Canonical has changed how Ubuntu 26.10 boots on system with Secure Boot enabled, in an effort to reduce the attack surface of the boot process.

Canonical has changed how Ubuntu 26.10 boots on system with Secure Boot enabled, in an effort to reduce the attack surface of the boot process.

Ubuntu 26.10’s signed build of GRUB, which is only used on systems if Secure Boot is turned on, no longer supports /boot on Btrfs, XFS, ZFS, LVM, LUKS encryption or software RAID (other than RAID1).

HFS+, Apple partition table support and JPEG and PNG image loading is also removed.

Since GRUB needs to read the /boot directory to load the kernel and boot Ubuntu, if those files are on one of the affected filesystems, it can’t access them and the system won’t boot.

Ubuntu 26.10 still supports /boot on ext4, FAT and ISO9660 (used for booting from CD/DVDs), as well as, naturally, squashfs for snaps with Secure Boot enabled

If Secure Boot is disabled, GRUB’s full feature set is loaded, meaning exotic /boot setups and any GRUB customisation tweaks, like image backgrounds work as normal.

  • partial_accumen
    2·
    17 days ago

    Honestly, I do get it, but imho, this seems a bit crazy. I don’t remember normally using a dedicated boot partition these days…

    What was old is new again! I’m fine with this change as its not removing support for the file systems altogether, its simply saying those can’t be the boot volume. Seems like a small price to pay to significantly reduce the attack surface. I’m also wondering if this decision was driven from histories of compromised machines. As in, did a data analyst show a chart that 90% of a specific breech comes from this group of file system vulnerabilities? If so, then removing boot support for them dramatically would reduce compromised machines.

    • auzy1OPM
      1·
      17 days ago

      Yeah, I wonder what happens to systems not using a dedicated /boot though. As I don’t remember if you’re definitely forced to allocate one (but maybe you are)

      But yeah, it does make sense