Managing, monitoring, and updating the kernel

Procedure

1. List the available versions of a package:

   $ yum repoquery <package_name>

   Copy to Clipboard Toggle word wrap

2. Display the list of files in a package:

   $ yum repoquery -l <package_name>

   Copy to Clipboard Toggle word wrap

Procedure

1. To update the kernel, enter the following command:

   # yum update kernel

   Copy to Clipboard Toggle word wrap

   This command updates the kernel along with all dependencies to the latest available version.

2. Reboot your system for the changes to take effect.

Procedure

1. Select a kernel module you want to load.

   The modules are located in the /lib/modules/$(uname -r)/kernel/<SUBSYSTEM>/ directory.

2. Load the relevant kernel module:

   # modprobe <MODULE_NAME>

   Copy to Clipboard Toggle word wrap
   Note

   When entering the name of a kernel module, do not append the .ko.xz extension to the end of the name. Kernel module names do not have extensions; their corresponding files do.

Procedure

1. List all the loaded kernel modules:

   # lsmod

   Copy to Clipboard Toggle word wrap

2. Select the kernel module you want to unload.

   If a kernel module has dependencies, unload those prior to unloading the kernel module. For details on identifying modules with dependencies, see Listing currently loaded kernel modules and Kernel module dependencies.

3. Unload the relevant kernel module:

   # modprobe -r <MODULE_NAME>

   Copy to Clipboard Toggle word wrap

   When entering the name of a kernel module, do not append the .ko.xz extension to the end of the name. Kernel module names do not have extensions; their corresponding files do.

Procedure

1. Boot the system into the boot loader.
2. Use the cursor keys to highlight the relevant boot loader entry.

3. Press the e key to edit the entry.

   Figure 2.1. Kernel boot menu

   

   View larger image

   
4. Use the cursor keys to navigate to the line that starts with linux.

5. Append modprobe.blacklist=module_name to the end of the line.

   Figure 2.2. Kernel boot entry

   

   View larger image

   

   The serio_raw kernel module illustrates a rogue module to be unloaded early in the boot process.

6. Press Ctrl+X to boot using the modified configuration.

Procedure

1. Select a kernel module you want to load during the boot process.

   The modules are located in the /lib/modules/$(uname -r)/kernel/<SUBSYSTEM>/ directory.

2. Create a configuration file for the module:

   # echo <MODULE_NAME> > /etc/modules-load.d/<MODULE_NAME>.conf

   Copy to Clipboard Toggle word wrap
   Note

   When entering the name of a kernel module, do not append the .ko.xz extension to the end of the name. Kernel module names do not have extensions; their corresponding files do.

Verification

1. After reboot, verify the relevant module is loaded:

   $ lsmod | grep <MODULE_NAME>

   Copy to Clipboard Toggle word wrap

Procedure

1. List modules loaded to the currently running kernel by using the lsmod command:

   $ lsmod
   Module                  Size  Used by
   tls                   131072  0
   uinput                 20480  1
   snd_seq_dummy          16384  0
   snd_hrtimer            16384  1
   …

   Copy to Clipboard Toggle word wrap

   In the output, identify the module you want to prevent from getting loaded.

   • Alternatively, identify an unloaded kernel module you want to prevent from potentially loading in the /lib/modules/<KERNEL-VERSION>/kernel/<SUBSYSTEM>/ directory, for example:

     $ ls /lib/modules/4.18.0-477.20.1.el8_8.x86_64/kernel/crypto/
     ansi_cprng.ko.xz        chacha20poly1305.ko.xz  md4.ko.xz               serpent_generic.ko.xz
     anubis.ko.xz            cmac.ko.xz…

     Copy to Clipboard Toggle word wrap

2. Create a configuration file serving as a denylist:

   # touch /etc/modprobe.d/denylist.conf

   Copy to Clipboard Toggle word wrap

3. In a text editor of your choice, combine the names of modules you want to exclude from automatic loading to the kernel with the blacklist configuration command, for example:

   # Prevents <KERNEL-MODULE-1> from being loaded
   blacklist <MODULE-NAME-1>
   install <MODULE-NAME-1> /bin/false
   
   # Prevents <KERNEL-MODULE-2> from being loaded
   blacklist <MODULE-NAME-2>
   install <MODULE-NAME-2> /bin/false
   …

   Copy to Clipboard Toggle word wrap

   Because the blacklist command does not prevent the module from getting loaded as a dependency for another kernel module that is not in a denylist, you must also define the install line. In this case, the system runs /bin/false instead of installing the module. The lines starting with a hash sign are comments you can use to make the file more readable.

