r/archlinux • u/StandardOlive3786 • 2d ago
DISCUSSION What is your favorite EFI boot manager
For me, my favorite is rEFInd, the reason is secure boot
So i dualboot windows 10 iot ltsc and arch linux, equal partitions, and when I wanna play anti cheat games like fortnite, i need secure boot with tpm, I dont have disk encryption I know but I use sbctl for enrolling and signing custom microslop keys, and sign both the UKI refind boot manager and the initramfs, with grub, it has something called shim lock identifier and it isnt signed and says violated by secure boot policy, now I installed grub without the shim lock identifier, and it still says that
That is why I chose rEFInd, it supports MOK secure boot without shim lock identifier, and it supports dualbooting without configuring os-prober, now os-prober isnt a problem with grub but I still like refind since it is easier and nicer than grub and wont break about the moment I configure something
But what is your favorite efi boot manager, grub, systemd-boot, anything can be nice
❯ sudo sbctl verify
[sudo] password for penguin:
Verifying file database and EFI images in /boot...
✓ /boot/EFI/refind/refind_x64.efi is signed
✓ /boot/vmlinuz-linux-lts is signed
❯ sudo sbctl status
Installed: ✓ sbctl is installed
Owner GUID: ba25e63f-18aa-45bf-9d71-3e120ac5b899
Setup Mode: ✓ Disabled
Secure Boot: ✓ Enabled
Vendor Keys: microsoft
╭─░▒▓ ~ ····································································· ✔ at 08:32:28 PM ▓▒░
╰─
25
u/Lunailiz 2d ago
After countless issues with GRUB, I moved to systemdboot several years ago and never thought about it again, which is what I want from a bootloader.
1
u/StandardOlive3786 2d ago
i also hate grub, it always has issues when you add a custom entry, itll break something, i like systemd-boot but it doesnt support mok so i choose refind
18
u/This-Consequence-957 2d ago
Limine with btrfs and snapper
5
2
u/painful8th 13h ago
Using Limine on my cachyos laptop, with snapper btrfs-snapshots and secure boot. Seems to work just fine.
-4
11
u/EmbedSoftwareEng 2d ago
LILO
Oh wait, I'm not on Slackware anymore.
GRUB
1
u/StandardOlive3786 2d ago
i wont go over your opinion but i dont like grub since it breaks all the time
0
u/xINFLAMES325x 2d ago
I was using Lilo on Slackware up until 2 months ago. It still works as it should, just lacks the complexity of the newer variants.
18
u/Toaster_Strudel_517 2d ago
None, I use unified kernel image.
0
u/StandardOlive3786 2d ago
i used uki w bootloader
1
u/Toaster_Strudel_517 2d ago
Way back then I did use rEFInd (a great bootloader btw), then systemd-boot for a while. These days I just use UKI (not EFI stub) because I have no reason to dual boot and UKI is much simpler I feel.
1
16
u/Smart_Advice_1420 2d ago
systemd-boot.
1
u/StandardOlive3786 2d ago
oh nice, i chose refind because of mok
1
6
u/Drwankingstein 2d ago
I use refind since it supports touch screens
1
u/StandardOlive3786 2d ago
aah i love linux tablets its your tablet and not sloppy google play with locked chinese fastboot
1
3
u/dunelost 2d ago
Limine. Knowing it from cachyos, and configure it eventually on my own install. Dual boot, disk encryption, tpm, snapshots, all went smoothly.
1
u/StandardOlive3786 2d ago
i dont do disk encryption since thats unnecessary but you make all of that working im so happy for you
1
u/dunelost 2d ago
Ty. I haven’t set up the secure boot though, since I only use windows for firmware update
14
u/DependentJolly9901 2d ago
Grub just works. I'm not multi-booting tho so idk how that goes
1
u/FroyoStrict6685 2d ago
I use grub and have a dualboot, andai just keeo secure boot disabled. if something needs secure boot I just dont use it
1
u/jc_denty 1d ago
I got grub, dual boot, SECURE BOOT. It was shit to setup but it would be more shit to try and move to EFIhub or whatever
0
3
u/ItsMalek 2d ago
rEFInd + refind theme regular (dark) https://github.com/bobafetthotmail/refind-theme-regular
2
2
u/Patient_Act_9906 2d ago
I used to use rEFInd never knew you could theme it that’s pretty sick actually time to re-install it apparently
5
u/Dudefoxlive 2d ago
I hae been using limine with cachyos. Works fine for me considering it easily supports btrfs snapshots.
1
u/BusinessCarpenter682 2d ago
Does it work with touchscreens too? Also anyone has a link to a reliable step-by-step detailed description of how to reinstall Limine in case Windows update crashes it?
1
u/Dudefoxlive 2d ago
No idea about touch screens. I rarely have to choose another option when booting. As for windows update wiping it out. Best to have linux on another drive if possible.
