grub-live - boot an existing Host OS or VM into Live Mode

Kicksecure ™

Download

On Computer USB Installation Intel / AMD64 ARM64 Raspberry Pi PPC64 Windows (VM) Mac Linux (VM) VirtualBox (VM) Qubes (VM) KVM (VM) Debian morph to Kicksecure More options Source Code

About

Overview Features Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Forum Best Practices Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

Distribution Morphing Advanced Documentation grub Previous page: Distribution Morphing Index page: Advanced Documentation Next page: grub grub-live - boot an existing Host OS or VM into Live Mode

• Live Mode
• read-only
• Write Protection
• Grub-live
• Kicksecure on USB
• Persistent Mode

Live Mode boot option selectable in boot menu. (more screenshots)

The grub-live package offers an additional "LIVE mode" boot menu entry for the GNU GRUB boot loader.

This package is potentially compatible with many Linux distributions such as Debian. In Kicksecure and Whonix^®, it is installed by default. Grub-live can be applied to a host operating system (OS) as well as to a guest OS on a virtual machine.

Debian Live Mode Boot (Live Mode)

Kicksecure Live Mode Boot (Live Mode)

Whonix^® Live Mode Boot (Live Mode)

Context

This wiki page documents grub-live mostly as a standalone software package outside the context of Kicksecure. Any elements related to Kicksecure are clearly marked as such ("Kicksecure feature").

Version

Documentation updated for Kicksecure version 17.4.1.0 (unrelated at time of writing).

For Kicksecure version 17.3.9.9 see wiki history: https://www.kicksecure.com/w/index.php?title=Grub-live&oldid=96700 - Free wiki account required for reading. (Reasons: Wiki History)

This notice will be removed after the next stable release.

Compatibility

grub-live is compatible and tested with Debian, Kicksecure, and Whonix. In Kicksecure and Whonix, it is installed by default. It should also run without any problems on Ubuntu and other Linux distributions that implement Debian live-boot. However, due to little user adoption and testing at this point in time, grub-live for those distributions is still labeled untested.

Installation / Getting started

The grub-live package is hosted under the grub-live GitHub repository. There you will also find the installation guide.

After the installation, you can instantly use the Live Mode in your operating system. Simply boot/reboot your system and choose the new "LIVE mode" option in the boot menu. For Kicksecure specifically, read: Detailed documentation for using the live mode for Kicksecure.

Set grub-live as Default in GRUB boot menu

Optional.

If you have installed grub-live and want the "LIVE mode" option to be the default selected option in your GRUB menu, please follow the instructions below. Be aware, however, that due to little user adoption and testing, this option is still labeled untested.

1. Do a grub-live package installation check

By default, the grub-live package is installed in Kicksecure. If you boot your system and a boot menu entry "LIVE mode" is already available, then grub-live is already installed.

Alternatively, you can make sure the grub-live package is installed. The following command can be used to check on the command line if the package is already installed by default.

dpkg -l | grep grub-live

2. Set LIVE mode as the default boot menu entry

There are two ways to accomplish this. Choose one of these options:

Option (A) - symlink method

• Advantage: This is easier because updates to grub-live will be automatically applied.
• Disadvantage: There will be a duplicate live boot menu entry.
• Copy and execute the following command:

sudo ln -s /etc/grub.d/10_20_linux_live /etc/grub.d/09_linux_live

Option (B) - moving method

• Advantage: No duplicate live boot menu entry.
• Disadvantage: Updates to grub-live will NOT be automatically applied.
• Copy and execute the following command:

sudo mv /etc/grub.d/10_20_linux_live /etc/grub.d/09_linux_live

3. Re-generate GRUB boot menu

The GRUB boot menu needs to be regenerated for the changes to be applied. Copy and execute the following command:

sudo update-grub

4. DONE

The process of changing from "live mode opt-in through GRUB boot menu" to "live boot by default" has been completed.

5. Updates

If in step 2, "option (B)" was chosen, then this process might need to be repeated from time to time if there have been updates to GRUB or to your system. The need to repeat this process from step 1 to step 4 will be indicated as soon as the "LIVE mode" entry is no longer the default entry in the GRUB boot menu.

If in step 2, "option (A)" was chosen, then this step is not needed. Updates will be applied automatically.

Get GRUB to remember your last choice (e.g., Live mode)

Optional.

If you don't want to set Live Mode as your permanent default boot option but still want the comfort of having GRUB remember your last choice, e.g., "Live mode," then follow these instructions.

1. Open file /etc/default/grub.d/50_user.conf in an editor with root rights.

Select your platform.

Kicksecure

See Open File with Root Rights for detailed instructions on why to use sudoedit for better security and how to use it.

Note: Mousepad (or the chosen text editor) must be closed before running the sudoedit command.

sudoedit /etc/default/grub.d/50_user.conf

Kicksecure for Qubes

NOTES:

• When using Kicksecure-Qubes, this needs to be done inside the Template.

sudoedit /etc/default/grub.d/50_user.conf

• After applying this change, shutdown the Template.
• All App Qubes based on the Template need to be restarted if they were already running.
• This is a general procedure required for Qubes and unspecific to Kicksecure for Qubes.

Others and Alternatives

• This is just an example. Other tools could achieve the same goal.
• If this example does not work for you or if you are not using Kicksecure, please refer to this link.

sudoedit /etc/default/grub.d/50_user.conf

2. Now add these two lines to this file: GRUB_DEFAULT=saved GRUB_SAVEDEFAULT=true

3. Finally, execute this command: sudo update-grub

4. Done.

Your boot menu now remembers your last choice.

