1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
|
<?xml version='1.0'?> <!--*-nxml-*-->
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
<refentry id="loader.conf" conditional='HAVE_GNU_EFI'
xmlns:xi="http://www.w3.org/2001/XInclude">
<refentryinfo>
<title>loader.conf</title>
<productname>systemd</productname>
</refentryinfo>
<refmeta>
<refentrytitle>loader.conf</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>
<refnamediv>
<refname>loader.conf</refname>
<refpurpose>Configuration file for systemd-boot</refpurpose>
</refnamediv>
<refsynopsisdiv>
<para><filename><replaceable>ESP</replaceable>/loader/loader.conf</filename>,
<filename><replaceable>ESP</replaceable>/loader/entries/*.conf</filename>
</para>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>
<citerefentry><refentrytitle>systemd-boot</refentrytitle><manvolnum>7</manvolnum></citerefentry>
will read <filename><replaceable>ESP</replaceable>/loader/loader.conf</filename> and any files with the
<literal>.conf</literal> extension under
<filename><replaceable>ESP</replaceable>/loader/entries/</filename> on the EFI system partition (ESP).
</para>
<para>Each configuration file must consist of an option name, followed by
whitespace, and the option value. <literal>#</literal> may be used to start
a comment line. Empty and comment lines are ignored.</para>
<para>Boolean arguments may be written as
<literal>yes</literal>/<literal>y</literal>/<literal>true</literal>/<literal>t</literal>/<literal>on</literal>/<literal>1</literal> or
<literal>no</literal>/<literal>n</literal>/<literal>false</literal>/<literal>f</literal>/<literal>off</literal>/<literal>0</literal>.
</para>
</refsect1>
<refsect1>
<title>Options</title>
<para>The following configuration options in <filename>loader.conf</filename> are understood:</para>
<variablelist>
<varlistentry>
<term>default</term>
<listitem><para>A glob pattern to select the default entry. The default entry
may be changed in the boot menu itself, in which case the name of the
selected entry will be stored as an EFI variable, overriding this option.
</para>
<para>If set to <literal>@saved</literal> the chosen entry will be saved as an EFI variable
on every boot and automatically selected the next time the boot loader starts.</para>
<table>
<title>Automatically detected entries will use the following names:</title>
<tgroup cols='2'>
<colspec colname='name' />
<colspec colname='expl' />
<thead>
<row>
<entry>Name</entry>
<entry>Description</entry>
</row>
</thead>
<tbody>
<row>
<entry>auto-efi-default</entry>
<entry>EFI Default Loader</entry>
</row>
<row>
<entry>auto-efi-shell</entry>
<entry>EFI Shell</entry>
</row>
<row>
<entry>auto-osx</entry>
<entry>macOS</entry>
</row>
<row>
<entry>auto-reboot-to-firmware-setup</entry>
<entry>Reboot Into Firmware Interface</entry>
</row>
<row>
<entry>auto-windows</entry>
<entry>Windows Boot Manager</entry>
</row>
</tbody>
</tgroup>
</table></listitem>
</varlistentry>
<varlistentry>
<term>timeout</term>
<listitem><para>How long the boot menu should be shown before the default
entry is booted, in seconds. This may be changed in the boot menu itself and
will be stored as an EFI variable in that case, overriding this option.