   Note

   When entering the name of a kernel module, do not append the .ko.xz extension to the end of the name. Kernel module names do not have extensions; their corresponding files do.

4. Create a backup copy of the current initial RAM disk image before rebuilding:

   # cp /boot/initramfs-$(uname -r).img /boot/initramfs-$(uname -r).bak.$(date +%m-%d-%H%M%S).img

   Copy to Clipboard Toggle word wrap

   • Alternatively, create a backup copy of an initial RAM disk image which corresponds to the kernel version for which you want to prevent kernel modules from automatic loading:

     # cp /boot/initramfs-<VERSION>.img /boot/initramfs-<VERSION>.img.bak.$(date +%m-%d-%H%M%S)

     Copy to Clipboard Toggle word wrap

5. Generate a new initial RAM disk image to apply the changes:

   # dracut -f -v

   Copy to Clipboard Toggle word wrap

   • If you build an initial RAM disk image for a different kernel version than your system currently uses, specify both target initramfs and kernel version:

     # dracut -f -v /boot/initramfs-<TARGET-VERSION>.img <CORRESPONDING-TARGET-KERNEL-VERSION>

     Copy to Clipboard Toggle word wrap

6. Restart the system:

   $ reboot

   Copy to Clipboard Toggle word wrap

Procedure

1. Create the /root/testmodule/test.c file with the following content.

   #include <linux/module.h>
   #include <linux/kernel.h>
   
   int init_module(void)
       { printk("Hello World\n This is a test\n"); return 0; }
   
   void cleanup_module(void)
       { printk("Good Bye World"); }

   Copy to Clipboard Toggle word wrap

   The test.c file is a source file that provides the main functionality to the kernel module. The file has been created in a dedicated /root/testmodule/ directory for organizational purposes. After the module compilation, the /root/testmodule/ directory will contain multiple files.

   The test.c file includes from the system libraries:

   • The linux/kernel.h header file is necessary for the printk() function in the example code.
   • The linux/module.h header file contains function declarations and macro definitions that are shared across multiple C source files.
2. Follow the init_module() and cleanup_module() functions to start and end the kernel logging function printk(), which prints text.

3. Create the /root/testmodule/Makefile file with the following content.

   obj-m := test.o

   Copy to Clipboard Toggle word wrap

   The Makefile contains instructions for the compiler to produce an object file named test.o. The obj-m directive specifies that the resulting test.ko file is going to be compiled as a loadable kernel module. Alternatively, the obj-y directive can instruct to build test.ko as a built-in kernel module.

4. Compile the kernel module.

   # make -C /lib/modules/$(uname -r)/build M=/root/testmodule modules
   make: Entering directory '/usr/src/kernels/4.18.0-305.el8.x86_64'
     CC [M]  /root/testmodule/test.o
     Building modules, stage 2.
     MODPOST 1 modules
   WARNING: modpost: missing MODULE_LICENSE() in /root/testmodule/test.o
   see include/linux/module.h for more information
     CC      /root/testmodule/test.mod.o
     LD [M]  /root/testmodule/test.ko
   make: Leaving directory '/usr/src/kernels/4.18.0-305.el8.x86_64'

   Copy to Clipboard Toggle word wrap

   The compiler creates an object file (test.o) for each source file (test.c) as an intermediate step before linking them together into the final kernel module (test.ko).

   After a successful compilation, /root/testmodule/ contains additional files that relate to the compiled custom kernel module. The compiled module itself is represented by the test.ko file.

