From 5406a8dec86598efad7c0f0a06d0435445de9f1e Mon Sep 17 00:00:00 2001 From: Marta Lewandowska Date: Wed, 19 Aug 2026 15:05:25 +0200 Subject: [PATCH] Harden grubby changes and add exit errors Signed-off-by: Marta Lewandowska --- grubby-bls | 44 ++++++++++++++++++++++++++++++++++++-------- grubby.8 | 48 ++++++++++++++++++++++++++++++++++++++++-------- grubby.spec | 6 +++++- 3 files changed, 81 insertions(+), 17 deletions(-) diff --git a/grubby-bls b/grubby-bls index 40cda08..106ac94 100755 --- a/grubby-bls +++ b/grubby-bls @@ -154,6 +154,22 @@ display_default_value() { echo "${bls_title[$default_index]}" exit 0 ;; + blscfg_status) + if grep -q "^GRUB_ENABLE_BLSCFG=.*" ${grub_etc_default} ; then + echo $(grep "^GRUB_ENABLE_BLSCFG=.*" ${grub_etc_default} | sed -e "s/GRUB_ENABLE_BLSCFG=//") + else + echo "value not set" + fi + exit 0 + ;; + grub_timeout) + if grep -q "^GRUB_TIMEOUT=.*" ${grub_etc_default} ; then + echo $(grep "^GRUB_TIMEOUT=.*" ${grub_etc_default} | sed -e "s/GRUB_TIMEOUT=//") + else + echo "value not set" + fi + exit 0 + ;; esac } @@ -555,6 +571,8 @@ update_timeout() { fi RUN_MKCONFIG=true update_grubcfg + else + print_error "The value $timeout is not a valid value for timeout." fi } @@ -568,6 +586,8 @@ update_blscfg() { fi RUN_MKCONFIG=true update_grubcfg + else + print_error "The value $blscfg is not a valid value." fi } @@ -687,6 +707,7 @@ Usage: grubby [OPTION...] --add-kernel=kernel-path add an entry for the specified kernel --args=args default arguments for the new kernel or new arguments for kernel being updated) --bad-image-okay don't sanity check images in boot entries (for testing only) + --blscfg-status show whether BLSCFG is enabled -c, --config-file=path path to grub config file to update ("-" for stdin) --copy-default use the default boot entry as a template for the new entry being added; if the default is not a linux image, or if the kernel referenced by the default image does not exist, the first linux entry whose kernel does exist is used as the template @@ -704,10 +725,11 @@ Usage: grubby [OPTION...] --set-blscfg=value change value of GRUB_ENABLE_BLSCFG --set-default=kernel-path make the first entry referencing the specified kernel the default --set-default-index=entry-index make the given entry index the default entry - --set-timeout=timeout change grub2 timeout value - --serial-cmd=cmd set grub2 serial command - --terminal-in=input-method set grub2 terminal input - --terminal-out=output-method set grub2 terminal output + --set-timeout=timeout change grub timeout value + --serial-cmd=cmd set grub serial command + --terminal-in=input-method set grub terminal input + --terminal-out=output-method set grub terminal output + --timeout display grub timeout --title=entry-title title to use for the new kernel entry --update-kernel=kernel-path updated information for the specified kernel --zipl configure zipl bootloader @@ -721,10 +743,10 @@ EOF } OPTS="$(getopt -o hc:i:b:? --long help,add-kernel:,args:,bad-image-okay,\ -config-file:,copy-default,default-kernel,default-index,default-title,env:,\ -grub2,info:,initrd:,extra-initrd:,make-default,remove-args:,remove-kernel:,\ -set-blscfg:,set-default:,set-default-index:,set-timeout:,\ -serial-cmd:,terminal-in:,terminal-out:,title:,update-kernel:,zipl,\ +blscfg-status,config-file:,copy-default,default-kernel,default-index,\ +default-title,env:,grub2,info:,initrd:,extra-initrd:,make-default,remove-args:,\ +remove-kernel:,set-blscfg:,set-default:,set-default-index:,set-timeout:,\ +serial-cmd:,terminal-in:,terminal-out:,timeout,title:,update-kernel:,zipl,\ bls-directory:,no-etc-grub-update,add-multiboot:,mbargs:,mounts:,boot-filesystem:,\ bootloader-probe,debug,devtree,devtreedir:,elilo,efi,extlinux,grub,lilo,\ output-file:,remove-mbargs:,remove-multiboot:,silo,yaboot -n ${SCRIPTNAME} -- "$@")" @@ -750,6 +772,9 @@ while [ ${#} -gt 0 ]; do --bad-image-okay) bad_image=true ;; + --blscfg-status) + display_default="blscfg_status" + ;; --config-file|-c) grub_config="${2}" zipl_config="${2}" @@ -825,6 +850,9 @@ while [ ${#} -gt 0 ]; do term_out="${2}" shift ;; + --timeout) + display_default="grub_timeout" + ;; --title) title="${2}" shift diff --git a/grubby.8 b/grubby.8 index e9a8e7b..c31ab56 100644 --- a/grubby.8 +++ b/grubby.8 @@ -4,14 +4,18 @@ grubby \- command line tool for configuring grub and zipl .SH SYNOPSIS \fBgrubby\fR [--add-kernel=\fIkernel-path\fR] [--args=\fIargs\fR] - [--bad-image-okay] [--config-file=\fIpath\fR] [--copy-default] - [--default-kernel] [--default-index] [--default-title] - [--env=\fIpath\fR] [--grub2] [--info=\fIkernel-path\fR] - [--initrd=\fIinitrd-path\fR] [--extra-initrd=\fIinitrd-path\fR] - [--make-default] [--remove-args=\fIargs\fR] - [--remove-kernel=\fIkernel-path\fR] [--set-default=\fIkernel-path\fR] - [--set-default-index=\fientry-index\fR] [--title=\fentry-title\fR] - [--update-kernel=\fIkernel-path\fR] [--zipl] [--bls-directory=\fIpath\fR] + [--bad-image-okay] [--blscfg-status] [--config-file=\fIpath\fR] + [--copy-default] [--default-kernel] [--default-index] + [--default-title] [--env=\fIpath\fR] [--grub2] + [--info=\fIkernel-path\fR] [--initrd=\fIinitrd-path\fR] + [--extra-initrd=\fIinitrd-path\fR] [--make-default] + [--remove-args=\fIargs\fR] [--remove-kernel=\fIkernel-path\fR] + [--set-blscfg=\fIvalue\fR] [--set-default=\fIkernel-path\fR] + [--set-default-index=\fientry-index\fR] [--set-timeout=\fItimeout\fR] + [--serial-cmd=\fIcmd\fR] [--terminal-in=\fIinput-method\fR] + [--terminal-out=\fIoutput-method\fR] [--timeout] + [--title=\fentry-title\fR] [--update-kernel=\fIkernel-path\fR] + [--zipl] [--bls-directory=\fIpath\fR] .SH DESCRIPTION \fBgrubby\fR is a command line tool for updating and displaying information @@ -60,6 +64,10 @@ the kernel exists in the filesystem, to make sure entries that obviously won't work aren't selected. This option overrides that behavior, and is designed primarily for testing. +.TP +\fB-\-blscfg-status\fR +Display whether BLSCFG is enabled and exit. + .TP \fB-\-config-file\fR=\fIpath\fR Use \fIpath\fR as the configuration file rather then the default. @@ -124,6 +132,10 @@ Removes all boot entries which match \fIkernel-path\fR. This may be used along with -\-add-kernel, in which case the new kernel being added will never be removed. +.TP +\fB-\-set-blscfg\fR=\fIvalue\fR +Set GRUB_ENABLE_BLSCFG in /etc/default/grub to either true or false and exit. + .TP \fB-\-set-default\fR=\fIkernel-path\fR The first entry which boots the specified kernel is made the default @@ -133,6 +145,26 @@ boot entry. \fB-\-set-default-index\fR=\fIentry-index\fR Makes the given entry number the default boot entry. +.TP +\fB-\-set-timeout\fR=\fItimeout\fR +Set GRUB_TIMEOUT (in seconds) in /etc/default/grub and exit. + +.TP +\fB-\-serial-cmd\fR=\fIcmd\fR +Set GRUB_SERIAL_COMMAND in /etc/default/grub and exit. + +.TP +\fB-\-terminal-in\fR=\fIinput-method\fR +Set GRUB_TERMINAL_INPUT in /etc/default/grub and exit. + +.TP +\fB-\-terminal-out\fR=\fIoutput-method\fR +Set GRUB_TERMINAL_OUTPUT in /etc/default/grub and exit. + +.TP +\fB-\-timeout\fR +Display GRUB TIMEOUT and exit. + .TP \fB-\-title\fR=\fIentry-title\fR When a new kernel entry is added \fIentry-title\fR is used as the title diff --git a/grubby.spec b/grubby.spec index 97ac46f..8c8afec 100644 --- a/grubby.spec +++ b/grubby.spec @@ -3,7 +3,7 @@ Name: grubby Version: 8.40 -Release: 84%{?dist} +Release: 85%{?dist} Summary: Command line tool for updating bootloader configs License: GPL-2.0-or-later Source1: grubby-bls @@ -74,6 +74,10 @@ fi %{_mandir}/man8/grubby.8* %changelog +* Wed Aug 19 2026 Marta Lewandowska - 8.40-85 +- Harden previous changes, allow displaying values + Related: RHEL-4341 + * Mon Jul 20 2026 Marta Lewandowska - 8.40-84 - Empower grubby to update the grub timeout and other values Resolves: RHEL-4341