Disabling tboot in RHEL6.4+
Environment
- Red Hat Enterprise Linux 6.4
Issue
- How can one disable/completely remove
tbootsafely from Red Hat Enterprise Linux 6? - How to make sure that it should not get installed by default in Installation using Kickstart file?
Resolution
- To avoid installation and configuration of
tbootin the Red Hat Enterprise Linux 6 machine directly, one can use the following%packagessection.
%packages
@Base --optional
-tboot
<extra packages as administrator wants to install>
Safely Removing tboot after installation
- Using
grubbyadd the existingkernel
# ARGS=$(grep "^[[:space:]]*module /vmlinuz-$(uname -r)" /boot/grub/grub.conf | sed -e 's/^.*x86_64 //' | head -n 1)
# grubby --add-kernel=/boot/vmlinuz-$(uname -r) --args="${ARGS}" --initrd=/boot/initramfs-$(uname -r).img --make-default --title "Red Hat Enterprise Linux without tboot ($(uname -r))"
# grep -v ^# /boot/grub/grub.conf
default=0
timeout=5
serial --unit=0 --speed=115200
terminal --timeout=5 serial console
title Red Hat Enterprise Linux without tboot (2.6.32-358.el6.x86_64
kernel /vmlinuz-2.6.32-358.el6.x86_64 ro root=/dev/mapper/vg00-root intel_iommu=on rd_NO_LUKS KEYBOARDTYPE=pc KEYTABLE=us rd_LVM_LV=vg00/swap LANG=en_US.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 rd_LVM_LV=vg00/root crashkernel=auto crashkernel=auto console=ttyS0,115200 rd_NO_DM
initrd /initramfs-2.6.32-358.el6.x86_64.img
title Red Hat Enterprise Linux (2.6.32-358.el6.x86_64)
root (hd0,0)
kernel /tboot.gz logging=vga,serial,memory
module /vmlinuz-2.6.32-358.el6.x86_64 ro root=/dev/mapper/vg00-root intel_iommu=on rd_NO_LUKS KEYBOARDTYPE=pc KEYTABLE=us rd_LVM_LV=vg00/swap LANG=en_US.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 rd_LVM_LV=vg00/root crashkernel=auto crashkernel=auto console=ttyS0,115200 rd_NO_DM
module /initramfs-2.6.32-358.el6.x86_64.img
- Remove the
tboot kernel
# grubby --remove-kernel=/boot/tboot.gz
# grep -v ^# /boot/grub/grub.conf
default=0
timeout=5
serial --unit=0 --speed=115200
terminal --timeout=5 serial console
title Red Hat Enterprise Linux without tboot (2.6.32-358.el6.x86_64
kernel /vmlinuz-2.6.32-358.el6.x86_64 ro root=/dev/mapper/vg00-root intel_iommu=on rd_NO_LUKS KEYBOARDTYPE=pc KEYTABLE=us rd_LVM_LV=vg00/swap LANG=en_US.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16 rd_LVM_LV=vg00/root crashkernel=auto crashkernel=auto console=ttyS0,115200 rd_NO_DM
initrd /initramfs-2.6.32-358.el6.x86_64.img
- Now one can remove
tboot, as it's not in use bygrub.
# yum -y erase tboot
- Also make sure to have the contents of the file
/etc/sysconfig/kernelare as follows. If not, simply overwrite it with the following contents
[root@rhel6 ~]# cat /etc/sysconfig/kernel
# UPDATEDEFAULT specifies if new-kernel-pkg should make
# new kernels the default
UPDATEDEFAULT=yes
# DEFAULTKERNEL specifies the default kernel package type
DEFAULTKERNEL=kernel
Root Cause
- Using
--optionalwith a@Baseinstructanacondato install all Optional packages within that group, which includestboot.
Diagnostic Steps
- Verify the @Base group
[root@<hostname> 6Server]# yum groupinfo Base | grep tboot
tboot
- Verify the kickstart file for either of the following syntax options which will result in the tboot package being installed:
%packages
@Base --optional
or
%packages
@Base
+tboot
This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.
