This is a request for packaging to also install the grub efi files in a /usr location which is accessible by all users. There are use cases for grubx64.efi beyond booting the machine it is installed on. Specifically serving grubx64.efi (and the shim) over tftp to a remote machine will make it possible to enable secure boot for baremetal provisioning in OpenStack Ironic by using (signed) grub network boot instead of iPXE. Requiring root just to copy grubx64.efi into the /tftpboot directory constrains /tftpboot population to a privileged tool. This has drawbacks, for example when the shim package is updated.
> Requiring root just to copy grubx64.efi into the /tftpboot directory constrains /tftpboot population to a privileged tool. This has drawbacks, for example when the shim package is updated. Root is not required. Just unpack the rpm cpio ball and get grubx64.efi from there.
Let me provide some more background for the requirements here. openstack-ironic is aiming to improve the install experience by auto-populating the /tftpboot director on service startup. This directory needs ipxe, grub, shim images plus some template generated text files. This leads to a solution which must be unprivileged, configuration driven, and distro agnostic. This means that running custom scripts which do rpm unpacking is not an option, and pulling a package from the network is *really* not an option. Red Hat family is unique in distros, installing root-only readable files to /boot/efi: SUSE: /usr/share/efi/x86_64/grub.efi Debian/Ubuntu: /usr/lib/grub/x86_64-efi-signed/grubnetx64.efi.signed I'm fine with doing the packaging work to make this happen: https://gitlab.com/redhat/centos-stream/rpms/grub2/-/merge_requests/19
After evaluating this issue, there are no plans to address it further or fix it in an upcoming release. Therefore, it is being closed. If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.