</para>
<para>If set to <literal>menu-hidden</literal> or <literal>0</literal> no menu
is shown and the default entry will be booted immediately. The menu can be shown
by pressing and holding a key before systemd-boot is launched. Setting this to
<literal>menu-force</literal> disables the timeout while always showing the menu.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>console-mode</term>
<listitem><para>This option configures the resolution of the console. Takes a
number or one of the special values listed below. The following values may be
used:</para>
<variablelist>
<varlistentry>
<term>0</term>
<listitem>
<para>Standard UEFI 80x25 mode</para>
</listitem>
</varlistentry>
<varlistentry>
<term>1</term>
<listitem>
<para>80x50 mode, not supported by all devices</para>
</listitem>
</varlistentry>
<varlistentry>
<term>2</term>
<listitem>
<para>the first non-standard mode provided by the device
firmware, if any</para>
</listitem>
</varlistentry>
<varlistentry>
<term>auto</term>
<listitem>
<para>Pick a suitable mode automatically using heuristics</para>
</listitem>
</varlistentry>
<varlistentry>
<term>max</term>
<listitem>
<para>Pick the highest-numbered available mode</para>
</listitem>
</varlistentry>
<varlistentry>
<term>keep</term>
<listitem>
<para>Keep the mode selected by firmware (the default)</para>
</listitem>
</varlistentry>
</variablelist>
</listitem>
</varlistentry>
<varlistentry>
<term>editor</term>
<listitem><para>Takes a boolean argument. Enable (the default) or disable the
editor. The editor should be disabled if the machine can be accessed by
unauthorized persons.</para></listitem>
</varlistentry>
<varlistentry>
<term>auto-entries</term>
<listitem><para>Takes a boolean argument. Enable (the default) or disable
entries for other boot entries found on the boot partition. In particular,
this may be useful when loader entries are created to show replacement
descriptions for those entries.</para></listitem>
</varlistentry>
<varlistentry>
<term>auto-firmware</term>
<listitem><para>A boolean controlling the presence of the "Reboot into firmware" entry
(enabled by default). If this is disabled, the firmware interface may still be reached
by using the <keycap>f</keycap> key.</para></listitem>
</varlistentry>
<varlistentry>
<term>beep</term>
<listitem><para>Beep once as soon as the boot menu is shown (default disabled). Currently,
only x86 is supported, where it uses the PC speaker.</para></listitem>
</varlistentry>
<varlistentry>
<term>reboot-for-bitlocker</term>
<listitem><para>Work around BitLocker requiring a recovery key when the boot loader was
updated (enabled by default).</para>
<para>Try to detect BitLocker encrypted drives along with an active TPM. If both are found
and Windows Boot Manager is selected in the boot menu, set the <literal>BootNext</literal>
EFI variable and restart the system. The firmware will then start Windows Boot Manager
directly, leaving the TPM PCRs in expected states so that Windows can unseal the encryption
key. This allows systemd-boot to be updated without having to provide the recovery key for
BitLocker drive unlocking.</para>
<para>Note that the PCRs that Windows uses can be configured with the
<literal>Configure TPM platform validation profile for native UEFI firmware configurations</literal>
group policy under <literal>Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption</literal>.
When secure boot is enabled, changing this to PCRs <literal>0,2,7,11</literal> should be safe.
The TPM key protector needs to be removed and then added back for the PCRs on an already
encrypted drive to change. If PCR 4 is not measured, this setting can be disabled to speed
up booting into Windows.</para></listitem>
</varlistentry>
<varlistentry>
<term>random-seed-mode</term>
<listitem><para>Takes one of <literal>off</literal>, <literal>with-system-token</literal> and
<literal>always</literal>. If <literal>off</literal> no random seed data is read off the ESP, nor
passed to the OS. If <literal>with-system-token</literal> (the default)
<command>systemd-boot</command> will read a random seed from the ESP (from the file
<filename>/loader/random-seed</filename>) only if the <varname>LoaderSystemToken</varname> EFI
variable is set, and then derive the random seed to pass to the OS from the combination. If
<literal>always</literal> the boot loader will do so even if <varname>LoaderSystemToken</varname> is
not set. This mode is useful in environments where protection against OS image reuse is not a
concern, and the random seed shall be used even with no further setup in place. Use <command>bootctl
random-seed</command> to initialize both the random seed file in the ESP and the system token EFI
variable.</para>
<para>See <ulink url="https://systemd.io/RANDOM_SEEDS">Random Seeds</ulink> for further
information.</para></listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>Example</title>
<programlisting># /boot/efi/loader/loader.conf
timeout 0
default 01234567890abcdef1234567890abdf0-*
editor no
</programlisting>
<para>The menu will not be shown by default (the menu can still be shown by
pressing and holding a key during boot). One of the entries with files with a
name starting with <literal>01234567890abcdef1234567890abdf0-</literal> will be
selected by default. If more than one entry matches, the one with the highest
priority will be selected (generally the one with the highest version number).
The editor will be disabled, so it is not possible to alter the kernel command
line.</para>
</refsect1>
<refsect1>
<title>See Also</title>
<para>
<citerefentry><refentrytitle>systemd-boot</refentrytitle><manvolnum>7</manvolnum></citerefentry>,
<citerefentry><refentrytitle>bootctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>
</para>
</refsect1>
</refentry>
|
