loader.conf - Configuration file for systemd-boot
ESP/loader/loader.conf, ESP/loader/entries/*.conf XBOOTLDR/loader/entries/*.conf
systemd-boot(7) will read ESP/loader/loader.conf, and any files with the ".conf" extension under ESP/loader/entries/ on the EFI system partition (ESP), and XBOOTLDR/loader/entries/ on the extended boot loader partition (XBOOTLDR) as defined by Boot Loader Specification.
Each of these configuration files must consist of series of newline (i.e. ASCII code 10) separated lines, each consisting of an option name, followed by whitespace, and the option value. "#" may be used to start a comment line. Empty and comment lines are ignored. The files use UTF-8 encoding.
Boolean arguments may be written as "yes"/"y"/"true"/"t"/"on"/"1" or "no"/"n"/"false"/"f"/"off"/"0".
The configuration options supported by ESP/loader/entries/*.conf and XBOOTLDR/loader/entries/*.conf files are defined as part of the Boot Loader Specification.
The following configuration are supported by the loader.conf configuration file:
If set to "@saved" the chosen entry will be saved as an EFI variable on every boot and automatically selected the next time the boot loader starts.
Table 1. Automatically detected entries will use the following names:
|auto-efi-default||EFI Default Loader|
|auto-reboot-to-firmware-setup||Reboot Into Firmware Interface|
|auto-windows||Windows Boot Manager|
If set to "menu-hidden" or "0" (the default) no menu is shown and the default entry will be booted immediately. The menu can be shown by pressing and holding a key before systemd-boot is launched. Setting this to "menu-force" disables the timeout while always showing the menu.
Work around BitLocker requiring a recovery key when the boot loader was updated (disabled by default).
Try to detect BitLocker encrypted drives along with an active TPM. If both are found and Windows Boot Manager is selected in the boot menu, set the "BootNext" EFI variable and restart the system. The firmware will then start Windows Boot Manager directly, leaving the TPM PCRs in expected states so that Windows can unseal the encryption key. This allows systemd-boot to be updated without having to provide the recovery key for BitLocker drive unlocking.
Note that the PCRs that Windows uses can be configured with the "Configure TPM platform validation profile for native UEFI firmware configurations" group policy under "Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption". When secure boot is enabled, changing this to PCRs "0,2,7,11" should be safe. The TPM key protector needs to be removed and then added back for the PCRs on an already encrypted drive to change. If PCR 4 is not measured, this setting can be disabled to speed up booting into Windows.
See Random Seeds for further information.
# /boot/efi/loader/loader.conf timeout 0 default 01234567890abcdef1234567890abdf0-* editor no
The menu will not be shown by default (the menu can still be shown by pressing and holding a key during boot). One of the entries with files with a name starting with "01234567890abcdef1234567890abdf0-" will be selected by default. If more than one entry matches, the one with the highest priority will be selected (generally the one with the highest version number). The editor will be disabled, so it is not possible to alter the kernel command line.
- Boot Loader Specification
- Random Seeds