Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 7. Managing kernel command-line parameters with UKI

Unified Kernel Image (UKI) combines the kernel, initial RAM disk (initrd), and boot command line into a single executable binary.

With UKI, systemd-boot, specifically systemd-stub, handles the kernel command-line parameters. The UKI delivered by Red Hat includes the basic kernel command-line parameter console=tty0 console=ttyS0.

You can add additional kernel command-line parameters by using UKI add-ons. Alternatively, you can generate your own UKI to contain any arguments you require.

Important

Secure Boot revokes improperly signed UKIs and add-ons. These signatures can also alter PCR measurements of TPM which can potentially affect boot sequence.

7.2. Understanding boot entries
Copy link

You manage boot entries directly in UEFI NVRAM. This means they are no longer stored on disk. You can use tools such as kernel-bootcfg or efibootmgr to alter boot entries directly.

The following is an example of a boot entry: 

Boot0001* redhat	HD(1,GPT,9192a707-8768-4c9f-bb11-fdd7c7e307e7,0x800,0x100000)/\EFI\redhat\shimx64.efi\EFI\Linux\ffffffffffffffffffffffffffffffff-6.12.0-174.el10.x86_64.efi
Copy to Clipboard Toggle word wrap

To add kernel command-line parameters, you can acquire officially signed add-ons delivered by Red Hat in the kernel-uki-virt-addons packages. These add-ons are signed by the same certificates as their associated UKIs. The default installation path is /lib/modules/$(uname -r)/vmlinuz-virt.efi.extra.d/.

Note

You must copy these add-ons to the appropriate locations for them to take effect.

If you need add-ons other than these or prefer signing them on your own, you can create them with tools such as systemd-ukify or dracut.

Procedure

  • Create a new add-on: 

    # ukify build --cmdline "emergency" --output emergency.unsigned.addon.efi
    Copy to Clipboard Toggle word wrap

To change kernel command-line parameters for all boot entries, add the UKI add-ons to the global add-ons directory /boot/efi/loader/addons/.

Prerequisites

  • You have root permissions on the system.
  • You have .addon.efi file.

Procedure

  1. Copy the add-on file to the /boot/efi/loader/addons/ directory: 

    # cp <my-addon>.addon.efi /boot/efi/loader/addons/
    Copy to Clipboard Toggle word wrap

  2. Reboot the system: 

    # reboot
    Copy to Clipboard Toggle word wrap

Verification

  • Verify the new parameter depends on the type of the added add-on. For example, check the kernel command line: 

    # cat /proc/cmdline
    Copy to Clipboard Toggle word wrap

To change kernel command-line parameters for a single UKI, manage the add-ons on a per-UKI basis. The revocation mechanism applies to UKI and its associated add-ons locally.

By default, UKIs are located at the following path:

/boot/efi/EFI/Linux/<machine_id>-<kernel_version>.efi

The effective add-ons designated to this UKI are located at the following path:

/boot/efi/EFI/Linux/<machine_id>-<kernel_version>.efi.extra.d/

Prerequisites

  • You have root permissions on the system.
  • You have .addon.efi file.

Procedure

  1. Identify the running kernel version and machine ID: 

    # uname -r
# cat /etc/machine-id
    Copy to Clipboard Toggle word wrap

  2. Copy the add-on file to the specific directory associated with the UKI: 

    # cp <my-addon>.addon.efi /boot/efi/EFI/Linux/<machine_id>-<kernel_version>.efi.extra.d/
    Copy to Clipboard Toggle word wrap

  3. Reboot the system: 

    # reboot
    Copy to Clipboard Toggle word wrap

Verification

  • Verify the new parameter depends on the type of the added add-on. For example, check the kernel command line: 

    # cat /proc/cmdline
    Copy to Clipboard Toggle word wrap
Note

When you update the kernel-uki-virt package, the system installs a new UKI version. The update also copies the currently effective add-ons to the directory for the new UKI, provided that the kernel-uki-virt-addons package is installed at the same time. This happens automatically, for example, when you run dnf update.

To customize the Linux kernel, initial RAM disk, or initrd, and kernel command-line parameters, you can create your own UKI by using tools such as systemd-ukify or dracut.

Procedure

  • For example, to create a custom UKI by using systemd-ukify: 

    # ukify build --initrd /boot/initramfs-$(uname -r).img --linux /lib/modules/$(uname -r)/vmlinuz --uname $(uname -r) --cmdline "console=tty0 console=ttyS0 emergency" --output uki.unsigned.efi
    Copy to Clipboard Toggle word wrap
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top