this post was submitted on 07 Dec 2025
130 points (99.2% liked)
Linux
10508 readers
1344 users here now
A community for everything relating to the GNU/Linux operating system (except the memes!)
Also, check out:
Original icon base courtesy of lewing@isc.tamu.edu and The GIMP
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
How else are you going to display anything at boot time?
Boot means initramfs plus kernel. Any other part could do that, doesnt need to run in kernelspace. I dont think the initramfs runs in kernel mode either.
Linux is a big huge thing that is all very highly privileged. It works, very well, but it is kind of a security mess.
initramfs is a compressed filesystem, not an execution context. But it must be possible to print text even before initramfs loads, e.g. to display an error if it fails.
And if you don't have an initramfs?
Found the Gentoo user
The Gentoo user who does not encrypt their boot drive
I use an encrypted rootfs without "an initramfs". Just requires some advanced fuckery.
A little known fun fact is that almost all kernels have a tiny stub-initram built into the kernel file. This is added when initram support is enabled, and is loaded before dedicated files are. It is however possible to supply your own initram directory or archive during kernel build to replace this built-in initram, so you can bake it in without leaving a separate file. No juggling with partitions, no boot options. Works just like a normal kernel "without initram", since even kernels without one usually do have that stub one anyway.
The downside is that a) you have to build the kernel, and b) the files to pack have to be available when the kernel is built, meaning you can't pack in modules of the kernel. But when building your own kernel anyway you can simply set the needed modules for encryption built-in and only pack the userspace cryptsetup executable needed for decryption, that way you get it all in a single kernel build, and the output is a single uniform kernel binary capable of decrypting your boot drive. No flags, no extra files, no access to the esp needed.
(I use gentoo with encrypted root btw.)
neat
Guys you have to see, it is amazing how much deep tech stuff you know, but dont forget you are a crazy niche within a niche and be nice to non-systems programmers XD
The Debian user who lets GRUB handle decryption AND updates (somehow, Debian is weird)
Nah I'm just old