Alternative to grub-live

As an alternative to grub-live, it is also possible to automatically detect if the disk is set to read-only and enable live mode automatically using the ro-mode-init package. Read VM Live Mode - Alternative ro-mode-init Configuration for further instructions.

ro-mode-init is currently less tested than grub-live.

Comparison between grub-live and Tails

Tails is its own operating system, whereas grub-live is a package enabling Live Mode on different Linux distributions. The following table will show the advantages and disadvantages of grub-live in regard to Tails. It should be noted, however, that while Tails is optimized for Live mode, grub-live is vastly more compatible with other systems.

Table: Comparison of grub-live and Tails

Aspect	grub-live on the host / grub-default-live on the host with Kicksecure	Tails DVD only	Tails USB / DVD, with persistent USB	Tails read-only medium and other devices with write capability unplugged
Common mode of operation	Yes	Yes	Yes	No
Amnesic / protects against disk modifications	Yes	Yes	Yes	Yes
Protects against malware persistence on hard drive after malware compromise	No	No	No	Yes
Protects against firmware trojans after malware compromise	No	No	No	No
Avoid writing to arbitrary (non-boot) host disks	Yes	Yes	Yes	Yes
Disables removable drives auto-mounting	Yes	?	?	?
Disables swap	Yes (Kicksecure feature)	Yes	Yes	Yes
Disabled virtual machine shared folders	No	?	?	?
Wipe RAM on shutdown	No, but see ram-wipe.	Yes, but with limitations.	Yes, but with limitations.	Yes, but with limitations.
Wipe video RAM on shutdown	No	No	No	No
Emergency shutdown on USB removal	No	Yes	Yes	Yes
Live Mode Usability	Good	Good	Good	Good
Live Mode Indicator Systray	Yes (Kicksecure feature)	Unneeded	Unneeded	Unneeded
Unified Amnesic User Experience	Yes	Yes	Yes	Yes
Unified Amnesic + Anonymous User Experience	Kicksecure: Not applicable Whonix: No	Yes	Yes	Yes
Easy standard ("everyday") upgrades	Yes	?	?	?
Release upgrades possible anytime	Yes	No	No	No
Live boot by default	grub-live: No grub-default-live: Yes	Yes	Yes	Yes
Persistent boot by default	grub-live: Yes grub-default-live: No	No	No	No
Full disk encryption compatibility	Yes	No	No	No
Encrypted persistence supported	Yes	Yes	Yes	Yes

Security Considerations

How secure and reliable is any live mode?

Computers typically default to data persistence rather than amnesia. Coupled with widespread computer security vulnerabilities (see About Computer (In)Security), implementing a secure non-persistent system is challenging.

grub-live is relatively straightforward. It primarily involves installing necessary dependencies and setting kernel parameters (details in Implementation). However, the software it is based on, such as dracut (or initramfs-tools / Debian's live-tools), mount, and overlayfs, are complex. Sparse developer documentation in this area makes this difficult. There is also an increased risk of failures post Release Upgrade or after installing new major versions of Kicksecure or Debian, due to the generic nature of the solution.

There is a potential risk that malware could remount a read-only disk as read-write. While no confirmed cases exist, theoretically, even legitimate software could inadvertently perform such actions. To mitigate this risk, it's advisable to use grub-live in conjunction with

• USER session; and/or
• physical read-only mode for hard drives, where feasible. See read-only.

Using grub-live on the host operating system, combined with virtual machines (VMs), is a safer configuration. In this setup, any disk remounting as read-write within a VM would be negated upon rebooting the host. VMs, in this context, are unaware of the host's live mode status and cannot directly alter it.

Would using an ISO image be safer? Generally, yes. Because ISOs commonly aren't modified. It seems unlikely that an ISO would be inadvertently remounted as read-write, unless targeted specifically by malware.

Tools like growisofs can append data to an ISO, but it's more complex than a simple remount command. Even without growisofs, malware could potentially repack and rewrite an ISO, but it is an even more complicated process. Not something that can happen by accident.

What about read-only media, like a DVD-R (not DVD-RW)? This is indeed a safer option, but less practical. It requires burning the DVD, then using it in a read-only DVD reader, which is not a common practice. Such devices are not popular anymore nowadays.

Combining physical write protection switches with grub-live would further enhance security. However, even this is not foolproof due to potential hardware vulnerabilities or defects. (See Write Protection.) Thus, it should be considered an additional layer of defense rather than a complete solution.

Reflecting on these aspects, we can categorize security configurations from least to most secure, as follows:

Notes:

• This list, created in December 2023, might have minor inaccuracies but generally represents the correct security hierarchy.
• ISO HDD: It is possible to boot an ISO located on the hard drive. This is unspecific to Kicksecure and out of scope for this documentation.

1. VM live mode HDD boot without read-only VM HDD ("least secure")
2. VM live mode HDD boot with read-only VM hard drive
3. VM live mode ISO boot without VM HDDs connected
4. host live mode HDD without read-only HDD
5. host live mode HDD without read-only HDD + using VMs
6. host live mode HDD with read-only HDD
7. host live mode HDD with read-only HDD + using VMs
8. host live mode ISO HDD with read-only HDD
9. host live mode ISO HDD with read-only HDD + using VMs
10. same as above but with Full Disk Encryption as an additional safety layer
11. same as above but hardware write protection switches enabled
12. host live mode ISO DVD-RW with
13. host live mode ISO DVD-RW with + using VMs
14. host live mode ISO DVD-R with
15. host live mode ISO DVD-R with + using VMs
16. same as above but with all other storage devices disconnected ("most secure")

Additional steps users can take to improve the security of live mode:

• Avoiding the installation of additional software, especially more complex software that uses mount/loop devices or breaks the live indicator, such as, for example, snapd.
• Prevention of Malware Sniffing the Root Password, because remount read-write requires root.