Verification

1. Optional: check the contents of the /root/testmodule/ directory:

   # ls -l /root/testmodule/
   total 152
   -rw-r—​r--. 1 root root    16 Jul 26 08:19 Makefile
   -rw-r—​r--. 1 root root    25 Jul 26 08:20 modules.order
   -rw-r—​r--. 1 root root     0 Jul 26 08:20 Module.symvers
   -rw-r—​r--. 1 root root   224 Jul 26 08:18 test.c
   -rw-r—​r--. 1 root root 62176 Jul 26 08:20 test.ko
   -rw-r—​r--. 1 root root    25 Jul 26 08:20 test.mod
   -rw-r—​r--. 1 root root   849 Jul 26 08:20 test.mod.c
   -rw-r—​r--. 1 root root 50936 Jul 26 08:20 test.mod.o
   -rw-r—​r--. 1 root root 12912 Jul 26 08:20 test.o

   Copy to Clipboard Toggle word wrap

2. Copy the kernel module to the /lib/modules/$(uname -r)/ directory:

   # cp /root/testmodule/test.ko /lib/modules/$(uname -r)/

   Copy to Clipboard Toggle word wrap

3. Update the modular dependency list:

   # depmod -a

   Copy to Clipboard Toggle word wrap

4. Load the kernel module:

   # modprobe -v test
   insmod /lib/modules/4.18.0-305.el8.x86_64/test.ko

   Copy to Clipboard Toggle word wrap

5. Verify that the kernel module was successfully loaded:

   # lsmod | grep test
   test                   16384  0

   Copy to Clipboard Toggle word wrap

6. Read the latest messages from the kernel ring buffer:

   # dmesg
   [74422.545004] Hello World
                   This is a test

   Copy to Clipboard Toggle word wrap

Procedure

1. Export your public key to the sb_cert.cer file:

   # certutil -d /etc/pki/pesign \
              -n 'Custom Secure Boot key' \
              -Lr \
              > sb_cert.cer

   Copy to Clipboard Toggle word wrap

2. Import your public key into the MOK list:

   # mokutil --import sb_cert.cer

   Copy to Clipboard Toggle word wrap
3. Enter a new password for this MOK enrollment request.

4. Reboot the machine.

   The shim boot loader notices the pending MOK key enrollment request and it launches MokManager.efi to enable you to complete the enrollment from the UEFI console.

5. Choose Enroll MOK, enter the password you previously associated with this request when prompted, and confirm the enrollment.

   Your public key is added to the MOK list, which is persistent.

   Once a key is on the MOK list, it will be automatically propagated to the .platform keyring on this and subsequent boots when UEFI Secure Boot is enabled.

Procedure

1. Export your public key to the sb_cert.cer file:

   # certutil -d /etc/pki/pesign \
              -n 'Custom Secure Boot key' \
              -Lr \
              > sb_cert.cer

   Copy to Clipboard Toggle word wrap

2. Extract the key from the NSS database as a PKCS #12 file:

   # pk12util -o sb_cert.p12 \
              -n 'Custom Secure Boot key' \
              -d /etc/pki/pesign

   Copy to Clipboard Toggle word wrap
3. When the previous command prompts, enter a new password that encrypts the private key.

4. Export the unencrypted private key:

   # openssl pkcs12 \
            -in sb_cert.p12 \
            -out sb_cert.priv \
            -nocerts \
            -nodes

   Copy to Clipboard Toggle word wrap
   Important

   Keep the unencrypted private key secure.

5. Sign your kernel module. The following command appends the signature directly to the ELF image in your kernel module file:

   # /usr/src/kernels/$(uname -r)/scripts/sign-file \
             sha256 \
             sb_cert.priv \
             sb_cert.cer \
             my_module.ko

   Copy to Clipboard Toggle word wrap

Verification

1. Display information about the kernel module’s signature:

   # modinfo my_module.ko | grep signer
     signer:         Your Name Key

   Copy to Clipboard Toggle word wrap

   Check that the signature lists your name as entered during generation.

