Ubuntu 26.10 Looks To Strip Its GRUB Bootloader To The Bare Minimum For Better Security (www.phoronix.com)

submitted 2 days ago by cm0002@literature.cafe to c/linux@programming.dev

30 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[-] grue@lemmy.world 28 points 2 days ago

Ripping out all of these GRUB features would basically mandate that most Ubuntu 26.10+ installations are done with the /boot partition being done on a raw EXT4 partition. Thus no more encrypted boot partition and having to rely on an EXT4 boot partition even if you are a diehard Btrfs / XFS / OpenZFS fan. Or you could opt for the non-signed GRUB bootloader that would be more full-featured albeit lacking Secure Boot and security compliance.

Reducing the signed GRUB builds to the minimum support necessary they feel would "[substantially] improve security". Users wanting those features back could use the non-signed GRUB builds albeit losing out on UEFI Secure Boot and security support.

How the Hell is any of that supposed to "improve" security? Something is fishy here.

[-] Dran_Arcana@lemmy.world 9 points 2 days ago

The simpler the arbitrary string/blob parsing logic the less this happens

https://app.opencve.io/cve/?product=grub2&vendor=gnu

I agree with you that it'd be nice if the cuts were a little shallower and allowed for an encrypted boot partition, but you could still have the system reasonably secure by encrypting the data partitions and signing the entire boot process to detect and abort decryption if the boot partition doesn't match signatures. You already have to do this with the efi partition if you're particularly paranoid about that attack vector, so this really isn't a new one.

this post was submitted on 25 Mar 2026

88 points (100.0% liked)

Linux

12991 readers

301 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 2 years ago

MODERATORS

Ategon@programming.dev

anzo@programming.dev

dwraf_of_ignorance@programming.dev