Linux Boot & Init — UEFI/Secure Boot, GRUB, initramfs/dracut, Early Userspace

Parent: DevOps, Infrastructure & Observability · Published reference · snapshot 2026-09-08 · skill devops-linux-internals/references/linux-boot-init.md

↓ Facts as markdown all context files

On a modern machine the boot is a chain of trust and handoffs, each stage finding, optionally

These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.

Overview

On a modern machine the boot is a chain of trust and handoffs, each stage finding, optionally verifying, and launching the next: [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#overview]
This reference covers everything up to and including switch_root. What systemd does after it becomes PID 1 (units, targets, ordering) is references/systemd.md. Kernel internals after decompression (scheduler, syscall ABI, module loading, init=) are references/linux-kernel-architecture.md. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#overview]
Legacy BIOS/MBR boot still exists (boot.img in the MBR → core.img from the post-MBR gap or BIOS Boot Partition), but UEFI is the default on essentially all hardware since ~2012 and is assumed throughout; BIOS differences are called out where they matter. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#overview]

1. UEFI firmware, the ESP, and boot entries

EFI System Partition (ESP): a FAT32 partition (GPT type c12a7328-...), conventionally mounted at /boot/efi (older) or /efi (newer, when /boot is a separate XBOOTLDR). Holds .efi PE executables under \EFI\<vendor>\. Firmware can read FAT directly - no filesystem driver needed in the OS yet. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#1-uefi-firmware-the-esp-and-boot-entries]
Boot manager + NVRAM variables: firmware stores Boot0000…BootFFFF entries (each a device path + loader path + optional args) and an ordered BootOrder, plus BootNext/BootCurrent. Manage from Linux with efibootmgr (e.g. efibootmgr -c -d /dev/sda -p 1 -L "Linux" -l '\EFI\fedora\shimx64.efi'). These live in efivarfs at /sys/firmware/efi/efivars/. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#1-uefi-firmware-the-esp-and-boot-entries]
Fallback/removable path: \EFI\BOOT\BOOTX64.EFI (BOOTAA64.EFI on ARM) is the default the firmware runs when no valid NVRAM entry matches - important for removable media and recovery. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#1-uefi-firmware-the-esp-and-boot-entries]
DXE/BDS phases: firmware initializes silicon (PEI), loads drivers (DXE), then the Boot Device Selection (BDS) phase walks BootOrder. Secure Boot enforcement begins here. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#1-uefi-firmware-the-esp-and-boot-entries]

2. Secure Boot — the signature-verification chain

Secure Boot makes the firmware refuse to run any boot binary whose signature is not chained to a trusted key. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#2-secure-boot-the-signature-verification-chain]
- Key hierarchy: PK (Platform Key, owns the machine) → KEK (Key Exchange Keys) → db (allowed signatures/hashes) and dbx (forbidden/revoked - blacklist wins). OEMs ship Microsoft's certs in db by default. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#2-secure-boot-the-signature-verification-chain]
- shim: because distros can't get every kernel signed by Microsoft, they ship shim - a small first-stage loader signed by Microsoft's UEFI CA. Firmware verifies shim against db; shim then carries the distro's embedded certificate (e.g. Canonical/Red Hat) and verifies GRUB and the kernel against it, plus a local MOK list. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#2-secure-boot-the-signature-verification-chain]
- MOK (Machine Owner Key): a user-enrolled key shim also trusts. Enroll with mokutil --import key.der (sets a one-shot password; on next boot MokManager prompts to confirm - this UI cannot be scripted, by design). Used to sign your own kernels, out-of-tree modules (NVIDIA/VirtualBox/DKMS), or custom GRUB. The kernel honors a MOK with the module-signing KeyUsage OID 1.3.6.1.4.1.2312.16.1.2. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#2-secure-boot-the-signature-verification-chain]
- SBAT (UEFI Secure Boot Advanced Targeting): generation-based revocation embedded in shim/GRUB so a vulnerable bootloader can be revoked via a metadata bump (a .sbat section + SbatLevel var) instead of blacklisting thousands of individual hashes in dbx. This is how the 2020 BootHole and later GRUB CVEs were rolled out; a dbx/SBAT update that outpaces your installed shim is a classic "stopped booting after a firmware/Windows update" cause. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#2-secure-boot-the-signature-verification-chain]
- Lockdown: when Secure Boot is on, the kernel enters lockdown (integrity) mode, blocking /dev/mem, kexec of unsigned images, unsigned module load, certain BPF, hibernation, etc. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#2-secure-boot-the-signature-verification-chain]

