Bug 1615167

Summary: grub2 is broken in rescue mode, kickstart preinstall, & doesn't work correctly when booted normally
Product: [Fedora] Fedora Reporter: Joseph Tingiris <joseph.tingiris>
Component: grub2Assignee: Peter Jones <pjones>
Status: CLOSED EOL QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 28CC: anaconda-maint-list, bcl, dmach, lkundrak, pjones
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-05-28 22:07:39 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Joseph Tingiris 2018-08-12 21:31:55 UTC
Description of problem:

grub2 is broken in rescue mode, kickstart preinstall, & doesn't work correctly when booted normally (without changes)

Version-Release number of selected component (if applicable):

Fedora 28 (Twenty Eight)

How reproducible:

A variety of ways; there are multiple defects that all seem to be somewhat related to the initial preinstall omission of grub2-efi-x64-modules and/or grub2-pc-modules.

Here are a couple,

1) Boot Fedora 28 into Rescue Mode
1b) /usr/lib/grub/i386-pc & /usr/lib/grub/x86_64-efi are missing

2) Boot Fedora 28 normally
2b) dnf install grub2-efi-x64-modules
2c) run grub2-install # yay, it works!
2d) reboot # grub2-install replaces /boot/efi/EFI/fedora/grubx64.efi
2e) boot fails # stock grub2-install grubx64.efi expectes grub.cfg in /boot/grub2/grub.cfg

Steps to Reproduce:
1. cd /usr/lib/grub && ls # it's empty
2. Normal, Rescue Mode, or Kickstart preinstall
 
2a. On a UEFI machine

grub2-install

2b. On an BIOS machine

grub2-install

Actual results:

2a) grub2-install: error: /usr/lib/grub/x86_64-efi/modinfo.sh doesn't exist
2b) grub2-install: error: /usr/lib/grub/i386-pc/modinfo.sh doesn't exist

Expected results:

grub2-install works as it does upstream for all use cases
grub2 does *not* depend on a 'prebaked', custom grubx64.efi (or anything in grub2-efi-x64)

Additional info:

On UEFI, simply moving /boot/grub/efi/EFI/fedora.cfg back to /boot/grub2/grub.cfg works.

There need for a custom grubx64.efi is not well understood, or documented.  It's missing useful grub2 modules, such as cryptodisk.

I think many would agree that it's more secure *not* to put grub.cfg on the ESP, too.

Comment 1 Joseph Tingiris 2018-08-12 22:31:35 UTC
This is what I've been found after installing f27 & f28.  It's an UEFI install of an encrypted lvm on /dev/sda1 & raw /boot on /dev/sda2 (so I can remove /dev/sda2 later).

GPTs initially looks like this:

sda1 fat16/efi
sda2 lvm/luks
sda3 raw/xfs

Post-boot, doing this ...

umount /boot/efi && mkdir -p /mnt/sysimage && mount -B / /mnt/sysimage
rsync -avp /boot/ /mnt/sysimage/boot/
umount /boot
mount /boot/efi
sed -i '/[[:space:]]\/boot[[:space:]]/s/^/#/g' /etc/fstab
dnf remove grub2-efi-x64
dnf install grub2-efi-x64-modules
echo GRUB_ENABLE_CRYPTODISK=y >> /etc/default/grub
# more grub stuff
grub2-mkconfig -o /boot/grub2/grub.cfg
grub2-install
parted /dev/sda rm 3
systemctl reboot

And I end up with this, and it's bootable, which is the goal ...

sda1 fat16/efi (without a grub.cfg)
sda2 lvm/luks

I'd like to be able to do something similar in preinstall via anaconda/kickstart but there's nothing in /usr/lib/grub at that point.  I've got some hacks in postinstall, but grub2-install should work via Rescue too.  It shouldn't be that difficult.

Most of the issues seem to stem from the custom grubx64.efi, which tends to break booting as it did for a bunch of people updating f26.  I'd rather use the one that grub2-install builds and not have to worry that an update or reinstall is going to affect it. 
 
Plus I'm really not fond of the fact that, by default, grub.cfg is on the ESP.  That's a significant security/design flaw imho.  I'm sure others would agree with me there, too.

Comment 2 Joseph Tingiris 2018-08-12 22:34:33 UTC
Aside, it would be really handy to be able to go back and edit comments & the description, to clarify and/or correct grammar.  Hopefully you all get the gist, or someone else trying to do what I'm doing finds this report useful.

Comment 3 Joseph Tingiris 2018-08-12 22:43:11 UTC
I should also add I keep finding /boot/efi/EFI/fedora artifacts (even after dnf remove grub2-efi-x64), that need to be removed manually.

cd /boot/efi/EFI/fedora && rm -rf grub.cfg grubenv loader/

Comment 4 Ben Cotton 2019-05-02 21:09:36 UTC
This message is a reminder that Fedora 28 is nearing its end of life.
On 2019-May-28 Fedora will stop maintaining and issuing updates for
Fedora 28. It is Fedora's policy to close all bug reports from releases
that are no longer maintained. At that time this bug will be closed as
EOL if it remains open with a Fedora 'version' of '28'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 28 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 5 Ben Cotton 2019-05-28 22:07:39 UTC
Fedora 28 changed to end-of-life (EOL) status on 2019-05-28. Fedora 28 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.