Certification Objective 3.02-The GRUB Boot Loader | Linux Patch Management: Keeping Linux Systems Up To Date

The standard boot loader associated with Red Hat Enterprise Linux (RHEL) is GRUB, the GRand Unified Boot loader. LILO, the Linux Loader, is no longer supported. As suggested by the Red Hat exam requirements, for the RHCT exam, you need to know how to use the GRUB menu to boot into different runlevels, and diagnose and correct boot failures arising from boot loader errors.

GRUB, the GRand Unified Bootloader

Red Hat has implemented GRUB as the only boot loader for its Linux distributions. When you start your computer, your BIOS looks for the /boot directory and finds the GRUB menu, which will look similar to Figure 3-2. If you've configured your computer with multiple operating systems, you can use the GRUB menu to boot any operating system detected during the Linux installation process.

image from book
Figure 3-2: The GRand Unified Bootloader (GRUB)

If you need to do something special with GRUB, you can edit the commands. If GRUB is password protected, you'll need to start with the p command. Use the e command to temporarily edit the file. You'll see a number of basic commands that you can use to modify GRUB, as shown in Figure 3-3 and Table 3-1. You can use these commands to test different GRUB configurations. They can help you troubleshoot problems with the GRUB configuration file, without booting, editing, and rebooting your system. That could possibly help you save time during the Troubleshooting exam. But once you find the solution, make sure to record the change in the GRUB configuration file, /boot/grub/grub.conf.

Table 3-1: GRUB Editing Commands
Command	Description
b	Boot the currently listed operating system
d	Delete the current line
e	Edit the current line
o	Create an empty line underneath the current line
O	Create an empty line above the current line

image from book
Figure 3-3: Details of GRUB

On the Job

Other Linux distributions store the GRUB menu in /boot/grub/menu.lst. Red Hat links that file to its GRUB menu file, /boot/grub/grub.conf.

Exam Watch

If you're troubleshooting GRUB, the GRUB menu can help you experiment with changes quickly. However, if you find the solution in this way, you'll still need to change (and test) the GRUB configuration file, /boot/grub/grub.conf.

Exam Watch

If you find a problem with GRUB during the Troubleshooting and System Maintenance part of your exam and are unsure about the solution, testing changes through the GRUB menu could save you time. However, until you record the change in the GRUB configuration file (which requires that you boot Linux into some runlevel), you won't get credit for the work that you've done.

You can also use GRUB to boot other operating systems, including various versions of Microsoft Windows, as shown in Figure 3-3.

On the Job

The /etc/grub.conf file is linked to the actual GRUB configuration file, /boot/grub/grub.conf. If you edit /etc/grub.conf, changes are automatically reflected in /boot/grub/grub.conf.

GRUB Parameters

To pass a parameter to GRUB, type the a command in the first GRUB menu. This allows you to append the command sent to the kernel. After typing the a command, you might see a command line similar to the following:

 grub append> ro root=LABEL=/ rhgb quiet

You can add the command of your choice to the end of this command. For example, if you add single at the end of this line, Linux starts in single-user mode. If you're having trouble getting Linux to recognize all of the RAM on your computer, try adding mem=xyzM (where xyzM represents the amount of memory on your computer) at the end of the line.

In short, you can boot your system into runlevels 1, single (or s), emergency, 2, 3, 4, or 5. If you have trouble booting into any runlevel, try init=/bin/sh. While it's possible to boot into runlevels 0 or 6, those runlevels would automatically halt or reboot your system. For more information, see the runlevels section later in this chapter.

Updating GRUB

If you're going to diagnose GRUB problems, you need to know how GRUB works. The best place to start is with a typical GRUB configuration file.