3. The boot loader — GRUB 2 vs systemd-boot

GRUB 2 (the default on most general-purpose distros): [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#3-the-boot-loader-grub-2-vs-systemd-boot]
- Stages: boot.img (BIOS: 446-byte MBR stub) → core.img (built by grub-mkimage/grub-install, contains just enough modules - a filesystem driver, etc. - to read /boot/grub). On UEFI the equivalent is grubx64.efi (loaded by shim). Stage modules (*.mod) live under /boot/grub/. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#3-the-boot-loader-grub-2-vs-systemd-boot]
- Config: /boot/grub2/grub.cfg (RHEL) or /boot/grub/grub.cfg (Debian) is generated, not hand-edited: grub-mkconfig -o … (Debian: update-grub) stitches together /etc/default/grub (e.g. GRUB_CMDLINE_LINUX) and the /etc/grub.d/ scripts (10_linux, 30_os-prober, 40_custom). [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#3-the-boot-loader-grub-2-vs-systemd-boot]
- menuentry: each entry runs linux /vmlinuz-… root=… <cmdline> then initrd /initramfs-….img. The kernel version in the linux line must match the initrd line. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#3-the-boot-loader-grub-2-vs-systemd-boot]
- BLS (Boot Loader Spec) Type 1 entries: Fedora/RHEL ≥8 no longer regenerate full menus - grub.cfg becomes a thin loader that reads drop-in *.conf files from /boot/loader/entries/ (<machine-id>-<kernel-version>.conf with title/linux/initrd/options keys). Managed by kernel-install / grubby. Edit options with grubby --update-kernel. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#3-the-boot-loader-grub-2-vs-systemd-boot]
systemd-boot (sd-boot) - a much simpler UEFI-only manager: [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#3-the-boot-loader-grub-2-vs-systemd-boot]
- Drops systemd-bootx64.efi on the ESP; auto-discovers kernels from BLS Type 1 entries in $BOOT/loader/entries/ and Type 2 UKIs in $BOOT/EFI/Linux/ - no generated config, no scripting. Installed/updated with bootctl install|update. Global settings in loader/loader.conf. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#3-the-boot-loader-grub-2-vs-systemd-boot]
Unified Kernel Image (UKI) - the modern direction: [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#3-the-boot-loader-grub-2-vs-systemd-boot]
- A single signed UEFI PE binary bundling stub + kernel + initrd + cmdline + (optional) splash/devicetree in named PE sections (.linux, .initrd, .cmdline, .osrel, …). The reference stub is systemd-stub (linuxx64.efi.stub); build with ukify or dracut --uefi. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#3-the-boot-loader-grub-2-vs-systemd-boot]
- Because the cmdline and initrd are inside the signed image, Secure Boot now covers them too (a plain GRUB+initrd setup leaves the initrd and cmdline unsigned). Place in $BOOT/EFI/Linux/*.efi; bootable directly by firmware or auto-listed by sd-boot. Standardized by the UAPI Group (UAPI.5). [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#3-the-boot-loader-grub-2-vs-systemd-boot]

4. The kernel command line

Passed by the loader (or baked into a UKI). Selected high-value parameters: [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#4-the-kernel-command-line]
- Root: root=UUID=… / root=/dev/mapper/…, rootflags=, ro, rootfstype=. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#4-the-kernel-command-line]
- initramfs control (dracut): rd.break[=pre-mount|mount|pre-pivot], rd.shell, rd.debug, rd.luks.uuid=, rd.lvm.lv=vg/lv, rd.md.uuid=, rootdelay=. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#4-the-kernel-command-line]
- Init/handoff: init=/bin/sh (override PID 1 - recovery), systemd.unit=rescue.target, systemd.unit=emergency.target, single/1. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#4-the-kernel-command-line]
- Diagnostics: quiet/splash (remove to see messages), loglevel=, nomodeset, systemd.log_level=debug. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#4-the-kernel-command-line]