See also Whonix technical design documentation on forensics.

In summary, while striving for maximum security, absolute guarantees are unattainable. Users seeking higher data amnesia assurances should consider becoming developers or auditors, or sponsoring focused development and review in the realm of anti-forensics, including the development of comprehensive automated testing frameworks.

Remount Disk as Read-Write after booting into Live Mode

This chapter is more of developer documentation, proof of concept, and curiosity rather than something that users should do.

1. Create a mount folder /mnt/disk.

sudo mkdir /mnt/disk

2. Mount.

Note: /dev/sda3 applies to VirtualBox VMs. It needs to be replaced with the actual hard drive device name.

sudo mount /dev/sda3 /mnt/disk

3. Remount as read-write.

sudo mount -o remount,rw /dev/sda3 /mnt/disk

4. Make persistent modifications.

For example, create a file /home/test-file.

touch /mnt/disk/home/test-file

It is unclear if the disk could even be remounted to / but that is left as a sysadmin exercise for the reader.

5. When done, unmount.

sudo umount /mnt/disk

6. Remove the mount point.

Optional.

sudo rmdir /mnt/disk

7. Done.

The process has been completed.

Questions and answers:

• Is this a security issue? Yes.
• Is this issue specific to, or caused by, grub-live or Kicksecure? No, unspecific to Kicksecure.
• Is this issue reproducible on other live systems, i.e., without grub-live or Kicksecure being involved? Yes.
• Are similar live systems also affected? Yes, see Security Considerations.
• What can users do to improve their security? See the same link as above.

Troubleshooting

Here are some problems you might encounter and their possible solutions.

Live Mode Without grub-live

Platform specific.

• Kicksecure: In recent versions of Kicksecure, dracut is installed by default. To boot into live mode without using grub-live, simply add the rootovl kernel parameter. Instructions for adding kernel parameters can be found on the grub wiki page.
  • Note that booting with the rootovl kernel parameter will only mount the root filesystem live. If you have other filesystems that are mounted by default when the system starts, such as /home on a separate partition, those filesystems will NOT be mounted live when doing this. grub-live remedies this via a live-hardener script that detects additional persistent mountpoints and remounts them read-only with a live writable overlay.
• Kicksecure for Qubes: For Qubes OS, the process may not work as expected. For further details, refer to the related Qubes feature request Implement live boot by porting grub-live to Qubes - amnesia / non-persistent boot / anti-forensics

It is recommended to Functionality Test of Live mode to verify non-persistence.

Missing grub-live boot menu entry

Please run the following commands for debugging/information gathering and post them when creating any support requests.

1. /etc/grub.d/10_20_linux_live file existence.

ls -la /etc/grub.d/10_20_linux_live

2. /etc/grub.d/10_20_linux_live file contents.

Please check your local file /etc/grub.d/10_20_linux_live to ensure it looks exactly the same as /etc/grub.d/10_20_linux_live on GitHub. This will verify that you have the latest version of the grub-live package. Note that the stable version might look slightly different from the developer's or tester's version on GitHub.

cat /etc/grub.d/10_20_linux_live

3. initramfs-tools package version number.

(Probably not installed. This is expected.)

dpkg-query -W -f='${db:Status-Status}' initramfs-tools

4. dracut package version number.

dpkg-query -W -f='${db:Status-Status}' dracut

5. dist-base-files package version number.

dpkg -l | grep dist-base-files

6. grub-live package version number.

dpkg -l | grep grub-live

7. /boot/grub/grub.cfg file contents.

sudo cat /boot/grub/grub.cfg

8. Optional: Compare /boot/grub/grub.cfg with sample grub.cfg.

Use File Comparison Tools.

related forums tips:

• Pasting Logs for Support
• Code Tags

Live Check Indicator Systray Issues

The live mode is indicated by a Live Check Systray icon. It can happen that this icon has issues. If so, here's what you can do.

First of all, this is not an indication of compromise by malware. The real issue is as simple as: the Live Check Systray is broken.

1. Is live-mode.sh showing an error?

bash -x /usr/libexec/helper-scripts/live-mode.sh

2. Is get_writable_fs_lists.sh showing an error?

bash -x /usr/libexec/helper-scripts/get_writable_fs_lists.sh

3. Try lsblk.

If the above method does not work, try also this:

sudo /bin/lsblk

4. Kernel parameter check.

Please check kernel parameters after booting into live mode.

If using dracut (default in newer versions):

cat -- /proc/cmdline | grep --color -- rootovl

If using initramfs-tools (old build versions):

cat -- /proc/cmdline | grep --color -- boot=live

If not booting into live mode, these kernel parameters should not be there.

5. Bug report.

If you are still having issues, you can report a bug with the output from the commands included above.

dracut

Optional.

Changing from initramfs-tools to dracut is optional and can cause dracut issues, unbootable system. See dracut.

Developer Information

Users can skip this chapter and below.

