Proxmox boot order is overridden automatically

[bugsdabunny]

I am trying to boot from a kernel I signed myself so I can use Secure Boot. I tested it on Debian 11 and it worked, so I figured it will work on Proxmox too. I change the boot order with efibootmgr and boot to an EFI stub. However on Proxmox, something is overriding the boot order and it won't show the EFI stub in BIOS as an option either. When I boot back into Proxmox, the boot order I set has been overridden. I cannot figure out why this is happening, but everything works great on Debian 11 so I feel like Proxmox is the cause. Does anyone know what's going on?

 

[fabian]

are you using ZFS? if so, your system uses proxmox-boot-tool to setup managed ESPs. if not, than PVE should not interfere with EFI setup at all, it's vanilla Grub.

 

[bugsdabunny]

I'm not using ZFS, I installed Proxmox 7 on top of Debian 11 using the guide in the Wiki. When I run the command to change the boot order it is reflected in efibootmgr command, but after I change I reboot then it reverts back every time

 

[fabian]

we don't touch the efi boot config unless booting is managed by proxmox-boot-tool, and then only when initializing a new ESP (a manual action).

 

[bugsdabunny]

I was reading this a bit more https://pve.proxmox.com/wiki/Host_Bootloader and it seems that I need to use systemd boot for booting an EFI loader according to this: https://wiki.archlinux.org/title/systemd-boot

I am not super familiar with this stuff, is possible that this is the reason it doesn't show up? Is it possible to have grub and systemd side by side?

 

[fabian]

we only use systemd-boot with ZFS on UEFI systems..

 

[bugsdabunny]

I am trying to boot my own EFI stub (which I think requires systemd-boot) which has a signed version of the kernel proxmox is using, so I can use it for Secure Boot. I think you are saying what the installer sets up is systemd boot only with ZFS, but I am trying to do something custom and something is being overwritten.

I am trying to do this because I read Proxmox doesn't support SecureBoot

 

[fabian]

again - PVE does not overwrite anything automatically (modulo what Grub does in stock Debian as well, and you said that worked fine for you).

so if you set a boot order or add a boot entry and it's not there after a reboot
- you set it as "one-off" boot option for the next reboot only
- your UEFI implementation is broken
- something else is messing with your efivars