Bug 19949 - UEFI/GPT installer needs to provide means of protecting the NVRAM boot array settings
Summary: UEFI/GPT installer needs to provide means of protecting the NVRAM boot array...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Installer (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Thierry Vignaud
QA Contact:
URL:
Whiteboard:
Keywords: IN_ERRATA6
Depends on:
Blocks:
 
Reported: 2016-12-14 22:36 CET by Maurice Batey
Modified: 2019-02-20 19:20 CET (History)
3 users (show)

See Also:
Source RPM:
CVE:
Status comment:


Attachments
How to video (835.91 KB, video/x-msvideo)
2017-03-05 21:51 CET, Barry Jackson
Details

Description Maurice Batey 2016-12-14 22:36:42 CET
Description of problem:

Some users installing Mageia may have already set the NVRAM boot array to suit their existing installs, perhaps using a boot manager such as rEFInd.
   But https://wiki.mageia.org/en/Grub2-efi_and_Mageia says that: 

> When installing Mageia, the installer did the following things:
> ...
> it wrote the file /boot/EFI/EFI/mageia/grubx64.efi in the ESP, and...
>  it created an entry in the non-volatile RAM on the mother board, this entry 
> is placed first in the boot order and points to 
> /boot/EFI/EFI/mageia/grubx64.efi. 

So, what such users need is an option "Do not touch the NVRAM [boot array]".

It can be seen in: 
 https://bugs.mageia.org/show_bug.cgi?id=15583 and 
 https://bugs.mageia.org/show_bug.cgi?id=18770

that the only way to achieve protection of the NVRAM is to select the option 
"Do not touch the ESP or  MBR", which - inter alia - will indeed prevent any change in the NVRAM (by using the command: 
    grub2-install --bootloader-id=tmp --no-nvram

Unfortunately, that construct also puts the new Mageia grubx64.efi boot file in EFI/tmp instead of EFI/mageia, in the ESP!
   (The other problem is how to explain all that to someone possibly coming to Mageia for the first time.)

So what is needed is a "Do not touch NVRAM' option so that the command used instead would be:

   grub2-install --bootloader-id=mageia --no-nvram

One approach would be to replace the "Do not touch the ESP or  MBR" option by 'radio buttons', e.g.

   "Do not touch:   o ESP
                    o MBR
                    o NVRAM"



Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
Maurice Batey 2016-12-14 22:44:38 CET

CC: (none) => zen25000

Comment 1 Maurice Batey 2016-12-15 12:15:10 CET
> "Do not touch:   o ESP
>                  o MBR
>                  o NVRAM"

  The term "ESP" is contradictory as, according to 18770, the generated grubx64.efi file is put in EFI/tmp, which is nevertheless in the ESP.

I believe the option really means "Do not touch EFI/mageia", so suggest that would be a less confusing term to use here.
Comment 2 Barry Jackson 2016-12-15 14:15:58 CET
(In reply to Maurice Batey from comment #1)
> > "Do not touch:   o ESP
> >                  o MBR
> >                  o NVRAM"
> 

Probably better would be checkboxes for:

o Do not overwrite /boot/EFI/EFI/mageia
o Do not modify UEFI nvram
o Do not write bootloader into MBR (on PC-BIOS systems)

But whether there is space for that and time for translations before Mga6 release is another matter.

>   The term "ESP" is contradictory as, according to 18770, the generated
> grubx64.efi file is put in EFI/tmp, which is nevertheless in the ESP.
> 
> I believe the option really means "Do not touch EFI/mageia", so suggest that
> would be a less confusing term to use here.

Indeed
Comment 3 Maurice Batey 2017-01-18 19:35:57 CET
Is consideration of this improvement being delayed until Mageia-7?

Having just set up my UEFI/GPT Probook to receive a Mageia-6 installation,
I urgently need confirmation that the boot 'Advanced' option can be selected and that its 'Do not touch MBR...' option also does indeed not touch the NVRAM Boot array,  please...

Many thanks!
Comment 4 Barry Jackson 2017-01-23 12:30:16 CET
(In reply to Maurice Batey from comment #3)
> Is consideration of this improvement being delayed until Mageia-7?
> 
> Having just set up my UEFI/GPT Probook to receive a Mageia-6 installation,
> I urgently need confirmation that the boot 'Advanced' option can be selected
> and that its 'Do not touch MBR...' option also does indeed not touch the
> NVRAM Boot array,  please...
> 
> Many thanks!