Implementation

The grub-live implementation combines the dracut module 90overlay-root with a script /usr/libexec/grub-live/live-hardener to mount all possible writable filesystems read-only, with a writable RAM-based overlay to allow normal system operation without persistence. 90overlay-root and live-hardener get enabled when kernel parameter rootovl is set. 90overlay-root is only available in the Debian fork of dracut.

• dracut module source file: /usr/lib/dracut/modules.d/90overlay-root/overlay-mount.sh
• /etc/grub.d/10_20_linux_live on GitHub
• main file: /etc/grub.d/10_20_linux_live
• 90overlay-root vs 90dmsquash-live
• https://github.com/dracutdevs/dracut/issues/1565

Simplified Summary

The first main source file is this one: /etc/grub.d/10_20_linux_live

The most relevant parts...

## initramfs support GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX boot=live plainroot union=overlay ip=frommedia noeject nopersistence"

(But Kicksecure at the time of writing uses the initramfs generator "dracut" by default, so "initramfs-tools" support is legacy.)

## dracut support ## https://www.kicksecure.com/wiki/Grub-live#Developer_Information ## ## using Debian forked upstream module 90overlay-root (tested) GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX rootovl" ## using dracut upstream module 90overlayfs (untested) #GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX rd.live.overlay.overlayfs=1 rd.live.overlay.readonly=1"

Therefore, as of June 2025, the majority of what grub-live does is provide a convenient way (the GRUB boot menu entry) to easily set the kernel parameter rootovl, which is a feature provided by Debian's forked version of dracut, module 90overlay-root. In the future, the dracut upstream module 90overlayfs should be used instead. See also Development. These dracut modules in turn make use of Linux kernel features.

The other primary source file is this one: live-hardener. This script detects writable filesystems and remounts most of them read-only, then adds a live overlay on top. This is similar to what Debian's dracut's 90overlay-root does for the root filesystem, but applies to most other writable filesystems on the system, thus preventing reducing persistence even in more complex setups.

live-hardener does not remount writable filesystems if both of the following conditions are met:

• The filesystem is mounted to /media, /mnt, or a subdirectory thereof, and
• The drive containing the filesystem is detected to be a removable drive (/sys/class/block/DRIVE_ID/removable is equal to 1).

live-hardener is not always able to mount a writable RAM-based overlay on top of all filesystems, as some filesystems are not compatible with the overlayfs kernel feature. These filesystems are simply remounted read-only, without providing a writable overlay.

In summary, the most heavy lifting is done by the initramfs generator (initramfs-tools or dracut) and the Linux kernel. grub-live only implements usability (GRUB boot menu entry), documentation, and a more thorough hardening mechanism for filesystems beyond the root filesystem.

Development

Should port to 90overlayfs

rd.live.overlay.overlayfs=1 rd.live.overlay.readonly=1

While Debian did not merge overlayfs with nfs for Debian bookworm the module will be updated in the next major version of Debian as per usual as Debian receives newer dracut versions from dracut upstream.

File Names

Legacy File Names

/etc/grub.d/11_linux_live has been renamed to /etc/grub.d/10_20_linux_live .

Porting grub-live to other Linux Distributions

This is an informational chapter for developers. Users can skip this chapter.

Porting grub-live to other Linux Distributions might be rather simple in comparison to other packages.

grub-live should already be compatible with any Debian based distribution as mentioned on top of this wiki page. Testing is very limited.

What grub-live technically in essence does:

• 1) The grub-live is mainly shipping three files:
  • GRUB config file /etc/grub.d/10_20_linux_live
  • live-hardener script live-hardener.
  • systemd service live-hardener.service.
• 2) Pull required dependencies in debian/control
• 3) Postinst runs: "sudo update-grub"

Qubes support:

• Might be harder.
• That would require packaging grub-live for Fedora.
• Or as a first step copying over the config files.
• https://github.com/QubesOS/qubes-issues/issues/1018
• https://github.com/QubesOS/qubes-issues/issues/4982

grub.cfg

For reference only.

/boot/grub/grub.cfg will be automatically created. (Auto-generated by sudo update-grub .) No manual user action required. Useful for comparison in case of debugging.

#
# DO NOT EDIT THIS FILE
#
# It is automatically generated by grub-mkconfig using templates
# from /etc/grub.d and settings from /etc/default/grub
#

### BEGIN /etc/grub.d/00_header ###
if [ -s $prefix/grubenv ]; then
  set have_grubenv=true
  load_env
fi
if [ "${next_entry}" ] ; then
   set default="${next_entry}"
   set next_entry=
   save_env next_entry
   set boot_once=true
else
   set default="0"
fi

if [ x"${feature_menuentry_id}" = xy ]; then
  menuentry_id_option="--id"
else
  menuentry_id_option=""
fi

export menuentry_id_option

if [ "${prev_saved_entry}" ]; then
  set saved_entry="${prev_saved_entry}"
  save_env saved_entry
  set prev_saved_entry=
  save_env prev_saved_entry
  set boot_once=true
fi

function savedefault {
  if [ -z "${boot_once}" ]; then
    saved_entry="${chosen}"
    save_env saved_entry
  fi
}
function load_video {
  if [ x$feature_all_video_module = xy ]; then
    insmod all_video
  else
    insmod efi_gop
    insmod efi_uga
    insmod ieee1275_fb
    insmod vbe
    insmod vga
    insmod video_bochs
    insmod video_cirrus
  fi
}