5. The initramfs / initrd — early userspace

Why it exists: the kernel needs drivers and userspace logic to find the real root - but those may live on the root (chicken-and-egg) or require assembly (LVM, LUKS decryption, mdraid, multipath, iSCSI/NFS, ZFS). The initramfs is a CPIO archive the kernel unpacks into a tmpfs and runs as a temporary root; it loads modules, assembles/unlocks the real root, mounts it, and pivots. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#5-the-initramfs-initrd-early-userspace]
- initrd vs initramfs: old initrd = a block-device image mounted as root; modern initramfs = a CPIO archive extracted into rootfs (tmpfs). Both are commonly called "the initrd"; the file is gzip/zstd CPIO (sometimes a concatenation, e.g. an early-cpio microcode blob + the main archive). [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#5-the-initramfs-initrd-early-userspace]
- dracut (RHEL/Fedora/SUSE/Arch; Debian/Ubuntu historically use initramfs-tools/mkinitcpio on Arch): builds the image event-driven and host-specific by default (hostonly, only the modules this machine needs) vs --no-hostonly (generic, portable to other hardware - what distro installers ship). [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#5-the-initramfs-initrd-early-userspace]
  - Build: dracut [--force] /boot/initramfs-$(uname -r).img $(uname -r); inspect with lsinitrd. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#5-the-initramfs-initrd-early-userspace]
  - Config: /etc/dracut.conf + /etc/dracut.conf.d/*.conf (add_dracutmodules, omit_dracutmodules, add_drivers, install_items). [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#5-the-initramfs-initrd-early-userspace]
  - dracut modules (under /usr/lib/dracut/modules.d/, e.g. 90lvm, 90crypt, 90mdraid, 95nfs, 01systemd) declare dependencies and inject scripts. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#5-the-initramfs-initrd-early-userspace]
- Two execution models inside the initramfs: [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#5-the-initramfs-initrd-early-userspace]
  - systemd-in-initrd (now the default on systemd distros): systemd itself is PID 1 in the initrd and drives it via initrd.target → initrd-root-device.target → mount real root at /sysroot → initrd-root-fs.target → initrd-switch-root.target. The contract is in systemd.io/INITRD_INTERFACE (real root must end up at /sysroot). [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#5-the-initramfs-initrd-early-userspace]
  - legacy dracut /init script with hook directories run in order: cmdline → pre-udev → pre-trigger → initqueue (main loop, settles devices) → pre-mount → mount → pre-pivot → cleanup. Custom logic drops scripts into the matching hooks/<name>/ dir. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#5-the-initramfs-initrd-early-userspace]
- The handoff - switch_root: once /sysroot (the real root) is mounted, early userspace kills udev, cleans up, and calls switch_root - which deletes the initramfs tmpfs contents, chroots into the real root, and execs the real /sbin/init (systemd) as PID 1. (pivot_root is the older mechanism; switch_root is purpose-built for an initramfs-on-rootfs and frees the RAM.) On shutdown, systemd can jump back into /run/initramfs/shutdown to tear down complex storage it is itself running from. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#5-the-initramfs-initrd-early-userspace]

6. Measured boot & TPM-bound unlock

Distinct from Secure Boot (which gates), measured boot records: each stage hashes the next into TPM2 PCRs before running it (PCR 4 = boot loader/EFI apps, PCR 7 = Secure Boot policy/keys, PCR 11 = UKI sections via systemd-stub, PCR 12 = cmdline/credentials, PCR 13 = sysext). [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#6-measured-boot-tpm-bound-unlock]
systemd-cryptenroll --tpm2-device=auto seals a LUKS key to a PCR policy so the root disk auto-unlocks only if the boot chain is unmodified. systemd-measure pre-computes/signs expected PCR 11 values for a UKI so unlock survives kernel updates (signature-based PCR policy). [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#6-measured-boot-tpm-bound-unlock]

