open atlas
↑ Back to track
Linux, the operating system LIN · 02 · 02

GRUB — the bootloader

GRUB is the bootloader on Debian/Ubuntu. Its config is generated from /etc/default/grub by update-grub. At boot you can edit the kernel command line to recover a broken system — adding init=/bin/bash or removing "quiet" unlocks the single most powerful recovery tool in Linux.

LIN Middle ◷ 22 min
Level
FoundationsJuniorMiddleSenior

A system admin locked themselves out by setting a bad root password in a provisioning script. The machine booted fine, but no one could log in. Recovery plan: reboot, hit e at the GRUB menu, add init=/bin/bash to the kernel line, boot into a single-process shell as root, change the password, reboot clean. Five minutes, no reinstall. That is GRUB as a recovery tool.

Every Linux engineer eventually needs to edit the kernel command line at boot. Understanding what GRUB does — and where its config lives — is the difference between a five-minute fix and a three-hour reinstall.

Goal

After this lesson you can describe GRUB’s role and config files, read and edit /etc/default/grub, regenerate grub.cfg with update-grub, edit the kernel command line at boot time for recovery, and know the difference between GRUB’s runtime config and the source files.

1

GRUB has two config layers: the source and the generated file. The file GRUB actually reads at boot is /boot/grub/grub.cfg — a generated file. You should never edit it directly; it is overwritten by update-grub. The source of truth is /etc/default/grub (user-facing options) and hook scripts in /etc/grub.d/ (which generate menu entries). The workflow is:

# Edit the source
sudoedit /etc/default/grub

# Regenerate /boot/grub/grub.cfg from the source
sudo update-grub

If your changes do not survive a kernel update, it means you edited grub.cfg directly instead of the source. Always edit /etc/default/grub.

2

Key options in /etc/default/grub. The file is a shell-sourced key=value store. The most important variables:

# How long GRUB waits before auto-booting the default entry (seconds)
GRUB_TIMEOUT=5

# The default menu entry to boot (0 = first, or a title string)
GRUB_DEFAULT=0

# Extra parameters appended to every kernel command line
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"

# Parameters for all kernels including recovery entries
GRUB_CMDLINE_LINUX=""

quiet suppresses most kernel log output to the console. splash shows a graphical boot screen. Remove both to see every kernel log line — extremely useful when debugging a boot that hangs silently.

3

The kernel command line is the most powerful recovery lever. When GRUB launches the kernel, it passes a string of space-separated parameters. The kernel parses them early, before any filesystem is mounted. Key parameters you will use in practice:

root=/dev/sda2        # which device is the root filesystem
ro                    # mount root read-only initially (normal)
quiet                 # suppress kernel messages
init=/bin/bash        # replace PID 1 with a shell (emergency recovery)
single                # boot into single-user mode (runlevel 1)
systemd.unit=rescue.target   # boot to rescue target (systemd equivalent)

The init=/bin/bash trick gives you a root shell before systemd ever starts. The filesystem is mounted read-only at first; you remount it read-write with mount -o remount,rw / before making any changes.

4

How to edit the kernel command line at boot (without persistence). This is the most valuable skill in this lesson — it requires physical or console access but no prior setup.

  1. Reboot (or power cycle) the machine.
  2. At the GRUB menu, press e to edit the selected entry.
  3. Find the line beginning with linux — that is the kernel command line.
  4. Move to the end of that line (End key) and add your parameter, e.g. systemd.unit=rescue.target.
  5. Press Ctrl+X or F10 to boot with the modified line.

The edit is not saved — it applies only to this one boot. The next boot uses the normal config. This is exactly what you want for recovery: make a change, boot, fix the system, reboot normally.

5

Where GRUB lives on disk and how it is installed. GRUB consists of two parts: a small first-stage loader written to the MBR or EFI partition, and modules/config under /boot/grub/. On UEFI systems the EFI executable is at /boot/efi/EFI/ubuntu/grubx64.efi. If you replace a disk, GRUB must be reinstalled to the new disk’s boot sector:

# Install GRUB to a specific disk (MBR/BIOS systems)
sudo grub-install /dev/sda

# Install GRUB for UEFI systems (usually done automatically by update-grub)
sudo grub-install --target=x86_64-efi --efi-directory=/boot/efi

# Then regenerate config
sudo update-grub

A common mistake after dd-cloning a disk: forgetting to reinstall GRUB on the new disk. The data is there, but the new disk has no bootloader in its MBR/EFI partition.

Worked example

Recover root access via the GRUB command line.

Scenario: You or an automation script set an unknown root password. SSH is not an option. You have console access.

1. Reboot the machine.

2. At GRUB menu: press 'e' to edit the default entry.

3. Find the 'linux' line. It looks like:
   linux /boot/vmlinuz-6.x root=/dev/sda2 ro quiet splash

4. Append to the end of that line:
   init=/bin/bash

   Result:
   linux /boot/vmlinuz-6.x root=/dev/sda2 ro quiet splash init=/bin/bash

5. Press Ctrl+X to boot.

6. You land in a bash shell as root, filesystem read-only.

7. Remount root read-write:
   mount -o remount,rw /

8. Change the password:
   passwd root

9. Flush writes and reboot:
   sync
   exec /sbin/init
   # or: echo b > /proc/sysrq-trigger

Why this works: init=/bin/bash tells the kernel to use /bin/bash as PID 1 instead of systemd. systemd never starts. No login, no PAM, no auth — you are root immediately.

Why this works

On RHEL/Fedora/CentOS, GRUB 2 is the same bootloader but the config location differs slightly: the source is still /etc/default/grub, but the regeneration command is grub2-mkconfig -o /boot/grub2/grub.cfg (not update-grub). On UEFI RHEL systems it may be /boot/efi/EFI/redhat/grub.cfg. The keyboard shortcut at boot (e to edit, Ctrl+X to boot) is identical. Whenever you read a RHEL recovery guide that says grub2-mkconfig, substitute update-grub for Debian/Ubuntu.

Common mistake

Editing /boot/grub/grub.cfg directly is the most common GRUB mistake. It works — until the next apt upgrade installs a new kernel, which triggers update-grub automatically and overwrites your changes with no warning. Always treat grub.cfg as a build artifact. Your persistent customizations belong in /etc/default/grub or a file in /etc/grub.d/.

Check yourself
Quiz

You edited /boot/grub/grub.cfg to add a kernel parameter. Two weeks later after a kernel update the parameter is gone. What went wrong?

Recap

GRUB 2 is the bootloader on Debian/Ubuntu. Its runtime config /boot/grub/grub.cfg is generated — never edit it directly. Edit /etc/default/grub and run update-grub. The kernel command line (the linux line in the GRUB entry) is your primary recovery lever: press e at the menu, append init=/bin/bash or systemd.unit=rescue.target, then Ctrl+X to boot once. Removing quiet reveals all kernel messages. If you replace a disk, re-run grub-install before update-grub. On RHEL/Fedora the equivalent is grub2-mkconfig.

Practice

Start at the top. Tasks go easiest → hardest: recall a fact, apply it to a case, then a senior-level stretch. Open one, attempt it, then reveal.

recallapplystretch0 of 3 done

Something unclear?

Ask a question about this lesson. Questions are anonymous and go straight to the author to make the lesson better.

shortcuts expand
search
K
prev piece
k
next piece
j
cycle tier
t
this menu
?
sources1
expand
  1. 01

Trademarks belong to their respective owners. Editorial reference only.