if [ x$feature_default_font_path = xy ] ; then
   font=unicode
else
insmod part_msdos
insmod btrfs
search --no-floppy --fs-uuid --set=root e727c741-7916-416a-a89b-6df8286415eb
    font="/grub/unicode.pf2"
fi

if loadfont $font ; then
  set gfxmode=1024x768
  load_video
  insmod gfxterm
  set locale_dir=$prefix/locale
  set lang=en_US
  insmod gettext
fi
terminal_output gfxterm
insmod part_msdos
insmod btrfs
search --no-floppy --fs-uuid --set=root e727c741-7916-416a-a89b-6df8286415eb
insmod gfxmenu
loadfont ($root)/grub/themes/dist-common/inter-grub_regular_17.pf2
loadfont ($root)/grub/themes/dist-common/inter-grub_regular_20.pf2
loadfont ($root)/grub/themes/dist-common/terminus-grub_14.pf2
insmod png
set theme=($root)/grub/themes/kicksecure/theme-4x3.txt
export theme
if [ "${recordfail}" = 1 ] ; then
  set timeout=30
else
  if [ x$feature_timeout_style = xy ] ; then
    set timeout_style=menu
    set timeout=5
  # Fallback normal timeout code in case the timeout_style feature is
  # unavailable.
  else
    set timeout=5
  fi
fi
### END /etc/grub.d/00_header ###

### BEGIN /etc/grub.d/05_debian_theme ###
set menu_color_normal=cyan/blue
set menu_color_highlight=white/blue
### END /etc/grub.d/05_debian_theme ###

### BEGIN /etc/grub.d/10_00_linux_dist ###
function gfxmode {
	set gfxpayload="${1}"
}
set linux_gfx_mode=1024x768
export linux_gfx_mode
menuentry 'Kicksecure GNU/Linux' --class kicksecure --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-f980020b-0f30-442d-b3ec-ab4c6c54fa9a' {
	load_video
	gfxmode $linux_gfx_mode
	insmod gzio
	if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
	insmod part_msdos
	insmod btrfs
	search --no-floppy --fs-uuid --set=root e727c741-7916-416a-a89b-6df8286415eb
	echo	'Loading Linux 6.1.0-32-amd64 ...'
	linux	/vmlinuz-6.1.0-32-amd64 root=UUID=f980020b-0f30-442d-b3ec-ab4c6c54fa9a ro rootflags=subvol=@  mitigations=auto,nosmt nosmt=force spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on ssbd=force-on l1tf=full,force mds=full,nosmt tsx=off tsx_async_abort=full,nosmt kvm.nx_huge_pages=force l1d_flush=on mmio_stale_data=full,nosmt retbleed=auto,nosmt gather_data_sampling=force reg_file_data_sampling=on slab_nomerge slab_debug=FZ init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 pti=on randomize_kstack_offset=on vsyscall=none debugfs=off kfence.sample_interval=100 vdso32=0 amd_iommu=force_isolation intel_iommu=on iommu=force iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma random.trust_bootloader=off random.trust_cpu=off extra_latent_entropy  rd.luks.uuid=dc1f531b-eea8-47b0-86f2-a841d6d61a4e loglevel=0 quiet
	echo	'Loading initial ramdisk ...'
	initrd	/initrd.img-6.1.0-32-amd64
}

### END /etc/grub.d/10_00_linux_dist ###

### BEGIN /etc/grub.d/10_20_linux_live ###
function gfxmode {
	set gfxpayload="${1}"
}
set linux_gfx_mode=1024x768
export linux_gfx_mode
menuentry 'Kicksecure LIVE mode USER (For daily activities.) GNU/Linux' --class kicksecure --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-f980020b-0f30-442d-b3ec-ab4c6c54fa9a' {
	load_video
	gfxmode $linux_gfx_mode
	insmod gzio
	if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
	insmod part_msdos
	insmod btrfs
	search --no-floppy --fs-uuid --set=root e727c741-7916-416a-a89b-6df8286415eb
	echo	'Loading Linux 6.1.0-32-amd64 ...'
	linux	/vmlinuz-6.1.0-32-amd64 root=/dev/disk/by-uuid/f980020b-0f30-442d-b3ec-ab4c6c54fa9a ro rootflags=subvol=@  mitigations=auto,nosmt nosmt=force spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on ssbd=force-on l1tf=full,force mds=full,nosmt tsx=off tsx_async_abort=full,nosmt kvm.nx_huge_pages=force l1d_flush=on mmio_stale_data=full,nosmt retbleed=auto,nosmt gather_data_sampling=force reg_file_data_sampling=on slab_nomerge slab_debug=FZ init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 pti=on randomize_kstack_offset=on vsyscall=none debugfs=off kfence.sample_interval=100 vdso32=0 amd_iommu=force_isolation intel_iommu=on iommu=force iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma random.trust_bootloader=off random.trust_cpu=off extra_latent_entropy rootovl  rd.luks.uuid=dc1f531b-eea8-47b0-86f2-a841d6d61a4e loglevel=0 quiet
	echo	'Loading initial ramdisk ...'
	initrd	/initrd.img-6.1.0-32-amd64
}

