Rhel 7 won't boot on physical server

[hdep]

Hello,

I encounter an issue with this module with a HP physical server, using uefi.
To fix the issue I had to use rescue mode and follow this KB :
https://access.redhat.com/solutions/3215551

I'm not an expert, but defaults settings are a bit aggressive don't you think ? Maybe we can add some logic in order to detect uefi and prevent some default settings in this case ?
Or maybe a documentation update.

What do you think ?

Regards,

[timstoop]

I'm not a RH subscriber, can you explain what's going wrong there so we can see what caused this?

[mcgege]

If I understand this KB right, disabling vfat prevents the bootup on UEFI systems, as /boot/efi cannot be mounted. I have not much experience with UEFI, but if vfat is needed to boot the system, we shouldn't disable this filesystem per default.

[mcgege]

Ok, this is a known problem:
dev-sec/linux-baseline#96

And has been fixed in ansible-os-hardening like this:
dev-sec/ansible-collection-hardening#162
dev-sec/ansible-collection-hardening#190

Who wants to solve this here? :-)

[hdep]

I will have a look, but maybe we can add some logic like if there is this partition vfat should be enabled ?
what do you think ?

[timstoop]

I think adding the logic would be way too much of a hassle. Anyway, switching to UEFI should probably be on anyones todo list, especially when you're interested in hardening, right? I simply removed it from the list of default modules to remove.

[hdep]

All right that's fine for me ! thank you

[mcgege]

Pragmatic solution, thanks!!