Arch Linux

jwodder

Member

Registered: 2026-05-14

Posts: 19

[SOLVED] Boot loaders for Unified Kernel Images

When creating a Unified Kernel Image for use with Secure Boot, you have a choice of including a boot loader/manager like systemd-boot or creating a UKI without a booloader that boots directly from UEFI.  However, I can't figure out what exactly the practical differences are that would motivate someone to pick one over the other.

As far as I can tell, the pros of using systemd-boot for this are:

• You get a boot manager, which lets you choose whether to boot normally, boot other OSes on the disk, reboot into firmware, and some other options.
   

  • ... but seeing as Secure Boot prevents kernel parameters from being set at runtime, will all of the options work?

While the pros of booting directly from UEFI are:

• Fewer files in the EFI system partition to worry about keeping secure

• Less stuff you have to configure

What pros, cons, and other considerations am I missing?

Last edited by jwodder (2026-06-26 17:00:57)

Lone_Wolf

Administrator

From: Netherlands, Europe

Registered: 2005-10-04

Posts: 15,217

Re: [SOLVED] Boot loaders for Unified Kernel Images

There are more bootloaders that support UKI and grub even supports Secure Boot.

Separate UKI and SB , then decide whether you want to use Secure Boot or not.

Hints
Unless you remove platform keys it's not you who controls Secure Boot
For a system that needs to be locked down (disallow changes) Secure Boot is one of the possible measures

EDIT
replaced SB with Secure Boot to avoid confusion.

Last edited by Lone_Wolf (2026-06-26 19:30:33)

---

Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.

clean chroot building not flexible enough ?
Try clean chroot manager by graysky

jwodder

Member

Registered: 2026-05-14

Posts: 19

Re: [SOLVED] Boot loaders for Unified Kernel Images

Separate UKI and SB , then decide whether you want to use SB or not.

But my question is: *How* do I decide whether to use systemd-boot or not?  What factors are there that should inform my decision?

V1del

Forum Moderator

Registered: 2012-10-16

Posts: 25,285

Re: [SOLVED] Boot loaders for Unified Kernel Images

I think Lone_Wolf is talking about Secure Boot in his abbreviation.

As for the bootloader, this is mostly preferences and you already listed the relevant differences. Afaik secure boot should not prevent kernel parameters at runtime assuming you are actually using a bootloader, because the bootloader is signed as well and whatever it passes to the kernel is considered "safe".

FWIW e.g. I use GRUB because I want to be able to load kernels from my root partition directly and I don't trust VFAT stability to keep kernel integrity safe (e.g. it's far more likely you have a corrupted kernel if you had a unsafe shutdown after an update involving the kernel on VFAT than on a proper filesystem). Other than that this is really just up to preferences and if you have a big enough VFAT partition and trust it enough there will not be that much inherent difference

jwodder

Member

Registered: 2026-05-14

Posts: 19

Re: [SOLVED] Boot loaders for Unified Kernel Images

I think Lone_Wolf is talking about Secure Boot in his abbreviation.

That would make a bit more sense.

As for the bootloader, this is mostly preferences and you already listed the relevant differences. Afaik secure boot should not prevent kernel parameters at runtime assuming you are actually using a bootloader, because the bootloader is signed as well and whatever it passes to the kernel is considered "safe".

Alright, good to know.  I'll mark this as "solved," then.

FWIW e.g. I use GRUB because I want to be able to load kernels from my root partition directly and I don't trust VFAT stability to keep kernel integrity safe (e.g. it's far more likely you have a corrupted kernel if you had a unsafe shutdown after an update involving the kernel on VFAT than on a proper filesystem). Other than that this is really just up to preferences and if you have a big enough VFAT partition and trust it enough there will not be that much inherent difference

For the record, the reason systemd-boot was the only boot loader I mentioned is because it's the only one I've found people using in the various writeups of Secure Boot + TPM setups I've found so far ([1], [2], [3], [4], [5]), except for one writeup that created a UKI that booted directly from EFI.  If I had to guess, this is probably cargo-culting caused by the wiki only mentioning systemd-boot in its "LUKS on a partition with TPM2 and Secure Boot" guide.

cyyynthia

Member

From: Toulouse, France

Registered: 2026-03-23

Posts: 10

Website

Re: [SOLVED] Boot loaders for Unified Kernel Images

If I had to guess, this is probably cargo-culting caused by the wiki only mentioning systemd-boot in its "LUKS on a partition with TPM2 and Secure Boot" guide.

I don't think calling it cargo-culting is productive; Arch Linux is a systemd-based distribution and as such it makes the most use of tools already present on the base installation - which includes systemd-boot. It's IMHO a reasonable default, especially considering it works with zero configuration when using UKIs - and even for dual booting Microsoft Copilot OS Windows! - which is a lot more beginner friendly than grub.

That being said, I updated that section of the wiki with a link to Unified kernel image#Booting for folks who wish to use a different bootloader at this step.

Additionally, I recently upgraded my TPM setup and found the (currently unreleased) latest version of Booster's manpage on TPM supplantation defense quite enlightening (also applies to other initrd generators like mkinitcpio or dracut), especially on how the dynamic between PCR 11+15 actually pans out during boot.