### END /etc/grub.d/10_20_linux_live ###

### BEGIN /etc/grub.d/10_50_linux_dist_advanced ###
submenu 'Advanced options for Kicksecure GNU/Linux' $menuentry_id_option 'gnulinux-advanced-f980020b-0f30-442d-b3ec-ab4c6c54fa9a' {
	menuentry 'Kicksecure GNU/Linux, with Linux 6.1.0-32-amd64' --class kicksecure --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.1.0-32-amd64-advanced-f980020b-0f30-442d-b3ec-ab4c6c54fa9a' {
		load_video
		gfxmode $linux_gfx_mode
		insmod gzio
		if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
		insmod part_msdos
		insmod btrfs
		search --no-floppy --fs-uuid --set=root e727c741-7916-416a-a89b-6df8286415eb
		echo	'Loading Linux 6.1.0-32-amd64 ...'
		linux	/vmlinuz-6.1.0-32-amd64 root=UUID=f980020b-0f30-442d-b3ec-ab4c6c54fa9a ro rootflags=subvol=@  mitigations=auto,nosmt nosmt=force spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on ssbd=force-on l1tf=full,force mds=full,nosmt tsx=off tsx_async_abort=full,nosmt kvm.nx_huge_pages=force l1d_flush=on mmio_stale_data=full,nosmt retbleed=auto,nosmt gather_data_sampling=force reg_file_data_sampling=on slab_nomerge slab_debug=FZ init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 pti=on randomize_kstack_offset=on vsyscall=none debugfs=off kfence.sample_interval=100 vdso32=0 amd_iommu=force_isolation intel_iommu=on iommu=force iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma random.trust_bootloader=off random.trust_cpu=off extra_latent_entropy  rd.luks.uuid=dc1f531b-eea8-47b0-86f2-a841d6d61a4e loglevel=0 quiet
		echo	'Loading initial ramdisk ...'
		initrd	/initrd.img-6.1.0-32-amd64
	}
	menuentry 'Kicksecure GNU/Linux, with Linux 6.1.0-32-amd64 (recovery mode)' --class kicksecure --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.1.0-32-amd64-recovery-f980020b-0f30-442d-b3ec-ab4c6c54fa9a' {
		load_video
		gfxmode $linux_gfx_mode
		insmod gzio
		if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
		insmod part_msdos
		insmod btrfs
		search --no-floppy --fs-uuid --set=root e727c741-7916-416a-a89b-6df8286415eb
		echo	'Loading Linux 6.1.0-32-amd64 ...'
		linux	/vmlinuz-6.1.0-32-amd64 root=UUID=f980020b-0f30-442d-b3ec-ab4c6c54fa9a ro single rootflags=subvol=@  mitigations=auto,nosmt nosmt=force spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on ssbd=force-on l1tf=full,force mds=full,nosmt tsx=off tsx_async_abort=full,nosmt kvm.nx_huge_pages=force l1d_flush=on mmio_stale_data=full,nosmt retbleed=auto,nosmt gather_data_sampling=force reg_file_data_sampling=on slab_nomerge slab_debug=FZ init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 pti=on randomize_kstack_offset=on vsyscall=none debugfs=off kfence.sample_interval=100 vdso32=0 amd_iommu=force_isolation intel_iommu=on iommu=force iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma random.trust_bootloader=off random.trust_cpu=off extra_latent_entropy
		echo	'Loading initial ramdisk ...'
		initrd	/initrd.img-6.1.0-32-amd64
	}
	menuentry 'Kicksecure GNU/Linux, with Linux 6.1.0-31-amd64' --class kicksecure --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.1.0-31-amd64-advanced-f980020b-0f30-442d-b3ec-ab4c6c54fa9a' {
		load_video
		gfxmode $linux_gfx_mode
		insmod gzio
		if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
		insmod part_msdos
		insmod btrfs
		search --no-floppy --fs-uuid --set=root e727c741-7916-416a-a89b-6df8286415eb
		echo	'Loading Linux 6.1.0-31-amd64 ...'
		linux	/vmlinuz-6.1.0-31-amd64 root=UUID=f980020b-0f30-442d-b3ec-ab4c6c54fa9a ro rootflags=subvol=@  mitigations=auto,nosmt nosmt=force spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on ssbd=force-on l1tf=full,force mds=full,nosmt tsx=off tsx_async_abort=full,nosmt kvm.nx_huge_pages=force l1d_flush=on mmio_stale_data=full,nosmt retbleed=auto,nosmt gather_data_sampling=force reg_file_data_sampling=on slab_nomerge slab_debug=FZ init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 pti=on randomize_kstack_offset=on vsyscall=none debugfs=off kfence.sample_interval=100 vdso32=0 amd_iommu=force_isolation intel_iommu=on iommu=force iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma random.trust_bootloader=off random.trust_cpu=off extra_latent_entropy  rd.luks.uuid=dc1f531b-eea8-47b0-86f2-a841d6d61a4e loglevel=0 quiet
