LOADER.CONF(5) loader.conf LOADER.CONF(5) (NAME) loader.conf - systemd-boot (SYNOPSIS) ESP/loader/loader.conf (DESCRIPTION) systemd-boot(7) ESP/loader/loader.conf . () (Secure Boot) . . UTF-8 <> ( ) . ("#") . (whitespace) . (Boolean) "yes"/"y"/"true"/"t"/"on"/"1" "no"/"n"/"false"/"f"/"off"/"0" . : systemd-boot # (ESP/loader/entries/*.conf XBOOTLDR/loader/entries/*.conf) # (ESP/EFI/Linux/*.uki XBOOTLDR/EFI/Linux/*.uki) . UAPI.1 Boot Loader Specification[1] . : systemd-boot EFI . (timeout) . systemd-boot(7) . (OPTIONS) loader.conf : default glob (id) ".conf" . EFI . "@saved" EFI . Table 1. : +------------------------------+--------------------------------+ | | | +------------------------------+--------------------------------+ |auto-efi-default | | | | EFI | +------------------------------+--------------------------------+ |auto-efi-shell | EFI Shell | +------------------------------+--------------------------------+ |auto-osx | | | | macOS | +------------------------------+--------------------------------+ |auto-poweroff | | | | | +------------------------------+--------------------------------+ |auto-reboot | | | | | +------------------------------+--------------------------------+ |auto-reboot-to-firmware-setup | | | | | | | | | | | +------------------------------+--------------------------------+ |auto-windows | | | | (Windows | | | Boot Manager) | +------------------------------+--------------------------------+ (glob) "?" "*" "[...]" ( ). glob(7) . . ( bootctl list ) . 239. timeout . EFI . "menu-disabled" "menu-hidden" "0" () . "menu-disabled" systemd-boot . "menu-force" . 239. console-mode () . EFI . . : 0 UEFI 80x25 239. 1 80x50 239. 2 239. auto 239. max 239. keep () 239. 239. editor . () . . 239. auto-entries . () . . 239. auto-firmware "Reboot Into Firmware Interface" ( ). f . 239. auto-reboot "Reboot The System" ( ). Shift+b . 255. auto-poweroff "Power Off The System" ( ). Shift+o . 255. beep . n- n ( ). x86 (PC speaker) . 251. secure-boot-enroll : (soft-brick) . (Secure Boot) ESP (setup mode) : if-safe . manual "auto" . . 253. manual . 253. off . 253. force "auto" . . 253. /loader/keys/NAME NAME . Secure Boot . Secure Boot (KEK) (PK). UEFI specification[2] Secure Boot and Driver Signing . EDK2 documentation[3] . UEFI db.auth KEK.auth PK.auth . UEFI . X.509 . uuid=$(systemd-id128 new --uuid) for key in PK KEK db; do openssl req -new -x509 -subj "/CN=${key}/" -keyout "${key}.key" -out "${key}.pem" openssl x509 -outform DER -in "${key}.pem" -out "${key}.der" sbsiglist --owner "${uuid}" --type x509 --output "${key}.esl" "${key}.der" done # : Windows Secure Boot Key Creation and Management Guidance[4] curl --location \ "https://go.microsoft.com/fwlink/p/?linkid=321192" -o ms-db-2011.der \ "https://go.microsoft.com/fwlink/p/?linkid=321185" -o ms-kek-2011.der \ "https://go.microsoft.com/fwlink/p/?linkid=321194" -o ms-uefi-db-2011.der \ "https://go.microsoft.com/fwlink/p/?linkid=2239776" -o ms-db-2023.der \ "https://go.microsoft.com/fwlink/p/?linkid=2239775" -o ms-kek-2023.der \ "https://go.microsoft.com/fwlink/p/?linkid=2239872" -o ms-uefi-db-2023.der sha1sum -c < Microsoft Windows ( ). cat ms-db-*.esl >>db.esl # Microsoft UEFI / Option ROM # ( shim) . # ( ). cat ms-uefi-*.esl >>db.esl # Microsoft KEK . # UEFI . # fwupdmgr(1) . cat ms-kek-*.esl >>KEK.esl attr=NON_VOLATILE,RUNTIME_ACCESS,BOOTSERVICE_ACCESS,TIME_BASED_AUTHENTICATED_WRITE_ACCESS sbvarsign --attr "${attr}" --key PK.key --cert PK.pem --output PK.auth PK PK.esl sbvarsign --attr "${attr}" --key PK.key --cert PK.pem --output KEK.auth KEK KEK.esl sbvarsign --attr "${attr}" --key KEK.key --cert KEK.pem --output db.auth db db.esl . Option ROM ( ) . Secure Boot and Option ROMs[5] . 252. secure-boot-enroll-action Secure Boot . reboot . . shutdown . "secure-boot-enroll" . 258. secure-boot-enroll-timeout-sec . "hidden" "0" . ( ) . "secure-boot-enroll" . 259. reboot-for-bitlocker : systemd ( ). (BitLocker) (recovery key) ( ). BitLocker TPM . Windows Boot Manager EFI "BootNext" . Windows Boot Manager PCR TPM . systemd- boot(7) BitLocker . PCR (Group Policy) "Configure TPM platform validation profile for native UEFI firmware configurations" "Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption" . Secure Boot PCR "0,2,7,11" . PCR TPM . PCR 4 . 251. reboot-on-error . yes . no - EFI . auto . . 258. log-level systemd-boot(7) . "emerg" "alert" "crit" "err" "warning" "notice" "info" "debug". "info" SMBIOS Type 11 smbios-type-11(7) . loader.conf . 259. (EXAMPLES) # /boot/efi/loader/loader.conf timeout 0 default 01234567890abcdef1234567890abdf0-* editor no ( ). "01234567890abcdef1234567890abdf0-" . ( ). . (SEE ALSO) systemd-boot(7), bootctl(1) (NOTES) 1. UAPI.1 Boot Loader Specification https://uapi- group.org/specifications/specs/boot_loader_specification 2. UEFI specification https://uefi.org/specifications 3. EDK2 documentation https://edk2-docs.gitbook.io/understanding-the-uefi-secure-boot- chain/secure_boot_chain_in_uefi/uefi_secure_boot 4. Windows Secure Boot Key Creation and Management Guidance https://learn.microsoft.com/en-us/windows- hardware/manufacture/desktop/windows-secure-boot-key-creation-and- management-guidance 5. Secure Boot and Option ROMs https://github.com/Foxboron/sbctl/wiki/FAQ#option-rom systemd 261.2 LOADER.CONF(5)