↓ Skip to main content
Le Site de François
  1. Index/

initramfs (initial RAM filesystem)

Linux Boot Security Systemd Luks Dracut

initramfs (initial RAM filesystem) is the temporary root filesystem the Linux kernel mounts immediately after loading itself and before switching to the machine’s real root. The bootloader — GRUB, systemd-boot, or firmware loading a UKI — passes a compressed cpio image (historically called an initrd, though modern Linux always unpacks it as an initramfs into tmpfs, not a separate ramdisk block device). The kernel extracts this archive into an in-memory tree, executes /init as pid 1, and that early userspace environment is responsible for everything the bare kernel cannot yet do: loading storage and filesystem kernel modules, bringing up networking, discovering and unlocking LUKS volumes, activating LVM or multipath devices, mounting the true root partition, and finally calling switch_root (or pivot_root) to hand control to the installed system’s init — typically systemd on current distributions. If the initramfs fails, the boot stops before userspace on the real root ever starts; if it succeeds, it is discarded and its memory reclaimed once the pivot completes.

The initramfs is not a fixed image shipped with the kernel — it is built per machine profile from the installed OS’s userspace. On RHEL, Fedora, and most enterprise Linux, dracut is the generator: it assembles a modular archive from dracut modules (crypt, lvm, network, nfs, iscsi, clevis, and dozens more) matching what hostonly mode infers from the running system or what an installer configured. Debian and Ubuntu use initramfs-tools; Arch uses mkinitcpio. The build pulls in userspace binaries (cryptsetup, clevis, ip, lvm, mdadm, nm-initrd-generator, etc.), udev rules, kernel modules for the initrd’s own hardware, and systemd units for the initrd target. LUKS unlocking is the most security-relevant path: systemd-cryptsetup in the initramfs prompts for a passphrase, reads a TPM2-sealed keyslot enrolled via systemd-cryptenroll, or runs a Clevis pin policy (Tang NBDE, TPM2 PCR binding, or combined SSS AND/OR policies) before / can mount. Network-bound and TPM-bound unlock therefore depend entirely on the initramfs containing the correct Clevis client, TPM tools, and network stack — a mismatch between the initramfs built at install time and the storage layout at boot produces the familiar “enter passphrase for encrypted volume” fallback even when automatic unlock was configured.

From a boot-security perspective, the initramfs is a first-class component of the trusted boot chain, not an afterthought. Measured boot records the initramfs hash into TPM PCRs before the kernel runs it — PCR 9 when GRUB loads separate kernel and initrd files, PCR 11 when a UKI bundles kernel and initramfs as one signed payload, and PCR 13 for UKI initrd extension images. Changing the initramfs — after a kernel update, a dracut rebuild, or a Clevis policy change — changes those PCR values and therefore breaks LUKS PCR sealing unless keyslots are re-enrolled. Secure Boot enforcement applies to the initramfs only when it is part of a signed UKI or otherwise covered by the bootloader’s signature policy; a separately loaded, unsigned initrd on a Secure Boot system may still boot depending on distribution shim/GRUB policy, which is why UKI-centric stacks treat the initramfs as statically bundled and signed with the kernel. bootc and image-based OS delivery ship the initramfs inside the OCI/bootable image alongside the kernel under /usr/lib/modules and rebuild it when the image changes, keeping the early-boot environment versioned with the same artifact as the root filesystem. Operational discipline for hardened systems is therefore: rebuild the initramfs whenever crypto, storage, or network boot dependencies change; treat initramfs updates as security-relevant events in the same class as kernel updates; and verify that measured-boot reference values and LUKS TPM policies are updated after each change.

Related

NBDE / Clevis / Tang (Network-Bound Disk Encryption)

Security Encryption Storage Linux Luks Boot Rhel
NBDE (Network-Bound Disk Encryption) is an approach to automatic LUKS disk unlocking that binds the volume key not to hardware state (a TPM PCR measurement) but to network presence: a LUKS-encrypted volume unlocks automatically at boot if and only if the machine can reach a designated Tang server on a trusted network. Remove the machine from that network — because it was stolen, because a data centre drive was pulled, because someone exfiltrated the hardware — and the volume key becomes unrecoverable without a fallback passphrase. The threat model is therefore complementary to TPM-based unlocking: TPM sealing asks “is this the right software stack?” and locks the key to a specific platform measurement; NBDE asks “is this machine on the trusted network?” and locks the key to network presence. Neither addresses both threat classes alone, which is why the two are routinely combined — and why RHEL formalises NBDE as a subcategory of the broader Policy-Based Decryption (PBD) framework that the Clevis pin system implements.

RHCOS (Red Hat Enterprise Linux CoreOS)

Linux Security Openshift Immutable Selinux Luks Tpm Boot
RHCOS (Red Hat Enterprise Linux CoreOS) is the operating system that runs on every OpenShift control plane and worker node. It is not a general-purpose Linux distribution — it is a purpose-built, immutable, container-optimised OS designed to run exclusively as a managed node in an OpenShift cluster. Its security posture is architecturally different from a hardened RHEL installation: rather than hardening a mutable system through configuration management, RHCOS makes the OS layer structurally resistant to modification by design. The root filesystem’s /usr tree is read-only (enforced at mount time by rpm-ostree and, in recent versions, by composefs over the OSTree object store), /etc and /var are writable but managed exclusively by the Machine Config Operator (MCO), and no package manager is available at runtime for ad-hoc software installation. An operator who wants to change any node-level configuration — kernel arguments, sysctl settings, systemd units, certificates, kubelet configuration — creates a MachineConfig object in the OpenShift API; the MCO renders it into an Ignition config, applies it to the target MachineConfigPool (master, worker, or custom), and drains and reboots the affected nodes in a rolling fashion. Direct SSH access to nodes for configuration changes is explicitly unsupported and actively discouraged — oc debug node/<name> is the supported emergency access path, dropping into a privileged container on the node’s host namespaces under audit.

UKI (Unified Kernel Image)

Boot Linux Security Systemd
A Unified Kernel Image (UKI) is a single EFI executable that packages together the Linux kernel, the initramfs (initrd), the kernel command line, and optionally other resources like a splash screen or system credentials. Instead of relying on a bootloader to assemble these components at runtime, a UKI bundles them statically into one signed binary.