   Note

   The appended signature is not contained in an ELF image section and is not a formal part of the ELF image. Therefore, utilities such as readelf cannot display the signature on your kernel module.

2. Load the module:

   # insmod my_module.ko

   Copy to Clipboard Toggle word wrap

3. Remove (unload) the module:

   # modprobe -r my_module.ko

   Copy to Clipboard Toggle word wrap

Procedure

1. Verify that your public keys are on the system keyring:

   # keyctl list %:.platform

   Copy to Clipboard Toggle word wrap

2. Copy the kernel module into the extra/ directory of the kernel that you want:

   # cp my_module.ko /lib/modules/$(uname -r)/extra/

   Copy to Clipboard Toggle word wrap

3. Update the modular dependency list:

   # depmod -a

   Copy to Clipboard Toggle word wrap

4. Load the kernel module:

   # modprobe -v my_module

   Copy to Clipboard Toggle word wrap

5. Optional: To load the module on boot, add it to the /etc/modules-loaded.d/my_module.conf file:

   # echo "my_module" > /etc/modules-load.d/my_module.conf

   Copy to Clipboard Toggle word wrap

Procedure

1. Boot into the GRUB boot menu.
2. Select the kernel you want to start.
3. Press the e key to edit the kernel parameters.
4. Find the kernel command line by moving the cursor down. The kernel command line starts with linux on 64-Bit IBM Power Series and x86-64 BIOS-based systems, or linuxefi on UEFI systems.

5. Move the cursor to the end of the line.

   Note

   Press Ctrl+a to jump to the start of the line and Ctrl+e to jump to the end of the line. On some systems, Home and End keys might also work.

6. Edit the kernel parameters as required. For example, to run the system in emergency mode, add the emergency parameter at the end of the linux line:

   linux   ($root)/vmlinuz-4.18.0-348.12.2.el8_5.x86_64 root=/dev/mapper/rhel-root ro crashkernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet emergency

   Copy to Clipboard Toggle word wrap

   To enable the system messages, remove the rhgb and quiet parameters.

7. Press Ctrl+x to boot with the selected kernel and the modified command line parameters.

Procedure

1. Add the following two lines to the /etc/default/grub file:

   GRUB_TERMINAL="serial"
   GRUB_SERIAL_COMMAND="serial --speed=9600 --unit=0 --word=8 --parity=no --stop=1"

   Copy to Clipboard Toggle word wrap

   The first line disables the graphical terminal. The GRUB_TERMINAL key overrides values of GRUB_TERMINAL_INPUT and GRUB_TERMINAL_OUTPUT keys.

   The second line adjusts the baud rate (--speed), parity and other values to fit your environment and hardware. Note that a much higher baud rate, for example 115200, is preferable for tasks such as following log files.

2. Update the GRUB configuration file.

   • On BIOS-based machines:

     # grub2-mkconfig -o /boot/grub2/grub.cfg

     Copy to Clipboard Toggle word wrap

   • On UEFI-based machines:

     # grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

     Copy to Clipboard Toggle word wrap
3. Reboot the system for the changes to take effect.

Procedure

1. List all parameters and their values.

   # sysctl -a

   Copy to Clipboard Toggle word wrap
   Note

   The # sysctl -a command displays kernel parameters, which can be adjusted at runtime and at boot time.

2. To configure a parameter temporarily, enter:

   # sysctl <TUNABLE_CLASS>.<PARAMETER>=<TARGET_VALUE>

   Copy to Clipboard Toggle word wrap

   The sample command above changes the parameter value while the system is running. The changes take effect immediately, without a need for restart.

   Note

   The changes return back to default after your system reboots.

Procedure

1. List all parameters.

   # sysctl -a

   Copy to Clipboard Toggle word wrap

   The command displays all kernel parameters that can be configured at runtime.

2. Configure a parameter permanently:

   # sysctl -w <TUNABLE_CLASS>.<PARAMETER>=<TARGET_VALUE> >> /etc/sysctl.conf

   Copy to Clipboard Toggle word wrap

   The sample command changes the tunable value and writes it to the /etc/sysctl.conf file, which overrides the default values of kernel parameters. The changes take effect immediately and persistently, without a need for restart.