I have done many net-installs of Mga6 using the 'Do not touch...' and it does not overwrite nvram.

I use a dedicated grub partition with it's own install of grub2 to boot into all systems on the machine, so I do not want nvram touched either.

I have also in the past killed the install before installing grub2, before we had the 'Do not touch...' option. That also worked.
Comment 5 Maurice Batey 2017-01-23 14:22:34 CET
I am much obliged to you for that, Barry!

As the only way I found to set the NVRAM to boot into something other than Windows10 was (because efforts to use efibootmgr failed) the Windows command:

    bcdedit /set {bootmgr} path \EFI\refind\refind_x64.efi

(in a 'Terminal (Administrator)' session)

and as my ultimate aim is to wipe Windows from the laptop I shall - for the time being -  abort the Mageia installs at 'grub boot setup' time to safeguard the NVRAM settings.
Comment 6 Maurice Batey 2017-01-23 22:48:56 CET
> I have also in the past killed the install before installing grub2, before we > had the 'Do not touch...' option. That also worked.

Did that and got Mageia-6-sta2 installed without problems.

However, I did not see the 'Advanced' option which then offers 'Do not touch MBR etc'.

Where, exactly, does that 'Advanced' option appear, please?
Comment 7 Barry Jackson 2017-01-23 23:01:34 CET
IIRC it only appears if you enter the bootloader section during the summary, which I guess is reasonable, as if you are wanting something special then you would not just accept the default bootloader settings at that point.
Comment 8 Maurice Batey 2017-01-24 14:23:18 CET
Well, in my case the installer started saying something like "Preparing boot loader" prior to that point, so I curtailed the install right there just to be on the safe side (in case I had somehow missed the 'Advanced' option). :-)

I seem to remember that Grub2's configuration options do not include editing the boot menu layout, otherwise I would would have held on a while longer...

Regarding booting the Mageia-6 install (on flash drive) it was nice to see that rEFInd found the USB drive and automatically added an ad hoc entry to its boot menu, whose selection did indeed boot it.
Comment 9 Barry Jackson 2017-01-24 14:36:15 CET
(In reply to Maurice Batey from comment #8)
> Well, in my case the installer started saying something like "Preparing boot
> loader" prior to that point, so I curtailed the install right there just to
> be on the safe side (in case I had somehow missed the 'Advanced' option). :-)
> 
grub2 is not installed until after the summary. I think what you saw was the initrd creation prior to the summary - that dialog used to mention "boot loader" which was scary, but it now says "Preparing initial startup program" with "Please wait" heading. I think it should just say "Working... Please wait" so as to not cause panic. ;)
 
> I seem to remember that Grub2's configuration options do not include editing
> the boot menu layout, otherwise I would would have held on a while longer...
> 
Not sure just what you mean - in your case where you only want Mageia to display it's own boot options (various kernels), then removing os-prober (or disabling it) and running update-grub2 will give you a clean boot menu.

> Regarding booting the Mageia-6 install (on flash drive) it was nice to see
> that rEFInd found the USB drive and automatically added an ad hoc entry to
> its boot menu, whose selection did indeed boot it.

Cool :)
Comment 10 Maurice Batey 2017-03-05 19:20:35 CET
> IIRC it only appears if you enter the bootloader section during the summary

Just done a UEFI install of the latest Mageia-6-sta2, waited until the 'Config Grub Loader/Firewall/etc summary appeared prior to bootloader install, but could see no sign of any "Do not touch the ESP or  MBR" option, there or in any Advanced tab (so had to abandon rest of install to protect the NVRAM).

Anyone know precisely how to get to see the "Do not touch the ESP or  MBR" option, please?
  
Something needs to be done to prevent some Mageia newcomers to Mageia-6 getting upset at an unhappy ending to installs :-)
Comment 11 Barry Jackson 2017-03-05 21:51:57 CET
Created attachment 9023 [details]
How to video

Video showing how to do it :)

Note you must enter the Summary -> Bootloader section.
Comment 12 Barry Jackson 2017-03-05 22:06:57 CET
Comment on attachment 9023 [details]
How to video

To view video:  Click on "Details" then Right click -> Save link as

Then open file with vlc etc.
Comment 13 Maurice Batey 2017-03-05 23:28:53 CET
Have given up trying to open file tonight. :-(

Try again tomorrow...
Comment 14 Barry Jackson 2017-03-05 23:38:12 CET
To clarify:  Click on "Details" then Right click on "Download the attachment" and select "Save link as"
Barry Jackson 2017-03-05 23:48:34 CET

Attachment 9023 mime type: application/octet-stream => video/avi

Barry Jackson 2017-03-05 23:51:17 CET

Attachment 9023 mime type: video/avi => video/x-msvideo

Comment 15 Barry Jackson 2017-03-06 00:01:40 CET
(In reply to Maurice Batey from comment #13)
> Have given up trying to open file tonight. :-(
> 
> Try again tomorrow...

