GRUB 2 administration: /etc/default/grub, grub-mkconfig, grubby and the default entry

Goal

Change GRUB 2 settings (default entry, timeout, kernel parameters) safely and know which command applies on which family of distribution.

Prerequisites

Root access; a way to reach the console if a change breaks booting (see the recovery-access checklist for this module).

Steps

1. On Debian, Ubuntu and derivatives, edit /etc/default/grub, a shell-sourced file of KEY=value lines: GRUB_DEFAULT selects the default menu entry (a number counted from zero, an entry's --id, or the special value saved); GRUB_TIMEOUT sets the seconds to wait (0 boots immediately, -1 waits forever). Regenerate the compiled configuration with update-grub (a Debian/Ubuntu wrapper) or directly with grub-mkconfig -o /boot/grub/grub.cfg, which discovers installed kernels and writes grub.cfg; on Debian/Ubuntu this path is the same on BIOS and UEFI (the file on the EFI partition is only a small stub). Nothing changes until the file is regenerated and the system rebooted.
2. On RHEL-family systems the commands are grub2-mkconfig, grub2-set-default etc., and the output path depends on the release: RHEL 9 and later (and Fedora 34 and later) use grub2-mkconfig -o /boot/grub2/grub.cfg on both BIOS and UEFI — the grub.cfg under /boot/efi/EFI/redhat/ (centos, rocky, almalinux on rebuilds) is a stub that must not be overwritten; RHEL 8 on UEFI still writes /boot/efi/EFI/redhat/grub.cfg, on BIOS /boot/grub2/grub.cfg.
3. Back up the target grub.cfg before regenerating it, and diff the new file against the backup so an unexpected change (missing entry, wrong root) is visible before rebooting.
4. On RHEL 8 and later, which use the Boot Loader Specification, boot entries are files under /boot/loader/entries/, loaded into the GRUB menu by the blscfg command rather than being written into grub.cfg directly. Manage them with grubby instead of hand-editing: grubby --default-kernel shows the current default, grubby --set-default=/boot/vmlinuz-<version> (or --set-default-index=<N>) changes it, and grubby --update-kernel=ALL --args="<param>" adds a kernel parameter to every BLS entry, --remove-args="<param>" removes one. On RHEL 9 and later, parameters are written literally into each entry's options line, so editing GRUB_CMDLINE_LINUX alone does not change existing entries.
5. grub-set-default <entry-id-or-index> (grub2-set-default on RHEL) stores a default in the GRUB environment block; it only has an effect when GRUB_DEFAULT=saved is set and the configuration was regenerated (RHEL BLS setups use saved already). grub-reboot <entry> selects an entry for the next boot only, likewise only with GRUB_DEFAULT=saved.
6. For a one-off change, do not edit any file: at the GRUB menu, highlight an entry and press e to open the menu entry editor; press Ctrl-x to boot the edited entry, or Esc to discard the edit and return to the menu. This is the way to test a kernel parameter (for example single or a different root=) without persisting it.

Expected result

grub-editenv list (grub2-editenv list) shows the intended saved_entry, or grubby --default-kernel names the intended kernel; the regenerated grub.cfg diff contains only the expected change; a reboot lands on that kernel without further input before the configured timeout.

Limits and test basis

Custom menu entries and ordering belong in the /etc/grub.d/ scripts, not the defaults file. grubby behaviour and flags are RHEL/Fedora-family specific; Debian/Ubuntu use neither grubby nor BLS entries by default. Undo a bad grub.cfg by restoring the backed-up file; undo a grubby change with its inverse flag or by restoring the BLS entry file from backup.