Procedure

1. Create a new configuration file in /etc/sysctl.d/:

   # vim /etc/sysctl.d/<some_file.conf>

   Copy to Clipboard Toggle word wrap

2. Include kernel parameters, one per line:

   <TUNABLE_CLASS>.<PARAMETER>=<TARGET_VALUE>
   <TUNABLE_CLASS>.<PARAMETER>=<TARGET_VALUE>

   Copy to Clipboard Toggle word wrap
3. Save the configuration file.

4. Reboot the machine for the changes to take effect.

   • Alternatively, apply changes without rebooting:

     # sysctl -p /etc/sysctl.d/<some_file.conf>

     Copy to Clipboard Toggle word wrap

     The command enables you to read values from the configuration file, which you created earlier.

Procedure

1. Identify a kernel parameter you want to configure.

   # ls -l /proc/sys/<TUNABLE_CLASS>/

   Copy to Clipboard Toggle word wrap

   The writable files returned by the command can be used to configure the kernel. The files with read-only permissions provide feedback on the current settings.

2. Assign a target value to the kernel parameter.

   # echo <TARGET_VALUE> > /proc/sys/<TUNABLE_CLASS>/<PARAMETER>

   Copy to Clipboard Toggle word wrap

   The configuration changes applied by using a command are not permanent and will disappear once the system is restarted.

Verification

1. Verify the value of the newly set kernel parameter.

   # cat /proc/sys/<TUNABLE_CLASS>/<PARAMETER>

   Copy to Clipboard Toggle word wrap

Procedure

1. On the GRUB boot screen, press the e key for edit.

2. Add the following parameter at the end of the linux line:

   systemd.unit=rescue.target

   Copy to Clipboard Toggle word wrap
   

   View larger image

   

3. Press Ctrl+x to boot to rescue mode.

   

   View larger image

   

Procedure

1. On the GRUB boot screen, press the e key for edit.

2. Add the following parameter at the end of the linux line:

   systemd.unit=emergency.target

   Copy to Clipboard Toggle word wrap
   

   View larger image

   

3. Press Ctrl+x to boot to emergency mode.

   

   View larger image

   

Procedure

1. On the GRUB boot screen, press the e key for edit.

2. Add the following parameter at the end of the linux line:

   systemd.debug-shell

   Copy to Clipboard Toggle word wrap
   

   View larger image

   

3. Optional: Add the debug option.

   Note

   Adding the debug option to the kernel command line increases the number of log messages. For systemd, the kernel command-line option debug is now a shortcut for systemd.log_level=debug.

4. Press Ctrl+x to boot to the debug shell.

Procedure

1. Press Ctrl+Alt+F9 to connect to the debug shell.

   If you work with a virtual machine, sending this key combination requires support from the virtualization application. For example, if you use Virtual Machine Manager, select Send Key → Ctrl+Alt+F9 from the menu.

2. The debug shell does not require authentication, therefore you can see a prompt similar to the following on TTY9:

Procedure

1. Boot the host from an installation source.

2. In the boot menu for the installation media, select the Troubleshooting option.

   

   View larger image

   

3. In the Troubleshooting menu, select the Rescue a Red Hat Enterprise Linux system option.

   

   View larger image

   

4. At the Rescue menu, select 1 and press the Enter key to continue.

   

   View larger image

   

5. Change the file system root as follows:

   sh-4.4# chroot /mnt/sysimage

   Copy to Clipboard Toggle word wrap
   

   View larger image

   

6. Enter the passwd command and follow the instructions displayed on the command line to change the root password.

   

   View larger image

   

7. Remove the autorelable file to prevent a time consuming SELinux relabel of the disk:

   sh-4.4# rm -f /.autorelabel

   Copy to Clipboard Toggle word wrap
8. Enter the exit command to exit the chroot environment.
9. Enter the exit command again to resume the initialization and finish the system boot.