It should open in Firefox if you left click "attachment 9023 [details]" now that I have edited the MIME type. I have tainted codecs so YMMV. Otherwise do as in #14.

Barry
Comment 16 Maurice Batey 2017-03-06 15:19:16 CET
This is what I see if I left click on 'Details':

-------------------------------------------------------
How to video
nvramdonttouch.avi (video/x-msvideo), 835.91 KB, created by Barry Jackson on 2017-03-05 21:51 CET

Attachment is not viewable in your browser because its MIME type (video/x-msvideo) is not one that your browser is able to display.

Download the attachment.
Actions: View
Attachments on bug 19949: 9023 
--------------------------------------------

If I try 'Download', Firefox shows a black screen apart from a large VLC icon in the centre, but the 'start triangle (bottom left) is a no-op.

However, "Otherwise do as in #14" worked, though RIGHT clicking on 'Download the attachment' seemed a foreign thing to do! 
  (Also, when I tried that last night (not logged in) what was downloaded was 'attachment.cgi' which VLC just ignored.

So I have now played back your thoughtful and welcome 'How to' video, and can see what  needs to be done to home in on the 'Do not touch...' option.
   
(The one puzzle with the video was that it starts by showing the Summary screen and then (without any apparent mouse clicks) switches to Bootloader Main Options. [Was this achieved simply by clicking on 'Next'?))

W.r.t. finding the 'Do not touch...' option I expected it to be in the 'Advanced' option there - but no - one has go to the NEXT level (Bootloader Configuration) to find it under it's 'Advanced' option.
   IMHO, that is far too late in the process...
(I had aborted the install well before then!)

Also, it still does not mention NVRAM in the 'Do not touch' list).

So, if we were to have a Mageia Wiki note on this, it should perhaps say something like:

  "Anyone wishing to bypass certain 'boot loader' actions  should look for a 'Do not touch...' option under 'Advanced' in the "Bootloader Configuration' screen, which follows the 'Bootloader Main Options' screen."

Thank you once again for providing the video - much apprecieted!
Comment 17 Maurice Batey 2017-03-06 16:19:02 CET
> If we were to have a Mageia Wiki note on this,...

  Perhaps include a link to the video?
Comment 18 Barry Jackson 2017-03-06 16:20:58 CET
(In reply to Maurice Batey from comment #16)

> 
> So I have now played back your thoughtful and welcome 'How to' video, and
> can see what  needs to be done to home in on the 'Do not touch...' option.
>    
> (The one puzzle with the video was that it starts by showing the Summary
> screen and then (without any apparent mouse clicks) switches to Bootloader
> Main Options. [Was this achieved simply by clicking on 'Next'?))

No, that was by clicking the bootloader option - I had to edit the video to reduce the file size, and also reduced the quality a lot, so the mouse probably got the chop!

> 
> W.r.t. finding the 'Do not touch...' option I expected it to be in the
> 'Advanced' option there - but no - one has go to the NEXT level (Bootloader
> Configuration) to find it under it's 'Advanced' option.
>    IMHO, that is far too late in the process...
> (I had aborted the install well before then!)

I agree that it is a bit disconcerting.

> 
> Also, it still does not mention NVRAM in the 'Do not touch' list).
> 
> So, if we were to have a Mageia Wiki note on this, it should perhaps say
> something like:
> 
>   "Anyone wishing to bypass certain 'boot loader' actions  should look for a
> 'Do not touch...' option under 'Advanced' in the "Bootloader Configuration'
> screen, which follows the 'Bootloader Main Options' screen."
> 
> Thank you once again for providing the video - much apprecieted!

Please add this to the wiki if you wish - and I think it should go in the errata (maybe as a link to the wiki? Not sure?

@marja WDYT?

