Skip to content

DOCTEAM-2023 Issue in Creating GRUB 2 NetBoot directories for PXE server #654

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sounix000 wants to merge 4 commits into
base: main
Choose a base branch
from
Open

DOCTEAM-2023 Issue in Creating GRUB 2 NetBoot directories for PXE server #654

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b647c7c
Clarified Secure Boot scope (UEFI/x86_64/AArch64 only) and added shim…
sounix000 Mar 20, 2026
6f63a34
minor change in revision history
sounix000 Mar 24, 2026
3c25999
Clarified that ppc64le supports secure boot but not UEFI, and added l…
sounix000 Mar 31, 2026
4ce18bb
Addressed comments from SMEs
sounix000 Apr 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions articles/sles-pxe-server-setup.asm.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,13 @@
<merge>
<title>Setting Up a PXE Boot Server</title>
<revhistory xml:id="rh-sles-pxe-server-setup">
<revision><date>2026-03-19</date>
<revdescription>
<para>
Clarified Secure Boot scope to UEFI-based architectures only, documented architecture-specific limitation of the shim package, and updated signed EFI file sourcing guidance.
</para>
</revdescription>
</revision>
<revision><date>2026-03-18</date>
<revdescription>
<para>
Expand Down
45 changes: 35 additions & 10 deletions tasks/sles-pxe-server-netboot-directories-uefi-secure-boot.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@
<para>
This section explains creating &grub; NetBoot directories for PXE servers using
<command>grub2-mknetdir</command>, which generates architecture-specific directories for
&x86-64; (UEFI and BIOS), &aarch64;, and &ppc64le; systems. For &uefisecboot; support,
&x86-64; (UEFI and BIOS), &aarch64;, and &ppc64le; systems. For Secure Boot support,
administrators must copy signed EFI files from installation media or use the
<package>shim</package> package to replace the default unsigned bootloader files.
</para>
Expand All @@ -42,16 +42,41 @@
architecture-specific directories under <filename>/srv/tftpboot/boot/grub2/</filename> for
different platforms. For example, &x86-64; systems generate both UEFI
(<filename>x86_64-efi</filename>) and legacy BIOS (<filename>i386-pc</filename>) directories,
while &aarch64; and &ppc64le; systems create their respective UEFI directories
(<filename>arm64-efi</filename> and <filename>powerpc-ieee1275</filename>).
and &aarch64; create their UEFI directory
<filename>arm64-efi</filename>. &ppc64le; systems (<filename>powerpc-ieee1275</filename>) supports secure boot too; the &grub; bootloader is in <filename>/boot/grub2/grub.elf</filename> on the ISOs.
</para>
Comment thread
sounix000 marked this conversation as resolved.
<important>
<para>
In the context of this section, Secure Boot applies to &x86-64; and &aarch64; architectures. &grub; PXE Secure Boot for &ppc64le; (which uses a different platform-specific mechanism) is not covered here.
</para>
</important>
<para>
For &uefisecboot; support, which is not provided by the default unsigned
<filename>core.efi</filename> files, administrators can either copy signed EFI files from
installation media or install the <package>shim</package> package and manually copy the
required bootloader files (<filename>shim.efi</filename>, <filename>grub.efi</filename>,
<filename>MokManager.efi</filename>) to the appropriate architecture directories, ensuring
proper symbolic link resolution to keep all files within the TFTP root directory.
For Secure Boot support, which is not provided by the default unsigned
<filename>core.efi</filename> files, administrators must obtain signed EFI files.
The signed files can be obtained from either of the following sources:
</para>
<itemizedlist>
<listitem>
<para>
The <package>shim</package> package installed on the PXE server (<command>zypper install
shim</command>), which provides <filename>shim.efi</filename>, <filename>grub.efi</filename>,
and <filename>MokManager.efi</filename> under
<filename>/usr/share/efi/<replaceable>ARCH</replaceable>/</filename>. Note that the
<package>shim</package> package provides files only for the architecture of the PXE server
itself. To support a different architecture, use the installation media ISO or manually
extract the files from the architecture-specific <package>shim</package> package.
</para>
</listitem>
<listitem>
<para>
The installation media ISO (mounted and copied from <filename>/mnt/EFI/BOOT/*.efi</filename>),
which provides signed EFI files for the target architecture regardless of the PXE server
architecture.
</para>
</listitem>
</itemizedlist>
<para>
The files must be copied to the appropriate architecture directories. This ensures proper symbolic link resolution to keep all files within the TFTP root directory.
</para>
</section>
<section xml:id="sles-pxe-server-netboot-directories-uefi-secure-boot-requirements">
Expand Down Expand Up @@ -153,7 +178,7 @@
<para>
Replace <filename><replaceable>ARCH</replaceable>-efi</filename> with
<filename>x86_64-efi</filename> or <filename>arm64-efi</filename>&mdash;the
supported architectures for &uefisecboot;.
supported architectures for Secure Boot.
</para>
</callout>
</calloutlist>
Expand Down