Procedure

1. Start the system and, on the GRUB boot screen, press the e key for edit.

2. Add the rd.break parameter at the end of the linux line:

   

   View larger image

   

3. Press Ctrl+x to boot the system with the changed parameters.

   

   View larger image

   

4. Remount the file system as writable.

   switch_root:/# mount -o remount,rw /sysroot

   Copy to Clipboard Toggle word wrap

5. Change the file system’s root.

   switch_root:/# chroot /sysroot

   Copy to Clipboard Toggle word wrap

6. Enter the passwd command and follow the instructions displayed on the command line.

   

   View larger image

   

7. Relabel all files on the next system boot.

   sh-4.4# touch /.autorelabel

   Copy to Clipboard Toggle word wrap

8. Remount the file system as read only:

   sh-4.4# mount -o remount,ro /

   Copy to Clipboard Toggle word wrap
9. Enter the exit command to exit the chroot environment.

10. Enter the exit command again to resume the initialization and finish the system boot.

    Note

    The SELinux relabeling process can take a long time. A system reboot occurs automatically when the process is complete.

Procedure

1. Copy all the kernel arguments from your default kernel to this new kernel entry:

   # grubby --add-kernel=new_kernel --title="entry_title" --initrd="new_initrd" --copy-default

   Copy to Clipboard Toggle word wrap

2. Get the list of available boot entries:

   # ls -l /boot/loader/entries/*
   -rw-r--r--. 1 root root 408 May 27 06:18 /boot/loader/entries/67db13ba8cdb420794ef3ee0a8313205-0-rescue.conf
   -rw-r--r--. 1 root root 536 Jun 30 07:53 /boot/loader/entries/67db13ba8cdb420794ef3ee0a8313205-4.18.0-372.9.1.el8.x86_64.conf
   -rw-r--r--  1 root root 336 Aug 15 15:12 /boot/loader/entries/d88fa2c7ff574ae782ec8c4288de4e85-4.18.0-193.el8.x86_64.conf

   Copy to Clipboard Toggle word wrap

3. Create a new boot entry. For example, for the 4.18.0-193.el8.x86_64 kernel, issue the command as follows:

   # grubby --grub2 --add-kernel=/boot/vmlinuz-4.18.0-193.el8.x86_64 --title="Red Hat Enterprise 8 Test" --initrd=/boot/initramfs-4.18.0-193.el8.x86_64.img --copy-default

   Copy to Clipboard Toggle word wrap

Procedure

1. List the kernel parameters from the kernelopts variable:

   # grub2-editenv - list | grep kernelopts
   kernelopts=root=/dev/mapper/rhel-root ro crashkernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet

   Copy to Clipboard Toggle word wrap

2. Make the changes to the kernel command-line parameters. You can add, remove or modify a parameter. For example, to add the debug parameter, enter:

   # grub2-editenv - set "$(grub2-editenv - list | grep kernelopts) <debug>"

   Copy to Clipboard Toggle word wrap

3. Optional: Verify the parameter newly added to kernelopts:

   # grub2-editenv - list | grep kernelopts
   kernelopts=root=/dev/mapper/rhel-root ro crashkernel=auto resume=/dev/mapper/rhel-swap rd.lvm.lv=rhel/root rd.lvm.lv=rhel/swap rhgb quiet debug

   Copy to Clipboard Toggle word wrap
4. Reboot the system for the changes to take effect.

Procedure

1. Set the GRUB_TIMEOUT_STYLE option in the /etc/default/grub file as follows:

   GRUB_TIMEOUT_STYLE=hidden

   Copy to Clipboard Toggle word wrap

2. Rebuild the grub.cfg file for the changes to take effect.

   • On BIOS-based machines, enter:

     # grub2-mkconfig -o /boot/grub2/grub.cfg

     Copy to Clipboard Toggle word wrap

   • On UEFI-based machines, enter:

     # grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

     Copy to Clipboard Toggle word wrap
3. Press the Esc key to display the list of bootable kernels when booting.

