-# restore execshield state
-if [ ! -z "$SHIELD" ]; then
- sysctl -w -e "kernel.exec-shield=$SHIELD" >/dev/null 2>&1
- echo -n " execshield2"
+# and final stage of devfs/udev brokeness fix
+if [ "x$install_device_resolved" != "x$install_device" ]; then
+ # get original (symlinked device)
+ root_device=$(find_device_nonresolved "/")
+ if [ -z "$root_device" ]; then
+ root_device=$(find_root_device)
+ fi
+
+ # fix (hd0) mapping
+ cp_check_and_sed '^\(hd0\)' \
+ "s;^(hd0).*;(hd0) $install_device;" "$device_map" \
+ || true
+
+ # fix global root= invocation
+ cp_check_and_sed '^# kopt=' \
+ "s;^# kopt=\(.*\)root=[^[:space:]]*\(.*\);# kopt=\1root=$root_device\2;g" \
+ "$menu_file" || true
+
+ # fix root= invocation for individual kernel profiles
+ cp_check_and_sed '^kernel' \
+ "s;\(^kernel.*\)root=[^[:space:]]*\(.*\);\1root=$root_device\2;g" \
+ "$menu_file" || true