 # grub.conf generated by anaconda # # Note that you do not have to rerun grub after making changes to this file # NOTICE:  You have a /boot partition. This means that #          all kernel and initrd paths are relative to /boot/, eg. #          root (hd0,4) #          kernel /vmlinuz-version ro root=/dev/sdb2 #          initrd /initrd-version.img # boot=/dev/sda default=0 timeout=5 splashimage=(hd0,4)/grub/splash.xpm.gz hiddenmenu password --md5 $1$2Srxmp06%KSkbeE#7deIrX8ucnCFzn/ title Red Hat Enterprise Linux (2.6.17-1.EL)        root (hd0,4)        kernel /vmlinuz-2.6.17-1.EL ro root=LABEL=/ rhgb quiet        initrd /initrd-2.6.17-1.EL.img title Windows XP Professional        rootnoverify (hd0,0)        chainloader +1

As you can see, even the comments are significant. The first line suggests that this file was created by Anaconda, the RHEL installation program. The next line notes that changes do not have to be written to the MBR; this file is automatically linked to the GRUB pointer that is probably already installed in the MBR.

On the Job

If you've previously installed a different boot loader to the MBR, such as Microsoft's NTLDR, you can make your MBR look for the GRUB configuration file. Just run the grub-install command.

The commented "Notice" in the configuration file appears if you have created a separate partition for the /boot directory. Now this is really weird-there are two definitions for the word root in this file. First, the /boot directory in the GRUB configuration file is associated with root, in this case, root(hd0,4). But the actual Linux top-level root directory is associated with a different partition, as defined by this comment:

 root=/dev/sdb2

The root(hd0,4) directive uses numbers starting with 0. In other words, this directive points to the fifth partition on the first hard drive. The /boot directory is mounted on this partition. If it were the first partition on the first hard drive, for example, this directive would read root(hd0,0).

The last commented line indicates the hard drive with the MBR-in this case, /dev/sda. Now examine the actual commands in this file:

 default=0 timeout=5 splashimage=(hd0,4)/grub/splash.xpm.gz hiddenmenu password --md5 $1$2Srxmp06%KSkbeE#7deIrX8ucnCFzn/ title Red Hat Enterprise Linux Server(2.6.18-1.EL)        root (hd0,4)        kernel /vmlinuz-2.6.18-1.EL ro root=LABEL=/ rhgb quiet        initrd /initrd-2.6.18-1.EL.img title Windows XP Professional        rootnoverify (hd0,0)        chainloader +1

The default=0 directive points to the first stanza. In other words, based on the remaining commands in this file, GRUB boots RHEL 5 by default. If you changed this to default=1, GRUB would boot the second stanza (in this case, Windows XP Professional) by default.

The timeout=5 directive specifies the time, in seconds, before GRUB automatically boots the default operating system. The splashimage directive locates the graphical GRUB screen you see in Figure 3-3. In this case, you can find it on the fifth partition of the first hard drive, in the /grub/splash.xpm.gz file. As (hd0,4) has been previously defined as the /boot directory, you can find the splash screen file in /boot/grub/splash.xpm.gz. The hiddenmenu directive means that the GRUB options are hidden, with the message shown here:

 Booting Red Hat Enterprise Linux Server (2.6.18-8.el5) in 4 seconds...

The password --md5 directive specifies a password, hashed to the MD5 (Message-Digest algorithm 5) format, which protects GRUB from modification during the boot process. As described earlier, when you see the GRUB menu, you can enter the password after pressing p. If you want to create your own MD5 password for this file, run the grub-md5-crypt command. You'll be prompted for a password that is converted to an MD5 hash. You can then copy this hash to the GRUB configuration file.

Each of the next two stanzas has a title normally associated with the operating system, such as:

 title Red Hat Enterprise Linux Server (2.6.18-1.EL)

This is a standard, based on the currently installed kernel. If you've configured more than one kernel, you'll probably see more than one stanza. Both would boot RHEL 5, using a different kernel.

The next three lines specify the location of the /boot directory, the kernel, and the initial RAM disk, respectively:

       root (hd0,4)       kernel /vmlinuz-2.6.18-1.EL ro root=LABEL=/ rhgb quiet       initrd /initrd-2.6.18-1.EL.img

In this case, the /boot directory, as described earlier, is on the fifth partition of the first hard drive, as specified by root (hd0,4). The kernel is specified by the vmlinuz-2.6.18-1.EL file, which you can find in the /boot directory. It's opened as read only (ro) to protect it from any accidental writes from the initial RAM disk; the actual top-level root directory is associated with the / label (root=LABEL=/). Finally, the rhgb quiet directive hides the boot messages by default.