Methodology — reading a boot end to end

Where did it stop? Firmware screen → no entry/Secure Boot reject. GRUB prompt → loader OK, config/kernel issue. Kernel panic "VFS: unable to mount root" or dracut emergency shell → initramfs couldn't find/assemble root. Login/systemd errors → you're past switch_root; this is now a systemd.md problem. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#methodology-reading-a-boot-end-to-end]
Is Secure Boot involved? mokutil --sb-state. If it broke right after a firmware/Windows/dbx update, suspect SBAT/dbx revocation outpacing your shim/GRUB. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#methodology-reading-a-boot-end-to-end]
Inspect the chain: bootctl status (loader + ESP + entries), efibootmgr -v (NVRAM order), lsinitrd /boot/initramfs-….img (is the needed storage module/key present?). [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#methodology-reading-a-boot-end-to-end]
Reproduce/interrupt: at GRUB press e, remove quiet, add rd.break (or rd.break=pre-mount) to land in the dracut shell at the chosen stage. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#methodology-reading-a-boot-end-to-end]
Fix forward: correct the cause, then always rebuild (dracut --force) and regenerate loader config so the fix is persistent and survives the next kernel update. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#methodology-reading-a-boot-end-to-end]

Practical Patterns

Sign your own boot chain (Secure Boot, your keys): sbctl is the easy path - sbctl create-keys, sbctl enroll-keys (optionally -m to keep Microsoft certs for firmware/Option ROMs), then sbctl sign -s /boot/vmlinuz-… / sign your UKI. Verify with sbctl verify. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#practical-patterns]
Move to a UKI + systemd-boot: generate a UKI (ukify/dracut --uefi) into /efi/EFI/Linux/, bootctl install. Gains signed cmdline+initrd and clean TPM PCR 11 measurement; drop GRUB entirely. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#practical-patterns]
Recover a borked root password / fstab: boot to emergency.target or init=/bin/sh; for SELinux systems use rd.break, mount -o remount,rw /sysroot, chroot /sysroot, fix, and touch /.autorelabel. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#practical-patterns]
Persist a kernel arg the right way: edit GRUB_CMDLINE_LINUX + grub-mkconfig (classic GRUB), or grubby --update-kernel=ALL --args="…" (BLS), or the UKI's .cmdline/kernel-install (UKI) - not the generated grub.cfg. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#practical-patterns]

Anti-Patterns

Hand-editing grub.cfg. It is regenerated on the next kernel update and your change vanishes. Edit the source (/etc/default/grub, /etc/grub.d/, or the BLS options). [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#anti-patterns]
Mismatched linux/initrd versions in a menuentry → kernel boots but can't load matching modules. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#anti-patterns]
hostonly initramfs cloned to different hardware → missing storage/NIC driver → unbootable. Use --no-hostonly for portable/golden images and rescue initramfs. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#anti-patterns]
Forgetting to rebuild the initramfs after adding LUKS/LVM/RAID, changing the root device, or installing a storage driver → "unable to mount root" on next boot. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#anti-patterns]
Plain GRUB+initrd and assuming Secure Boot protects you end-to-end - the cmdline and initrd are unsigned there; only a UKI (or signed initrd scheme) closes that gap. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#anti-patterns]
Enrolling a MOK and walking away - MokManager needs the physical/interactive confirmation on reboot; unattended enrollment silently does nothing. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#anti-patterns]
Sealing LUKS to PCRs without a signed/pcrlock policy → every kernel/firmware update changes the PCRs and locks you out. Use PCR 11 signature policy (systemd-measure) or systemd-pcrlock. [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#anti-patterns]

