Ubuntu drops Btrfs, XFS & ZFS boot support with Secure Boot
-
Canonical has changed how Ubuntu 26.10 boots on system with Secure Boot enabled, in an effort to reduce the attack surface of the boot process.
Ubuntu 26.10’s signed build of GRUB, which is only used on systems if Secure Boot is turned on, no longer supports /boot on Btrfs, XFS, ZFS, LVM, LUKS encryption or software RAID (other than RAID1).
HFS+, Apple partition table support and JPEG and PNG image loading is also removed.
Since GRUB needs to read the /boot directory to load the kernel and boot Ubuntu, if those files are on one of the affected filesystems, it can’t access them and the system won’t boot.
Ubuntu 26.10 still supports /boot on ext4, FAT and ISO9660 (used for booting from CD/DVDs), as well as, naturally, squashfs for snaps with Secure Boot enabled
If Secure Boot is disabled, GRUB’s full feature set is loaded, meaning exotic /boot setups and any GRUB customisation tweaks, like image backgrounds work as normal.
Ubuntu drops Btrfs, XFS & ZFS boot support with Secure Boot
Canonical has changed how Ubuntu 26.10 boots on system with Secure Boot enabled, in an effort to reduce the attack surface of the boot process.
OMG! Ubuntu (www.omgubuntu.co.uk)
-
Canonical has changed how Ubuntu 26.10 boots on system with Secure Boot enabled, in an effort to reduce the attack surface of the boot process.
Ubuntu 26.10’s signed build of GRUB, which is only used on systems if Secure Boot is turned on, no longer supports /boot on Btrfs, XFS, ZFS, LVM, LUKS encryption or software RAID (other than RAID1).
HFS+, Apple partition table support and JPEG and PNG image loading is also removed.
Since GRUB needs to read the /boot directory to load the kernel and boot Ubuntu, if those files are on one of the affected filesystems, it can’t access them and the system won’t boot.
Ubuntu 26.10 still supports /boot on ext4, FAT and ISO9660 (used for booting from CD/DVDs), as well as, naturally, squashfs for snaps with Secure Boot enabled
If Secure Boot is disabled, GRUB’s full feature set is loaded, meaning exotic /boot setups and any GRUB customisation tweaks, like image backgrounds work as normal.
Ubuntu drops Btrfs, XFS & ZFS boot support with Secure Boot
Canonical has changed how Ubuntu 26.10 boots on system with Secure Boot enabled, in an effort to reduce the attack surface of the boot process.
OMG! Ubuntu (www.omgubuntu.co.uk)
Honestly, I do get it, but imho, this seems a bit crazy. I don't remember normally using a dedicated boot partition these days...
Feels like it should be an option
However to defend canonical, their LTS releases are 15 years, so it makes sense they make the best choice now
-
Honestly, I do get it, but imho, this seems a bit crazy. I don't remember normally using a dedicated boot partition these days...
Feels like it should be an option
However to defend canonical, their LTS releases are 15 years, so it makes sense they make the best choice now
Honestly, I do get it, but imho, this seems a bit crazy. I don’t remember normally using a dedicated boot partition these days…
What was old is new again! I'm fine with this change as its not removing support for the file systems altogether, its simply saying those can't be the boot volume. Seems like a small price to pay to significantly reduce the attack surface. I'm also wondering if this decision was driven from histories of compromised machines. As in, did a data analyst show a chart that 90% of a specific breech comes from this group of file system vulnerabilities? If so, then removing boot support for them dramatically would reduce compromised machines.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login