You may see other directives on this line, such as selinux=0, which disables Security Enhanced Linux (SELinux). But remember, SELinux is now part of the RHCE exam requirements.

The initial RAM disk creates a temporary filesystem during the boot process. It includes kernel modules and user space programs needed to mount actual filesystems and run the first initialization programs.

The final three lines are trivial with respect to the Red Hat exams; however, many users see them when they configure their computers in a dual-boot with Microsoft Windows. In most cases, you'll actually see the first line as:

 title Other

I've modified it to specify the actual operating system on the other partition. In this case, Microsoft Windows XP is installed on the first partition on the first hard drive, as specified by:

       rootnoverify (hd0,0)

This is different from the aforementioned root (hd0,4) directive, as rootnoverify does not attempt to mount the noted partition in a Linux fashion.

Finally, the chainloader +1 directive points to the first sector of the noted partition, where Microsoft Windows continues the boot process:

       chainloader +1

GRUB Error Effects

Now that you've analyzed the GRUB configuration file, you can probably visualize some of the effects of errors in this file. If some of the filenames or partitions are wrong, GRUB won't be able to find critical files such as the Linux kernel. Here's an example of the error you'll see if the root (hd0,4) directive points to something other than the /boot directory:

    Booting command-list root (hd0,4)   Filesystem type unknown, partition type 0x8e kernel /vmlinuz-2.6.18-1.EL ro root=LABEL=/ rhgb quiet Error 17: Cannot mount selected partition Press any key to continue...

If the GRUB configuration file is completely missing, you'll see a prompt similar to this:

 grub>

You'll see more of these issues in Chapter 16.

Exercise 3-1: GRUB Error Effects

It's important to know what can happen when there are errors in the GRUB configuration file. In this exercise, you'll first back up and print out the GRUB configuration file, change it during the boot process, and see what happens. Save the printout for Exercise 3-2.

If you make a mistake during the process, you'll have to refer to the techniques described in Chapter 16 to rescue the system from the backup grub.conf that you created. However, the steps used here should make no permanent changes in grub .conf. All you need to do to restore the original settings is reboot your system.

Boot into Linux, and back up the default GRUB configuration file with a command such as:
```
 # cp /boot/grub/grub.conf ~ 
```
This particular command, run as the root user, saves a copy of grub.conf in the root user's home directory, /root. Print out a copy; if your printer is connected, all you need to run is lpr /boot/grub/grub.conf.
Reboot your system. When you see the following line at the top of the screen, press a key to access the GRUB menu:
```
 Press any key to enter the menu 
```
If your GRUB configuration file is password protected, you'll have to press p to enter the password.
Highlight a RHEL 5 kernel (if you haven't installed new kernels, there will be only one in the menu), and press e to edit the associated stanza.
Highlight and press e to edit the first line in the stanza, which should look similar to:
```
 root (hd0,0) 
```
Change the root directive-misspell it in some way. For this exercise, I deleted a letter:
```
 roo (hd0,0) 
```
Press ENTER to save the change temporarily, and press b to boot this stanza. You'll see messages similar to:
```
    Booting command-list roo (hd0,0) Error 27: Unrecognized command Press any key to continue... 
```
Observe the result. You can see what happens when you try to boot from a stanza with a misspelled command. Repeat the process in steps 5 through 7, but try different changes, such as (what you do depends on your specific configuration):
```
 root (h0,0) root (hd1,0) root (hd0,1) 
```
You should see messages such as "Error while parsing number" and "Cannot mount selected partition."
Now restore the first line. If you don't remember what you did, reboot or reset your system; that should restore the original line.
Repeat steps 2 through 4, and now try creating errors in the second line. Misspell the kernel command. What kind of error do you see? What do you see before the error? Does this provide a clue?
When you get to the ro in the second line, delete it, and try to boot. What happens? Why did it work? Why is the ro important?
Normally, the second line will include a directive that points to a LABEL or a logical volume. Here are two examples:
```
 root=/dev/VolGroup00/LogVol00 root=LABEL=/1 
```
See what happens when you misspell the root directive. Would this be fault tolerance? And again, see what happens if you change the LABEL or logical volume number. What happens if you delete the directive completely? If there's an error in this directive, remember that you can check /etc/fstab to restore it.