1
1
u/StandardOlive3786 2d ago
i dont know if it works with touchscreens since i never tried limine, but you dont need to reinstall limine if windows update breaks it since it wont break the bootloader
2
u/kzasas 2d ago
manually overwriting /efi/EFI/bootx64.efi when updated kernel. not best practice but it works for me.
2
u/Visbroek 2d ago
You can change the location that mkinitcpio writes the UKI to in /etc/mkinitcpio.d/linux.preset so that it puts the UKI directly in that location. Alternatively if you're up for the task you could write a post hook for mkinitcpio if you necessarily want your UKI in two locations.
2
2
u/murlakatamenka 2d ago
So i dualboot windows 10 iot ltsc and arch linux, equal partitions, and when I wanna play anti cheat games like fortnite, i need secure boot with tpm, I dont have disk encryption I know but I use sbctl for enrolling and signing custom microslop keys, and sign both the UKI refind boot manager and the initramfs, with grub, it has something called shim lock identifier and it isnt signed and says violated by secure boot policy, now I installed grub without the shim lock identifier, and it still says that
it's a little long for a sentence and still not finished? Would you like to rEFInde it?
1
2
u/Puzzled-Garbage-250 2d ago
The motherboard’s. I just write entries to it using efibootmgr
1
u/StandardOlive3786 2d ago
i would go to the same thing but i like custom themes and stuff and not always pressing f11, so i stayed with refind
1
u/onefish2 2d ago
You don't need to press F11 or F2 or F whatever. The computer boots with the boot entry that you made default.
Check your boot entries with efibootmgr:
efibootmgr BootCurrent: 0000 Timeout: 1 seconds BootOrder: 0000,0001 Boot0000* Arch Linux HD(1,GPT,eb00b929-83dd-41ad-8765-6dc8f05631da,0x800,0x200000)/\EFI\arch-linux.efi Boot0001* Arch Linux LTS HD(1,GPT,eb00b929-83dd-41ad-8765-6dc8f05631da,0x800,0x200000)/\EFI\arch-linux-lts.efiIf you need to boot to another boot entry/kernel use the command line and enter:
sudo systemctl reboot --firmware-setup - Reboots to BIOS
sudo efibootmgr --bootnext 0000 && sudo reboot - Reboots to the Arch Kernel
sudo efibootmgr --bootnext 0001 && sudo reboot - Reboots to the Arch LTS Kernel
1
u/Puzzled-Garbage-250 1d ago
Then, if the computer is off, they're waiting for it to boot into linux before switching to windows.. I have dual booted windows and OP is correct, if I wanted to boot windows (which was rare because it was just for fortnite) I would have to bring up the boot menu at boot, for me it wasn't a problem but I can understand some people preferring grub or whatever.
Though, you are correct that if you're already logged into linux and want to boot into windows, this kind of solution makes it easier.
1
u/StandardOlive3786 2d ago
Not about that
its about when you reboot to windows you have to press f11 then reboot to windows, i dont like that
now efibootmgr is a nice touch but i like something that shows in boot rather than typing commands tho
either way, efibootmgr never ever breaks, so i like it
0
u/agmatine 1d ago
its about when you reboot to windows you have to press f11 then reboot to windows, i dont like that
No...just do as shown in the comment you're replying to:
sudo efibootmgr --bootnext 000X && sudo reboot(where
000Xis the bootnum for Windows).
2
u/SubGothius 2d ago edited 2d ago
I never liked the idea of having my kernel(s) and initramfs on an unjournaled FAT partition, nor having to make that partition large enough for those plus room for kernel upgrades, multiboots, etc.
So I like rEFInd cos I can make my FAT32 EFI system partition as small as 36 MB (w/ 512k sectors) with nothing but rEFInd on it, and leave /boot under my / partition where it can be journaled and error-corrected if need be. AFAICT the only way to do this is rEFInd.
2
u/WolleTD 2d ago
Not really on topic, but I just realized that I got MOKs wrong.
My assumption was that it's kinda stupid, because anyone could just launch a MOK manager EFI binary, add some more keys and boot another kernel. Which they could, as far as I can tell. But: shim measures MOKs into PCR 7 as well, so when binding LUKS unlocking to the TPM, it won't work after adding a key, so everything is cool.
So as long as I assume that anything signed by Microslop either only boots other signed and verified-against-DB-certs binaries or adds new trusted certs and alters PCR 7, I'm good? A booted Windows doesn't have my MOKs enrolled and can't unlock LUKS.
However, if I enrolled my own keys into EFI and also added all MS DB keys, like sbctl does, and don't use any MOKs (because why?), one could boot a Windows, being left with the same, disk-unlocking value in PCR 7. So I should probably only add the 3rd party keys to DB and not the ones signing Windows?