		echo	'Loading initial ramdisk ...'
		initrd	/initrd.img-6.1.0-31-amd64
	}
	menuentry 'Kicksecure GNU/Linux, with Linux 6.1.0-31-amd64 (recovery mode)' --class kicksecure --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.1.0-31-amd64-recovery-f980020b-0f30-442d-b3ec-ab4c6c54fa9a' {
		load_video
		gfxmode $linux_gfx_mode
		insmod gzio
		if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
		insmod part_msdos
		insmod btrfs
		search --no-floppy --fs-uuid --set=root e727c741-7916-416a-a89b-6df8286415eb
		echo	'Loading Linux 6.1.0-31-amd64 ...'
		linux	/vmlinuz-6.1.0-31-amd64 root=UUID=f980020b-0f30-442d-b3ec-ab4c6c54fa9a ro single rootflags=subvol=@  mitigations=auto,nosmt nosmt=force spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on ssbd=force-on l1tf=full,force mds=full,nosmt tsx=off tsx_async_abort=full,nosmt kvm.nx_huge_pages=force l1d_flush=on mmio_stale_data=full,nosmt retbleed=auto,nosmt gather_data_sampling=force reg_file_data_sampling=on slab_nomerge slab_debug=FZ init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 pti=on randomize_kstack_offset=on vsyscall=none debugfs=off kfence.sample_interval=100 vdso32=0 amd_iommu=force_isolation intel_iommu=on iommu=force iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma random.trust_bootloader=off random.trust_cpu=off extra_latent_entropy
		echo	'Loading initial ramdisk ...'
		initrd	/initrd.img-6.1.0-31-amd64
	}
	menuentry 'Kicksecure GNU/Linux, with Linux 6.1.0-28-amd64' --class kicksecure --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.1.0-28-amd64-advanced-f980020b-0f30-442d-b3ec-ab4c6c54fa9a' {
		load_video
		gfxmode $linux_gfx_mode
		insmod gzio
		if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
		insmod part_msdos
		insmod btrfs
		search --no-floppy --fs-uuid --set=root e727c741-7916-416a-a89b-6df8286415eb
		echo	'Loading Linux 6.1.0-28-amd64 ...'
		linux	/vmlinuz-6.1.0-28-amd64 root=UUID=f980020b-0f30-442d-b3ec-ab4c6c54fa9a ro rootflags=subvol=@  mitigations=auto,nosmt nosmt=force spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on ssbd=force-on l1tf=full,force mds=full,nosmt tsx=off tsx_async_abort=full,nosmt kvm.nx_huge_pages=force l1d_flush=on mmio_stale_data=full,nosmt retbleed=auto,nosmt gather_data_sampling=force reg_file_data_sampling=on slab_nomerge slab_debug=FZ init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 pti=on randomize_kstack_offset=on vsyscall=none debugfs=off kfence.sample_interval=100 vdso32=0 amd_iommu=force_isolation intel_iommu=on iommu=force iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma random.trust_bootloader=off random.trust_cpu=off extra_latent_entropy  rd.luks.uuid=dc1f531b-eea8-47b0-86f2-a841d6d61a4e loglevel=0 quiet
		echo	'Loading initial ramdisk ...'
		initrd	/initrd.img-6.1.0-28-amd64
	}
	menuentry 'Kicksecure GNU/Linux, with Linux 6.1.0-28-amd64 (recovery mode)' --class kicksecure --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.1.0-28-amd64-recovery-f980020b-0f30-442d-b3ec-ab4c6c54fa9a' {
		load_video
		gfxmode $linux_gfx_mode
		insmod gzio
		if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
		insmod part_msdos
		insmod btrfs
		search --no-floppy --fs-uuid --set=root e727c741-7916-416a-a89b-6df8286415eb
		echo	'Loading Linux 6.1.0-28-amd64 ...'
		linux	/vmlinuz-6.1.0-28-amd64 root=UUID=f980020b-0f30-442d-b3ec-ab4c6c54fa9a ro single rootflags=subvol=@  mitigations=auto,nosmt nosmt=force spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on ssbd=force-on l1tf=full,force mds=full,nosmt tsx=off tsx_async_abort=full,nosmt kvm.nx_huge_pages=force l1d_flush=on mmio_stale_data=full,nosmt retbleed=auto,nosmt gather_data_sampling=force reg_file_data_sampling=on slab_nomerge slab_debug=FZ init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 pti=on randomize_kstack_offset=on vsyscall=none debugfs=off kfence.sample_interval=100 vdso32=0 amd_iommu=force_isolation intel_iommu=on iommu=force iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma random.trust_bootloader=off random.trust_cpu=off extra_latent_entropy
		echo	'Loading initial ramdisk ...'
		initrd	/initrd.img-6.1.0-28-amd64
	}
}

