1

Every time I boot a Fedora 27 UEFI installed system it messes with the EFI bootmanager entries. For example:

  1. As root, I change the boot-order such that Fedora's entry isn't first. And/or I delete the Fedora entry.
  2. At boot, at the systems UEFI boot menu, I boot a generic harddisk boot entry.
  3. This boots Fedora fine.
  4. As root, checking with efibootmgr I see that Fedora somehow managed to add an entry for itself (if it was deleted before) and to put that entry in front of the boot ordering.

This behavior makes sense for standard installations, but not so much if Fedora is installed on a USB stick you want to boot for rescue work, without implicitly changing the EFI bootmanager entries.

Thus, what Fedora piece is responsible for these boot time changes? And how can this be disabled?

edit: Another experiment:

As root, delete all Fedora boot entries with efibootmgr and change the bootorder to just include one generic entry (000C).

Include efibootmgr into the initramfs (using dracut).

Reboot and drop into the dracut shell.

efibootmgr now prints:

BootCurrent: 000C
BootOrder: 000A,0000,...
...
Boot000A* Fedora    HD(2,GPT,...)/File(\EFI\fedora\shimx64.efi)
Boot000C* UEFI Misc Device 2    PciRoot(0x0)/Pci(0x5,0x0)...
...

The BootCurrent is as expected, the change in BootOrder (contains everything now) and the new Fedora entry are unexpected.

Thus, something running between the shutdown -r now and the initramfs emergency shell has changed the EFI bootmanager configuration.

It's possible that the UEFI firmware did this change but I don't see how it would derive the 'Fedora' name and the /EFI/fedora/shimx64.efi path.

3

It's the shim.

With a default Fedora install, the EFI/BOOT/BOOTX64.EFI is a shim (to support secure boot) that also executes some fallback logic that restores the Fedora boot manager entry. The 'Fedora' name comes from the EFI/fedora/BOOTX64.CSV file.

The fallback logic can be disabled via removing the fallback code and copying the grub bits to the BOOT directory, i.e.:

cd /boot/efi/EFI
rm BOOT/fallback.efi BOOT/fbx64.efi
cp fedora/grub*.efi BOOT
cp fedora/MokManager.efi BOOT

The default setup can be restored via removing the copied files and reinstalling the packages:

rm /boot/efi/EFI/fedora/*.efi
dnf reinstall grub2-efi-x64 shim-x64
  • I did not know that either, great to know! Thanks for sharing - upvoted. – telcoM Mar 11 '18 at 20:30
1

It might be some boot script or systemdunit file running efibootmgr -c with the appropriate options, so you might want to run:

grep -r efibootmgr /etc /lib/systemd /usr

to find any mention of efibootmgr in any scripts that might run at boot time. Then read the likely suspects to find if there is a designed-in way to switch them off.

On the other hand, it might also be your UEFI firmware trying to be "helpful": automatically registering any bootloaders booted using a generic UEFI device name, under the assumption that something may have wiped out the existing registration. In that case, a bug report to the system or motherboard vendor might be appreciated.

  • Hm, I had similar thoughts and grepped for efibootmgr but couldn't find anything obvious. Perhaps the UEFI firmware is responsible, but the entry is named Fedora - I don't know how the firmware would choose such a specific name. – maxschlepzig Mar 11 '18 at 9:17
  • The efi boot manager entries are added during early boot, even before grub starts: it's the shim! See my answer for details. – maxschlepzig Mar 11 '18 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.