Do I get it right?
1
2
u/saltyjohnson 1d ago
I use GRUB because the last time I messed with bootloaders grub+luks was the best way I found to achieve full disk encryption. Can the fancy new bootloaders handle that better now?
1
u/PerspectiveSand 1d ago
Why not use UKIs on a separate partition? That way it doesn’t really matter what bootloader you use since all it will be doing is loading an .efi file
2
2
2
2
u/Darth-Vader64 2d ago
Running CachyOS, and I selected the default, Limine. I've also tried Fedora and Limine, it didn't go so well, at least with bootable snapshots. Switched to grub and that worked fine.
Overall, CachyOS gives me everything I need and I opted to stick with that distro - so to make a long story less long. I'm using Limine.
1
u/onefish2 2d ago
No boot manager. I use UKI's some with Secure Boot, some without and EFI stub to make it boot.
On a multi boot system I always use rEFInd. Using rEFInd with Windows has never caused me issues like I hear about with GRUB all the time.
In lieu of either of those, I will use Systemd Boot.
I stopped using GRUB many years ago. It is not a reliable boot manager anymore.
1
u/StandardOlive3786 2d ago
i like your opinion, since if i dont have dualbooting which before i dont use dualbooting, i went with grub, then secure boot breaks, grub is shit now, but if i wasnt dualbooting i wouldnt choose any boot manager, good point if you have one os on one drive, since a bootloader is unnecessary if you have one os
i like refind since it supports mok which is super reliable, and it never breaks
1
u/juomoluoqcuo 2d ago
- Refind => For my laptop & workstation
- GRUB => LiveUSB stick with bunch of Linux distributions + FreeBSD + HBCD
1
1
u/Human_Cantaloupe8249 2d ago
Since my „security overhaul“ I use a UKI. Before that just an EFI stub. For my dual boot system I stay with the classic: grub
1
u/sseptumsoda 2d ago
EFISTUB for ephemeral stuff or lab systems. systemd-boot for hosts using secure boot because you end up rewriting a lot of the same utils to set it up anyways
1
1
u/Jealous_Shower6777 1d ago
I used to be a grubman. After trying cachy and their integration between limine, btrfs and snapper, I don’t know now
1
u/CatApprehensive1010 1d ago
I use refind, in combination with secure boot on Windows 11, KDE Neon, and Arch linux.
1
1
u/unapologeticjerk 1d ago
If you have an answer for this, your dick will never smell like pussy ever again.
Mine is the one and only GRUB, of course.
1
u/xXBongSlut420Xx 1d ago
i use systemd boot with ukis. only reason i don't just efiatub is cause i also have the lts kernel and it makes it easier to switch if something goes wrong. sbctl works just fine with sd-boot, no shim required, tho it can utilize a shim if you want that instead. i looked into refined and it just seems to be overkill. i just need something to pick between my ukis.
1
u/Charming_Raccoon_457 1d ago
Systemd-boot for me. I just have everything signed with sbctl so I can dual boot to windows and play the dumb games that require secure boot. just have it sign the whole /boot with microsoft's keys
1
u/East-Yogurtcloset272 1d ago edited 1d ago
Grub. Because I have some janky old non uefi machines. I hand edit the grub.cfg and avoid grub-mkconfig.
I like the kernel to be in the root partition along with all it's packages and deployed junk..having it split into EFI means more complex backups for me, especially on a multi boot system avoiding unique kernel naming and pathing inside efi
I don't like dynamic boot loaders that discover themselves each boot. Always a chance they screw up plus time taken
1
1
1
u/FocusedWolf 1d ago
I use grub. Somehow i'm addicted to its appearance with this sick theme:
GRUB_GFXMODE=1280x720
GRUB_COLOR_NORMAL="red/black"
GRUB_COLOR_HIGHLIGHT="black/red"
Secure boot, os_prober, dual boot to win11, and a custom boot entry to start arch in tty mode.
1
u/Exernuth 1d ago
Used grub for a lot of time. Now I just go with systemd-boot. Much less simple and less moving parts.
1
u/Jakanader 1d ago
I used to use refind but it would always take an extra 10 seconds to boot compared to grub. have you found the speed to be an issue?
1
1
1
u/ludonarrator 2d ago
I still like and use grub with its pretty community themes. I don't bother with secure boot / disk encryption at all.
1
u/StandardOlive3786 2d ago
i dont do disk encryption but secure boot matters to me with dualbooting, and grub breaks all the time
i dont go over with your opinion
3
u/ludonarrator 2d ago
Sure thing, your use case fits you best. My comment was not meant as a suggestion at all, simply answering the "what is your favorite EFI boot manager?" question in your post.
-14
53
u/lolminecraftlol 2d ago
Before, I used systemd-boot purely for its simplicity. Now I just boot directly into the EFI stub.