### END /etc/grub.d/10_50_linux_dist_advanced ###

### BEGIN /etc/grub.d/10_51_linux_live_advanced ###
submenu 'Advanced options for Kicksecure LIVE mode USER (For daily activities.) GNU/Linux' $menuentry_id_option 'gnulinux-advanced-f980020b-0f30-442d-b3ec-ab4c6c54fa9a' {
	menuentry 'Kicksecure LIVE mode USER (For daily activities.) GNU/Linux, with Linux 6.1.0-32-amd64' --class kicksecure --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.1.0-32-amd64-advanced-f980020b-0f30-442d-b3ec-ab4c6c54fa9a' {
		load_video
		gfxmode $linux_gfx_mode
		insmod gzio
		if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
		insmod part_msdos
		insmod btrfs
		search --no-floppy --fs-uuid --set=root e727c741-7916-416a-a89b-6df8286415eb
		echo	'Loading Linux 6.1.0-32-amd64 ...'
		linux	/vmlinuz-6.1.0-32-amd64 root=/dev/disk/by-uuid/f980020b-0f30-442d-b3ec-ab4c6c54fa9a ro rootflags=subvol=@  mitigations=auto,nosmt nosmt=force spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on ssbd=force-on l1tf=full,force mds=full,nosmt tsx=off tsx_async_abort=full,nosmt kvm.nx_huge_pages=force l1d_flush=on mmio_stale_data=full,nosmt retbleed=auto,nosmt gather_data_sampling=force reg_file_data_sampling=on slab_nomerge slab_debug=FZ init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 pti=on randomize_kstack_offset=on vsyscall=none debugfs=off kfence.sample_interval=100 vdso32=0 amd_iommu=force_isolation intel_iommu=on iommu=force iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma random.trust_bootloader=off random.trust_cpu=off extra_latent_entropy rootovl  rd.luks.uuid=dc1f531b-eea8-47b0-86f2-a841d6d61a4e loglevel=0 quiet
		echo	'Loading initial ramdisk ...'
		initrd	/initrd.img-6.1.0-32-amd64
	}
	menuentry 'Kicksecure LIVE mode USER (For daily activities.) GNU/Linux, with Linux 6.1.0-31-amd64' --class kicksecure --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.1.0-31-amd64-advanced-f980020b-0f30-442d-b3ec-ab4c6c54fa9a' {
		load_video
		gfxmode $linux_gfx_mode
		insmod gzio
		if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
		insmod part_msdos
		insmod btrfs
		search --no-floppy --fs-uuid --set=root e727c741-7916-416a-a89b-6df8286415eb
		echo	'Loading Linux 6.1.0-31-amd64 ...'
		linux	/vmlinuz-6.1.0-31-amd64 root=/dev/disk/by-uuid/f980020b-0f30-442d-b3ec-ab4c6c54fa9a ro rootflags=subvol=@  mitigations=auto,nosmt nosmt=force spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on ssbd=force-on l1tf=full,force mds=full,nosmt tsx=off tsx_async_abort=full,nosmt kvm.nx_huge_pages=force l1d_flush=on mmio_stale_data=full,nosmt retbleed=auto,nosmt gather_data_sampling=force reg_file_data_sampling=on slab_nomerge slab_debug=FZ init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 pti=on randomize_kstack_offset=on vsyscall=none debugfs=off kfence.sample_interval=100 vdso32=0 amd_iommu=force_isolation intel_iommu=on iommu=force iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma random.trust_bootloader=off random.trust_cpu=off extra_latent_entropy rootovl  rd.luks.uuid=dc1f531b-eea8-47b0-86f2-a841d6d61a4e loglevel=0 quiet
		echo	'Loading initial ramdisk ...'
		initrd	/initrd.img-6.1.0-31-amd64
	}
	menuentry 'Kicksecure LIVE mode USER (For daily activities.) GNU/Linux, with Linux 6.1.0-28-amd64' --class kicksecure --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.1.0-28-amd64-advanced-f980020b-0f30-442d-b3ec-ab4c6c54fa9a' {
		load_video
		gfxmode $linux_gfx_mode
		insmod gzio
		if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
		insmod part_msdos
		insmod btrfs
		search --no-floppy --fs-uuid --set=root e727c741-7916-416a-a89b-6df8286415eb
		echo	'Loading Linux 6.1.0-28-amd64 ...'
		linux	/vmlinuz-6.1.0-28-amd64 root=/dev/disk/by-uuid/f980020b-0f30-442d-b3ec-ab4c6c54fa9a ro rootflags=subvol=@  mitigations=auto,nosmt nosmt=force spectre_v2=on spectre_bhi=on spec_store_bypass_disable=on ssbd=force-on l1tf=full,force mds=full,nosmt tsx=off tsx_async_abort=full,nosmt kvm.nx_huge_pages=force l1d_flush=on mmio_stale_data=full,nosmt retbleed=auto,nosmt gather_data_sampling=force reg_file_data_sampling=on slab_nomerge slab_debug=FZ init_on_alloc=1 init_on_free=1 page_alloc.shuffle=1 pti=on randomize_kstack_offset=on vsyscall=none debugfs=off kfence.sample_interval=100 vdso32=0 amd_iommu=force_isolation intel_iommu=on iommu=force iommu.passthrough=0 iommu.strict=1 efi=disable_early_pci_dma random.trust_bootloader=off random.trust_cpu=off extra_latent_entropy rootovl  rd.luks.uuid=dc1f531b-eea8-47b0-86f2-a841d6d61a4e loglevel=0 quiet
		echo	'Loading initial ramdisk ...'
		initrd	/initrd.img-6.1.0-28-amd64
	}
}

### END /etc/grub.d/10_51_linux_live_advanced ###

### BEGIN /etc/grub.d/20_linux_xen ###

### END /etc/grub.d/20_linux_xen ###

### BEGIN /etc/grub.d/30_os-prober ###
### END /etc/grub.d/30_os-prober ###

### BEGIN /etc/grub.d/30_uefi-firmware ###
### END /etc/grub.d/30_uefi-firmware ###

### BEGIN /etc/grub.d/40_custom ###
# This file provides an easy way to add custom menu entries.  Simply type the
# menu entries you want to add after this comment.  Be careful not to change
# the 'exec tail' line above.
### END /etc/grub.d/40_custom ###

### BEGIN /etc/grub.d/41_custom ###
if [ -f  ${config_directory}/custom.cfg ]; then
  source ${config_directory}/custom.cfg
elif [ -z "${config_directory}" -a -f  $prefix/custom.cfg ]; then
  source $prefix/custom.cfg
fi
### END /etc/grub.d/41_custom ###

### BEGIN /etc/grub.d/45_debugging ###
### END /etc/grub.d/45_debugging ###

Footnotes

Distribution Morphing Advanced Documentation grub Previous page: Distribution Morphing Index page: Advanced Documentation Next page: grub

Kicksecure A secure by default operating system with the latest security research in place.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Kicksecure is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Kicksecure we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2025 ENCRYPTED SUPPORT LLC

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!