Lesson 3.63: Boot loader and kernel command line
Before any of the system's defences start, GRUB decides which kernel boots and with which options. Anyone at the console who can edit a boot entry can add init=/bin/bash and get a root shell without a password, and options left on the kernel command line can quietly switch off CPU vulnerability mitigations or kernel lockdown. In the lab Northwind's database server boots with mitigations=off from an old benchmark. You read the running command line, find where the option comes from, replace it with hardening options, protect GRUB editing with a password without blocking normal boots, and regenerate the configuration.
19 min
You will learn to
- Read /proc/cmdline, Secure Boot and lockdown state
- Trace kernel options to /etc/default/grub and grub.d
- Choose hardening options and remove dangerous ones
- Set a GRUB superuser without blocking normal boot
- Regenerate grub.cfg and know when it takes effect
Key terms
- Kernel command line
- Options passed to the kernel at boot; the running one is in /proc/cmdline.
- mitigations=off
- Disables CPU vulnerability mitigations (Spectre, Meltdown and others) for speed.
- Kernel lockdown
- An LSM that stops even root from modifying the running kernel; modes none, integrity, confidentiality.
- Secure Boot
- UEFI firmware only starts signed boot loaders and kernels; Ubuntu then enables lockdown.
- GRUB superuser
- A user allowed to edit entries and use the GRUB shell, protected by password_pbkdf2.
- init=/bin/bash
- A boot option that replaces systemd with a root shell: why console access to GRUB must be protected.
← Immutable and append-only files · All lessons · TPM measured boot →