Linux Boot Process for Security Analysis

This article explains each step of the Linux boot process, from firmware initialisation to user logon, and shows what Logs are generated during system startup.

Core Linux Boot Phases:

1. Firmware Initialisation
2. Boot Configuration and Boot Loader Selection
3. GRUB Boot Loader
4. Kernel Initialisation
5. User Space Initialisation
6. System Initialisation
7. Logon Phase

Linux Boot Process Diagram:

Description of Each Boot Phase:

1. Firmware Initialisation
   POST (Power-On Self-Test) performs hardware initialisation and checks essential system components such as CPU, memory and storage devices.
2. Boot Configuration and Boot Loader Selection
   BIOS (Basic Input/Output System) or UEFI (Unified Extensible Firmware Interface) identifies a bootable device and starts the boot loader.
3. GRUB Boot Loader
   GRUB (Grand Unified Boot Loader) loads the Linux kernel and initramfs into memory, then passes control to the kernel. It also provides options such as booting older kernels, recovery mode, memory testing and a command shell.
4. Kernel Initialisation
   The Linux Kernel initialises hardware devices, loads drivers and kernel modules, mounts the initramfs and then the real root file system. It then starts the init system (usually systemd) as Process ID 1.
5. User Space Initialisation
   The init system (usually systemd) becomes the first user-space process and begins transitioning the system from kernel space to user space. It prepares the user environment by mounting remaining file systems, loading system configuration and starting essential background processes and services.
6. System Initialisation
   systemd manages and starts system services and targets such as udev, logging services, networking, cron and CUPS. It also starts getty for terminal logins or a graphical display manager such as GDM, SDDM or LightDM.
7. Logon Phase
   Users log in through a command-line terminal or a graphical desktop environment.

Linux Logs Recorded During the Boot Process:

Detailed logging typically starts during kernel initialisation, Phase 4. Prior to this point, the firmware and boot loader stages generate little or no output in the Linux journal, so the earliest actionable logs are usually those produced by the kernel and later user-space components.

4. Kernel Initialisation

Booting Linux on a physical CPU - The first recorded event indicating the beginning of the kernel initialisation phase, where the Linux kernel starts on the main CPU.

Get Denysqw’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Linux version 6.18.9+kali-arm64 - Displays the running Linux kernel version and architecture.

efi: EFI v2.7 by EDK II - Confirms the system booted using UEFI firmware.

5. User Space Initialisation

systemd 260.1–1 running in system mode - systemd starts as the first user-space process and begins managing system services.

Hostname set to <kali> - The system hostname is configured as kali during startup.

Created slice user.slice — User and Session Slice - systemd creates a slice for managing user sessions and processes.

Started systemd-ask-password-wall.path - systemd starts the service responsible for handling password request notifications.

6. System Initialisation

Started systemd-logind.service — User Login Management - Shows the login/session management service being started.

Started NetworkManager.service — Network Manager - Shows the networking service starting during system initialisation.

Reached target network.target — Network - Indicates that core networking has been fully initialised.

Started lightdm.service — Light Display Manager - Indicates the graphical login manager has started.

Reached target graphical.target — Graphical Interface - Confirms the system reached the full graphical operating state.

7. Logon Phase

pam_unix(lightdm:session): session opened for user kali(uid=1000) - User authentication succeeded and the login session was opened.

New session ‘2’ of user ‘kali’ with class ‘user’ and type ‘x11’ - systemd-logind created a new graphical user session.

Starting user@1000.service — User Manager for UID 1000 - systemd started the user service manager after login.

Conclusion:

The Linux boot process is a sequence of stages that prepares the system to start correctly and allows the user to log in and interact with the system.

The main components of the Linux boot process are BIOS or UEFI, which perform hardware checks and start the boot loader, GRUB, which loads the kernel and initramfs, the Linux kernel, which initialises hardware and drivers, and systemd, which starts system services, networking, logging and the login environment.

References:

Collins, J. (2025) How Linux Boots. YouTube video, EzeeLinux. (Accessed: 20 May 2026).

Disclaimer:

Some parts of this article were created with AI assistance and may contain technical inaccuracies or incomplete information.