the beginning. The utilities that set up your raid even warn you about this because this setup is so standard.</text></comment>