On 6/4/23 14:40, Chris Adams wrote:
As far as I can tell, you cannot configure network boot for different
OSes in a UEFI Secure Boot environment. The shim is loaded first,
before you get to the point of choosing which kernel to boot, and a
given distribution's shim will only load other Linux things signed by
that distribution's key.
It'd be nice if there was a way to chainload one shim from another
(they're all signed by the MS firmware-trusted key, so it seems like
this should be possible and still meet the security requirements), so
you could have a menu option "Switch to RHEL" that would load the RHEL
shim+bootloader, but I don't think that's possible today. I'm using
grub2 for network book rather than syslinux, but I couldn't figure out a
way to make that work.
The only way to handle it would be to distinguish the clients at the
DHCP server (use separate VLANs, pre-configure MAC addresses, etc.).
Once the DHCP server sends an answer, it's too late to change.
Yeah, that's why I was hoping there was maybe some magic in the
vendor-class-identifier response that I could use. It would make life a
LOT easier.
I've started using cobbler again
(https://cobbler.readthedocs.io/en/latest/quickstart-guide.html).
Cobbler was HORRIBLY broken in Fedora 37, but it seems to be fixed in
38. I do love that, when I set up a distro, it automatically creates the
grub.cfg file in /var/lib/tftpboot/grub and creates the menu files for
me. I actually have my kickstarts set up such that I can install Fedora
38 and RHEL 9, except for this weird shim issue. I guess when I'm going
to install RHEL machines, I need to copy the RHEL shim.efi to
/var/lib/tftpboot, and when I'm going to install Fedora machines, copy
the Fedora shim.efi. It's kind of a pain in the backside. But I can
script it pretty easily. I just need to remember to run the script when
I decide to change what I'm installing.
Thanks so much for the answer, I appreciate it, Chris.
--
Thomas
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