References

UAPI Group - Boot Loader Specification (BLS Type 1/2, ESP+XBOOTLDR layout): https://uapi-group.org/specifications/specs/boot_loader_specification/ [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]
UAPI Group - Unified Kernel Image (UKI) specification: https://uapi-group.org/specifications/specs/unified_kernel_image/ [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]
systemd - Initrd Interface (the /sysroot contract, switch_root, shutdown jump-back): https://systemd.io/INITRD_INTERFACE/ [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]
systemd-boot(7) and bootctl - UEFI boot manager + UKI/BLS discovery: https://www.man7.org/linux/man-pages/man7/sd-boot.7.html [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]
systemd-measure(1) - pre-compute/sign TPM2 PCR 11 for a UKI: https://www.freedesktop.org/software/systemd/man/latest/systemd-measure.html [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]
ArchWiki - UEFI Secure Boot (shim, MOK, sbctl, custom key enrollment): https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]
ArchWiki - Unified kernel image (ukify, systemd-stub, sd-boot layout): https://wiki.archlinux.org/title/Unified_kernel_image [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]
ArchWiki - GRUB (boot.img/core.img, grub-mkconfig, BIOS vs UEFI install): https://wiki.archlinux.org/title/GRUB [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]
ArchWiki - dracut (hostonly, modules, hooks, UKI via dracut --uefi): https://wiki.archlinux.org/title/Dracut [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]
dracut.bootup(7) - the hook pipeline (cmdline → … → pre-pivot → cleanup, switch_root): https://man7.org/linux/man-pages/man7/dracut.bootup.7.html [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]
Red Hat - Working with GRUB 2 / signing a kernel & modules for Secure Boot: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/managing_monitoring_and_updating_the_kernel/signing-a-kernel-and-modules-for-secure-boot_managing-monitoring-and-updating-the-kernel [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]
Ubuntu - UEFI Secure Boot (shim trust DB, Canonical signing, MOK): https://documentation.ubuntu.com/security/security-features/platform-protections/secure-boot/ [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]
Debian Wiki - SecureBoot (shim/grub chain, mokutil workflow): https://wiki.debian.org/SecureBoot [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]
Fedora Magazine - InitRAMFS, dracut, and the dracut emergency shell: https://fedoramagazine.org/initramfs-dracut-and-the-dracut-emergency-shell/ [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]
Fedora Project Wiki - How to debug Dracut problems (rd.break, rd.shell, rd.debug): https://fedoraproject.org/wiki/How_to_debug_Dracut_problems [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]
NSA/CISA - Guidance for Managing UEFI Secure Boot (Dec 2025): https://media.defense.gov/2025/Dec/11/2003841096/-1/-1/0/CSI_UEFI_SECURE_BOOT.PDF [archived source: https://llms-explorer.com/sources/mdb-context-hub/linux-boot-init/#references]

Where this helps

Debugging a system that fails somewhere between the firmware splash and login — knowing exactly which stage stopped tells you whether the problem is firmware/Secure Boot, GRUB config, or an initramfs missing a driver. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Building a hardened, signed boot chain (Secure Boot with custom keys via sbctl, or a UKI) for a security-conscious deployment that needs to close the unsigned-cmdline/initrd gap plain GRUB leaves open. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Recovering a system with a broken root password, corrupted fstab, or SELinux mislabeling by dropping into rd.break/emergency.target and fixing it from the initramfs shell. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Deciding whether to move from classic GRUB plus a separate initramfs to a Unified Kernel Image and systemd-boot for a simpler, fully signed boot path. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Project ideas

Build a fully signed custom Secure Boot chain with sbctl — generate your own PK/KEK/db keys, sign a UKI, and verify the chain rejects an unsigned kernel. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Convert an existing GRUB plus initramfs system to a UKI plus systemd-boot setup, then confirm with systemd-measure that PCR 11 stays stable across a kernel update. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Set up TPM2-bound LUKS auto-unlock with systemd-cryptenroll and a PCR 11 signature policy (systemd-measure or systemd-pcrlock) so it survives kernel and firmware updates instead of locking you out. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Write a custom dracut module that injects a pre-mount hook (waiting on an iSCSI target, or decrypting a non-standard LUKS setup) and verify the built image with lsinitrd. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Common mistakes

Hand-editing /boot/grub2/grub.cfg directly instead of /etc/default/grub or /etc/grub.d/ — the file is regenerated on the next kernel update and the change silently disappears. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Forgetting to rebuild the initramfs (dracut --force) after adding LUKS, LVM, or RAID to the root device, which produces an "unable to mount root" failure on the very next boot. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Cloning a hostonly-built initramfs onto different hardware, which omits the storage or NIC driver the new machine needs and leaves it unbootable. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
Assuming a plain GRUB+initrd setup gets full Secure Boot protection — the cmdline and initrd are unsigned there, so only a UKI (or a signed-initrd scheme) actually closes that gap. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Known issues

Sealing a LUKS key to TPM2 PCRs without a signature-based policy (systemd-measure/pcrlock) means every kernel or firmware update changes the PCR values and locks you out of your own encrypted root. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
MOK enrollment via mokutil requires an interactive confirmation in MokManager on the next physical reboot by design — unattended or remote enrollment silently does nothing. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
SBAT-based revocation can outpace an older shim/GRUB after a firmware, Windows, or dbx update, so a previously working boot chain can suddenly fail Secure Boot verification with no local change on your part. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.
A mismatched kernel version between the linux and initrd lines in a GRUB menuentry lets the system boot but fail to load matching kernel modules, producing confusing runtime errors rather than an outright boot failure. [source] — AI-suggested, synthesized from this pack's existing facts — not extracted from a source document.