Procedure

1. Specify which operating system or kernel must be loaded by default by passing its index to the grub2-set-default command, for example:

   # grubby --set-default-index=1
   The default is /boot/loader/entries/d5151aa93c444ac89e78347a1504d6c6-4.18.0-348.el8.x86_64.conf with index 1 and kernel /boot/vmlinuz-4.18.0-348.el8.x86_64

   Copy to Clipboard Toggle word wrap

   GRUB supports using a numeric value as the key for the saved_entry directive in /boot/grub2/grubenv to change the default order in which the operating systems are loaded.

   Note

   Index counting starts with zero. Therefore, GRUB loads the second entry. With the next installed kernel, the index value will be overwritten.

   Note

   You can also use grubby to find indices for kernels. For more information, see Viewing the GRUB Menu Entry for a Kernel.

2. Optional: Force the system to always use a particular menu entry:

   1. List the available menu entries:

      # grubby --info=ALL

      Copy to Clipboard Toggle word wrap

   2. Use the menu entry name or the number of the position of a menu entry in the list as the key to the GRUB_DEFAULT directive in the /etc/default/grub file. For example:

      GRUB_DEFAULT=example-gnu-linux

      Copy to Clipboard Toggle word wrap

3. Rebuild the grub.cfg file for the changes to take effect.

   • On BIOS-based machines, enter:

     # grub2-mkconfig -o /boot/grub2/grub.cfg

     Copy to Clipboard Toggle word wrap

   • On UEFI-based machines:

     # grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

     Copy to Clipboard Toggle word wrap

Procedure

1. Reinstall GRUB on the device where it is installed. For example, if sda is your device:

   # grub2-install /dev/sda

   Copy to Clipboard Toggle word wrap

2. Reboot your system for the changes to take effect:

   # reboot

   Copy to Clipboard Toggle word wrap

Procedure

1. Reinstall the grub2-efi and shim boot loader files:

   # yum reinstall grub2-efi shim

   Copy to Clipboard Toggle word wrap

2. Reboot your system for the changes to take effect:

   # reboot

   Copy to Clipboard Toggle word wrap

Procedure

1. Determine the disk partition that stores GRUB:

   # bootlist -m normal -o
   sda1

   Copy to Clipboard Toggle word wrap

2. Reinstall GRUB on the disk partition:

   # grub2-install partition

   Copy to Clipboard Toggle word wrap

   Replace partition with the identified GRUB partition, such as /dev/sda1.

3. Reboot your system for the changes to take effect:

   # reboot

   Copy to Clipboard Toggle word wrap

Procedure

1. Remove the configuration files:

   # rm /etc/grub.d/*
   # rm /etc/sysconfig/grub

   Copy to Clipboard Toggle word wrap

2. Reinstall packages.

   • On BIOS-based machines:

     # yum reinstall grub2-tools

     Copy to Clipboard Toggle word wrap

   • On UEFI-based machines:

     # yum reinstall grub2-efi shim grub2-tools grub2-common

     Copy to Clipboard Toggle word wrap

3. Rebuild the grub.cfg file for the changes to take effect.

   • On BIOS-based machines:

     # grub2-mkconfig -o /boot/grub2/grub.cfg

     Copy to Clipboard Toggle word wrap

   • On UEFI-based machines:

     # grub2-mkconfig -o /boot/efi/EFI/redhat/grub.cfg

     Copy to Clipboard Toggle word wrap
4. Follow Reinstalling GRUB procedure to restore GRUB on the /boot/ partition.

Procedure

1. Issue the grub2-setpassword command as root:

   # grub2-setpassword

   Copy to Clipboard Toggle word wrap

2. Enter the password for the user and press the Enter key to confirm the password:

   Enter password:
   Confirm the password:

   Copy to Clipboard Toggle word wrap

Procedure

1. Open the Boot Loader Specification (BLS) file for boot entry you want to modify from the /boot/loader/entries/ directory.
2. Find the line beginning with grub_users. This parameter passes extra arguments to menuentry.
3. Set the grub_users attribute to the user name that is allowed to boot the entry besides the superusers, by default this user is root.