##################################
For errata
##################################
Maybe better if written in the order that it is accessed:-

If during installation of Mageia 6 you wish to avoid overwriting the MBR (PC-BIOS) or changing the default option in the UEFI nvram then at the 'Summary' screen you must enter the Bootloader section and then proceed to the next screen where there is an 'Advanced' button.
In the advanced section there is a check box labelled "Do not touch MBR or ESP", checking this will avoid your current boot set-up from being changed, but you will of course have to add an entry to your current bootloader either manually or by running e.g. grub2-mkconfig or update-grub from another system.

Keywords: (none) => FOR_ERRATA6

Comment 19 Barry Jackson 2017-03-06 16:23:57 CET
(In reply to Maurice Batey from comment #17)
> > If we were to have a Mageia Wiki note on this,...
> 
>   Perhaps include a link to the video?

No! certainly not as it is. I think that passage in the wiki/errata will be more than adequate :)
Comment 20 Maurice Batey 2017-03-06 16:37:04 CET
"...or changing the default option in the UEFI nvram then at the 'Summary' screen you must enter the Bootloader section and then proceed to the next screen where there is an 'Advanced' button.
In the advanced section there is a check box labelled "Do not touch MBR or ESP","

Need to more specific than "..enter the Bootloader section and then proceed to the next screen where there is an 'Advanced' button" because among those screens there are TWO 'Advanced' options!

  Need to say e.g.: Proceed to the 'Bootloader Main Options' screen and then on to the 'Bootloader Configuration' screen, where select the Advanced option to see the 'Do not touch...' option."
Comment 21 Barry Jackson 2017-03-06 22:11:55 CET
Until they are there, they do not know what the next screen will be or what it may be called.

How is "and then proceed to the next screen" ambiguous?

I want to keep it as concise and as clear as possible.

I suppose "and then proceed to the next screen titled 'Bootloader Configuration'"
would be acceptable.

I have made some changes below - I am sure the doc team will be able to take it from here. ;) Please edit bootloader/boot-loader/boot loader to whatever is consistent with our other documentation.

So: For wiki/errata
###########################
Retaining an existing third party bootloader

If during installation of Mageia 6 you wish to avoid overwriting the MBR (PC-BIOS) or changing the default option in the UEFI nvram then at the 'Summary' screen you MUST enter the Bootloader section and then proceed to the NEXT screen titled 'BOOTLOADER CONFIGURATION' where there is an 'Advanced' button.
In this advanced section there is a check box labelled "Do not touch MBR or ESP". Checking this box will stop your current bootloader from being modified. You will then need to add Mageia to a bootloader yourself.
##########################
Comment 22 Maurice Batey 2017-03-06 23:19:18 CET
> at the 'Summary' screen you MUST enter the Bootloader section and then proceed > to the NEXT screen titled 'BOOTLOADER CONFIGURATION' where there is an 
> 'Advanced' button.

Why introduce the ambiguity "Bootloader section"? 

   I believe it should specifically say "'Bootloader Main Options' screen and then to the next screen ('Bootloader Configuration'), where select the Advanced option to see the 'Do not touch...' option."
Comment 23 Barry Jackson 2017-03-06 23:49:26 CET
Whatever - do as you wish - I have said all I am going to on the matter.

CC: zen25000 => (none)

Comment 24 Marja Van Waes 2017-03-07 09:32:37 CET
(In reply to Barry Jackson from comment #21)

> 
> I have made some changes below - I am sure the doc team will be able to take
> it from here. ;) Please edit bootloader/boot-loader/boot loader to whatever
> is consistent with our other documentation.
> 
> So: For wiki/errata
> ###########################
> Retaining an existing third party bootloader
> 
> If during installation of Mageia 6 you wish to avoid overwriting the MBR
> (PC-BIOS) or changing the default option in the UEFI nvram then at the
> 'Summary' screen you MUST enter the Bootloader section and then proceed to
> the NEXT screen titled 'BOOTLOADER CONFIGURATION' where there is an
> 'Advanced' button.
> In this advanced section there is a check box labelled "Do not touch MBR or
> ESP". Checking this box will stop your current bootloader from being
> modified. You will then need to add Mageia to a bootloader yourself.
> ##########################

Thanks, Barry, I've added it to both the CI and the Live iso part of the errata. 

