bootloader

The bootloader Kickstart command is required. It specifies how the boot loader should be installed. Use this command only once.

Syntax

              bootloader [OPTIONS]
Options
  • --append= - Specifies additional kernel parameters. To specify multiple parameters, separate them with spaces. For example: 
    bootloader --location=mbr --append="hdd=ide-scsi ide=nodma"

    When the plymouth package is installed, the rhgb and quiet parameters are automatically added. This happens even if you do not specify them here or do not use the --append= command. To disable this behavior, explicitly disallow installation of plymouth:

    %packages
-plymouth
%end

    This option is useful for disabling mechanisms which were implemented to mitigate the Meltdown and Spectre speculative execution vulnerabilities found in most modern processors (CVE-2017-5754, CVE-2017-5753, and CVE-2017-5715). In some cases, these mechanisms may be unnecessary, and keeping them enabled causes decreased performance with no improvement in security. To disable these mechanisms, add the options to do so into your Kickstart file - for example, bootloader --append="nopti noibrs noibpb" on AMD64/Intel 64 systems.

    Warning
    Ensure your system is not at risk of attack before disabling any of the vulnerability mitigation mechanisms. See the Red Hat vulnerability response article for information about the Meltdown and Spectre vulnerabilities.
  • --boot-drive= - Specifies which drive the boot loader should be written to, and therefore which drive the computer will boot from. If you use a multipath device as the boot drive, specify the device by using its disk/by-id/dm-uuid-mpath-WWID name. Important
    The --boot-drive= option is currently being ignored in Red Hat Enterprise Linux installations on 64-bit IBM Z systems by using the zipl boot loader. When zipl is installed, it determines the boot drive on its own.
  • --leavebootorder - This option is applicable for Power and UEFI systems. The installation program adds Red Hat Enterprise Linux 10 to the list of the installed systems in UEFI. It does not add the installed system to the boot order. All existing boot entries as well as their order are preserved.
  • --driveorder= - Specifies which drive is first in the BIOS boot order. For example: 
    bootloader --driveorder=sda,hda
  • --location= - Specifies where the boot record is written. Valid values are the following:
    • mbr - The default option. Depends on whether the drive uses the Master Boot Record (MBR) or GUID Partition Table (GPT) scheme:

      On a GPT-formatted disk, this option installs stage 1.5 of the boot loader into the BIOS boot partition.

      On an MBR-formatted disk, stage 1.5 is installed into the empty space between the MBR and the first partition.

    • partition - Install the boot loader on the first sector of the partition containing the kernel.
    • none - Do not install the boot loader.

    In most cases, this option does not need to be specified.

  • --nombr - Do not install the boot loader to the MBR.
  • --password= - If using GRUB2, set the boot loader password to the one specified with this option. This should be used to restrict access to the GRUB2 shell, where arbitrary kernel options can be passed.

    If a password is specified, GRUB2 also asks for a user name. The user name is always root.

  • --iscrypted - Normally, when you specify a boot loader password by using the --password= option, it is stored in the Kickstart file in plain text. If you want to encrypt the password, use this option and an encrypted password.

    To generate an encrypted password, use the grub2-mkpasswd-pbkdf2 command, enter the password you want to use, and copy the command’s output (the hash starting with grub.pbkdf2) into the Kickstart file. An example bootloader Kickstart entry with an encrypted password looks similar to the following:

    bootloader --iscrypted --password=grub.pbkdf2.sha512.10000.5520C6C9832F3AC3D149AC0B24BE69E2D4FB0DBEEDBD29CA1D30A044DE2645C4C7A291E585D4DC43F8A4D82479F8B95CA4BA4381F8550510B75E8E0BB2938990.C688B6F0EF935701FF9BD1A8EC7FE5BD2333799C98F28420C5CC8F1A2A233DE22C83705BB614EA17F3FDFDF4AC2161CEA3384E56EB38A2E39102F5334C47405E
  • --timeout= - Specifies the amount of time the boot loader waits before booting the default option (in seconds).
  • --default= - Sets the default boot image in the boot loader configuration.
  • --extlinux - Use the extlinux boot loader instead of GRUB2. This option only works on systems supported by extlinux.
  • --disabled - This option is a stronger version of --location=none. While --location=none disables boot loader installation, --disabled disables boot loader installation and also disables installation of the package containing the boot loader, thus saving space.
Notes
  • Red Hat recommends setting up a boot loader password on every system. An unprotected boot loader can allow a potential attacker to modify the system’s boot options and gain unauthorized access to the system.
  • In some cases, a special partition is required to install the boot loader on AMD64, Intel 64, and 64-bit ARM systems. The type and size of this partition depend on whether the boot disk uses a Master Boot Record (MBR) or a GUID Partition Table (GPT) schema for the boot loader. For more information, see the Configuring boot loader section.
  • The sdX (or /dev/sdX) format does not guarantee consistent device names across reboots, which can complicate the usage of some Kickstart commands. When a command requires a device node name, you can use any item from /dev/disk as an alternative. For example, instead of using the following device name: 
    bootloader --boot-drive=sda

    You can use an entry similar to one of the following:

    bootloader --boot-drive=/dev/disk/by-path/pci-0000:00:05.0-scsi-0:0:0:0
bootloader --boot-drive=/dev/disk/by-id/ata-ST3160815AS_6RA0C882

    By using this approach, the command always targets the same storage device. This is especially useful in large storage environments. To explore the available device names on the system, you can use the ls -lR /dev/disk command during the interactive installation. For more information about different ways to consistently refer to storage devices, see Persistent naming attributes.