Children

UEFI firmware, the ESP, and boot entries (BootOrder/Boot#### EFI vars, efibootmgr, efivarfs, PEI/DXE/BDS, fallback BOOTX64.EFI) (frontier)
Secure Boot signature chain (PK/KEK/db/dbx, Microsoft-signed shim, distro embedded cert, MOK/MokManager/mokutil, SBAT generation-based revocation, kernel lockdown) (frontier)
GRUB 2 (boot.img/core.img stages, grubx64.efi, generated grub.cfg via grub-mkconfig/update-grub, menuentry linux/initrd, BLS Type 1 entries, grubby/kernel-install) (frontier)
systemd-boot / sd-boot (UEFI-only, bootctl, auto-discovery of BLS Type1 + Type2 UKIs, loader.conf) (frontier)
Unified Kernel Image (UKI) — systemd-stub, ukify, PE sections .linux/.initrd/.cmdline, signed cmdline+initrd, UAPI.5 (frontier)
Kernel command line (root=, rd.* dracut params, init=/systemd.unit handoff, diagnostics quiet/loglevel/nomodeset) (frontier)
initramfs/initrd early userspace (why it exists, CPIO-into-tmpfs, dracut build + hostonly vs no-hostonly, dracut modules, config) (frontier)
Two initramfs execution models (systemd-in-initrd targets + /sysroot contract vs legacy dracut /init hook pipeline cmdline..pre-pivot..cleanup) (frontier)
The switch_root / pivot_root handoff to PID 1 and shutdown jump-back to /run/initramfs/shutdown (frontier)
Measured boot & TPM-bound unlock (TPM2 PCR 4/7/11/12/13, systemd-cryptenroll, systemd-measure signed PCR11, systemd-pcrlock) (frontier)
Boot-failure troubleshooting (dracut emergency shell, rd.break stages, VFS unable to mount root, grub rescue, rebuilding a broken initramfs) (frontier)

Frontier under this node: Boot-failure troubleshooting (dracut emergency shell, rd.break stages, VFS unable to mount root, grub rescue, rebuilding a broken initramfs), GRUB 2 (boot.img/core.img stages, grubx64.efi, generated grub.cfg via grub-mkconfig/update-grub, menuentry linux/initrd, BLS Type 1 entries, grubby/kernel-install), Kernel command line (root=, rd.* dracut params, init=/systemd.unit handoff, diagnostics quiet/loglevel/nomodeset), Measured boot & TPM-bound unlock (TPM2 PCR 4/7/11/12/13, systemd-cryptenroll, systemd-measure signed PCR11, systemd-pcrlock), Secure Boot signature chain (PK/KEK/db/dbx, Microsoft-signed shim, distro embedded cert, MOK/MokManager/mokutil, SBAT generation-based revocation, kernel lockdown), The switch_root / pivot_root handoff to PID 1 and shutdown jump-back to /run/initramfs/shutdown, Two initramfs execution models (systemd-in-initrd targets + /sysroot contract vs legacy dracut /init hook pipeline cmdline..pre-pivot..cleanup), UEFI firmware, the ESP, and boot entries (BootOrder/Boot#### EFI vars, efibootmgr, efivarfs, PEI/DXE/BDS, fallback BOOTX64.EFI), Unified Kernel Image (UKI) — systemd-stub, ukify, PE sections .linux/.initrd/.cmdline, signed cmdline+initrd, UAPI.5, initramfs/initrd early userspace (why it exists, CPIO-into-tmpfs, dracut build + hostonly vs no-hostonly, dracut modules, config), systemd-boot / sd-boot (UEFI-only, bootctl, auto-discovery of BLS Type1 + Type2 UKIs, loader.conf)

← the whole tree · 3D view· how to read this page