(In reply to Maurice Batey from comment #22)
> > at the 'Summary' screen you MUST enter the Bootloader section and then proceed > to the NEXT screen titled 'BOOTLOADER CONFIGURATION' where there is an 
> > 'Advanced' button.
> 
> Why introduce the ambiguity "Bootloader section"? 
> 
>    I believe it should specifically say "'Bootloader Main Options' screen
> and then to the next screen ('Bootloader Configuration'), where select the
> Advanced option to see the 'Do not touch...' option."

CC'ing docteam, I didn't manage to really think about this suggestion. The Errata will need to be proofread anyway!

Keywords: FOR_ERRATA6 => IN_ERRATA6
CC: (none) => doc-bugs, marja11

Comment 25 Marja Van Waes 2017-03-07 09:33:31 CET
Btw, doesn't that "Do not touch ESP or MBR" option fix this bug?
Comment 26 Maurice Batey 2017-03-07 12:13:54 CET
As it turns out, yes, but the option doesn't mention 'NVRAM' (nor does it say where the unwanted Mageia Grub file is put (something like /EFI/tmp, I believe)), so anyone looking for a way of preserving the NVRAM settings will not find it there.

  That's why I proposed (as above):

One approach would be to replace the "Do not touch the ESP or  MBR" option by 'radio buttons', e.g.

   "Do not touch:   o ESP
                    o MBR
                    o NVRAM"
Comment 27 Maurice Batey 2017-03-07 18:27:23 CET
Most unexpected postscript:

Have just bitten the bullet and re-installed Mageia-6-sta2 on the UEFI/GPT Probook - this time not aborting before the bootloader phase was over.

But - somehow - after setting the Firewall, Time, etc.  on the Summary page I accidentally failed to reach any bootloader configuration screen at all, and then it was reboot time...

HOWEVER, despite expecting to find the NVRAM Boot array changed, the machine still booted into rEFInd!!!  (Very happy about that, as well as surprised)
   In other words the installer did not change the NVRAM to boot Mageia. 
                  -----------------------------------------------------

So, I started the install over again, this time to be careful to pin down the "Do Not Touch" option, and:  
      No change: As expected, this time it still booted into rEFINd.
Comment 28 Maurice Batey 2017-03-08 13:45:53 CET
> the installer did not change the NVRAM to boot Mageia

  I hasten to add that I do *not* suspect the installer to be at fault here.

Whatever  mechanism the installer uses to do that (GRUB2, efibootmgr?) could probably not avoid the misbehaviour of the HP laptop's UEFI/efibootmgr mechanism, which - when I first grappled with it a year ago - simply would not do what it 'said on the lid'.    (All that with expert advice)
   Echoing the old Ford Motor co mantra, it was a case of "You can boot any system you like as long as it's Windows'!

(My early solution as to how to achieve default booting of Mageia-5 was to disguise the /mageia/grub_64.efi as the default Windows .efi!)
Comment 29 Barry Jackson 2017-10-22 12:36:02 CEST
(In reply to Marja van Waes from comment #25)
> Btw, doesn't that "Do not touch ESP or MBR" option fix this bug?

I would say yes.

CC: (none) => zen25000

Comment 30 Maurice Batey 2017-10-22 14:13:28 CEST
I do not agree! As I said earlier:

> The term "ESP" is contradictory as, according to 18770, the generated 
> grubx64.efi file is put in EFI/tmp, which is nevertheless in the ESP.

In the context of the Mageia installer it really means just "Do not touch EFI/mageia", so suggest that would be a less confusing term to use here.

But for any who - like me - have already harnessed e.g. rEFInd and ensured the UEFI interface will always boot rEFInd, they need to be assured that the installer will not tamper with the NVRAM boot vectors.

So instead of 'ESP or MBR' it should be more specific, e.g. " NVRAM or MBR" or  "UEFI boot mechanism or MBR'.  
  Remember, EFI/mageia *is* in the ESP...
Comment 31 Maurice Batey 2017-10-22 14:55:19 CEST
> EFI/mageia *is* in the ESP...

 Should have said "EFI/tmp" *is* (also) in the ESP...
Comment 32 Maurice Batey 2019-02-20 19:20:52 CET
Well, having reached Mageia-7 I personally have no problems with UEFI booting with rEFInd, and if no one else has either then - so far as I am concerned - this bug  can be closed.

My main concern was the inability of my HP Probook 450G2**'s efibootmgr to change the NVRAM vector to default boot to rEFInd, as the only way back then is a Windows BCD command...

  (** And possibly other's similar machines)

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.