However, you should be careful. If you happen to change the LABEL to another existing partition, you may end up booting RHEL 5 on a different root directory tree.
Observe the kernel panic error. Note the setuproot directives, such as:
```
 setuproot: error mounting /proc: No such file or directory 
```
This particular error means that the GRUB directives can't find your top-level root directory; in other words, the root directive on the second line points to a bad partition or volume. Whenever you see a kernel panic, a reboot may not be possible; you may have to reset the power on your system.
Note what happens when you delete the rhgb or quiet directive. Does it make a difference to the system once booted?
Repeat steps 2 through 4, and now try creating errors in the third line. What kinds of errors result? Compare the result with step 11, with respect to the line before "Error 15: File not found."
Reboot your system. Check the details of your GRUB configuration file against your backup or printout.

Exercise 3-2: Using the GRUB Command Line

In this exercise, you'll use the printout of the GRUB configuration file from Exercise 3-1 to boot RHEL 5 manually. Look at the printout and identify the desired commands in the stanza. Now follow these steps:

Boot your system. When you see the following line at the top of the screen, press any key to access the GRUB menu:
```
 Press any key to enter the menu 
```
If your GRUB configuration file is password protected, you'll have to press p to enter the password.
Press c for a GRUB-based command line interface. You should see the grub> prompt.

Type in the commands listed in the selected stanza. Start by issuing the first root directive. If the command is successful, you should see output similar to:
```
 Filesystem type is ext2fs, partition type 0x83 
```
Note that if you've configured a different filesystem such as XFS, you'll see a slightly different result.
Enter the second command from your selected GRUB configuration file stanza, which specifies the kernel and root directory partition. Yes, this is a long line; however, you can use command completion (press the TAB key) to make it faster. If successful, you'll see the following message (the setup and size numbers may vary):
```
 [Linux-bzImage, setup=0x1e00, size=0x16eb71] 
```
Enter the third command from the stanza, which specifies the initial RAM disk command and file location. If successful, you'll see the following message (the numbers may vary):
```
 [Linux-initrd @ 0x16544000, 0x19b6c7 bytes] 
```
Now enter the boot command. If successful, Linux should now boot your desired kernel and initial RAM disk just as if you selected that option from the GRUB configuration menu.

The GRUB Command Line

If you see a GRUB command line, you may feel lost. To see a list of available commands, press the TAB key at the grub> prompt.

Some trial and error may be required. You should be able to find all detected hard drives on a standard PC from the BIOS menu (SCSI drives can be a different story). Assuming you have just one, you can use the find command to identify the partition with the GRUB configuration file. For example, to find grub.conf on this particular system, start with the following command:

 grub> find (hd0,0)/grub/grub.conf

This returns an "Error 15: File not found" error message. Repeat this process with the other partitions on this drive,

 grub> find (hd0,1)/grub/grub.conf grub> find (hd0,2)/grub/grub.conf grub> find (hd0,3)/grub/grub.conf grub> find (hd0,4)/grub/grub.conf

and so on, until you see output associated with your partition, such as:

 (hd0,4)

In this case, the /boot directory is on the fifth partition on the first hard drive. Just to confirm, use the cat command to read the contents of the GRUB configuration file:

 grub> cat (hd0,4)/grub/grub.conf

Now use these commands from the GRUB configuration file to boot Linux from the grub> command line. But what if your GRUB configuration file is missing? In Chapter 16, you'll create a GRUB configuration file from scratch, using documentation available on your system via a rescue disk.

Note that a shortcut is available. From the grub> command line, look for the stage1 boot loader file. The command is simple:

 grub> find /grub/stage1

If the stage1 boot loader file is still there, you'll see output specifying the partition with the /boot directory, such as:

 (hd0,4)

But wait, it can be even simpler. Just run root at the grub> command line:

 grub> root (hd0,4): Filesystem type is ext2fs, partition type 0x83

Command completion works from the GRUB command line. For example, if you don't remember the name of the Kernel file, type kernel / and then press the TAB key to review the available files in the /boot directory.