3 ms·
When I saw the title, I planned on posting about systemd's boot stub and unified images. Happy that I don't have to. A couple of random additions: 1) If you ar
by gizmo686 4y ago
When I saw the title, I planned on posting about systemd's boot stub and unified images. Happy that I don't have to. A couple of random additions:
1) If you are using a dracut based initrd (which seems to be the standard for general purpose Linux distributions), then dracut has a --uefi flag that automatically creates a unified image. Under the hood, it does exactly what the article describes, but you can just add a flag to the command that was creating your ramdisk instead of needing to figure out the obj copy incantation. You're still on your own for signing though.
2) You do not need to pivot out of the ramdisk. You can put your entire system in the single EFI executable. In addition to the security implications, this makes it very easy to create a portable OS. Just copy the file to a thumbdrive with an EFI compatable filesystem and select it from the EFI boot menu.
2.5) To hawk dracut a bit more, while it is very much designed around the assumption that its job is to execute a pivot root, it is actually quite useful for the above as well. You can easily specify executables on the host system you want to include, and dracut will automagically include them and any libraries they depend on. Set the kernel commandline to include a dracut breakpoint before the pivot happens, and you will be dropped directly to a terminal.
3) > One can easily compile the boot stub separately from the rest of systemd and copy it over to various systems to be used.
This is probably because I am not familiar with systemd's build system, but this was only half true for me. I had to check out the entire repository and due a build from the top level. I was able to get it to compile nothing but the stub, but before it would do that, I still had to satisfy the dependencies of all the other components (which I could do by deleting the dependency in the build files since I wasn't actually going to compile them).