Linux Boot Sequence Explained

The Linux boot process is the name given to the startup procedures/order that your system goes through to load its operating system. In the following example, I will be referring to booting Linux on x86 architecture.

Note: This boot sequence is based around systems that use sysV init. Most newer systems will be using a system called systemd. Systemd will be covered later within our tutorials.

BIOS - Basic Input Output System

When an x86 computer is booted your system will look for a program called "BIOS", Basic Input output System. The BIOS code is a piece of read only code. The BIOS is responsible for initiating the first steps of the boot process. When the BIOS code is executed, it will look for any peripherals present, it will then look for a drive to use for the booting of the system. Normally you can press 'F12' or 'F2' to enter your BIOS and change the boot sequence order. Once a valid boot loader has been found and loaded into memory, full control is then passed. In simple terms, the BIOS loads and executes the MBR (Master Boot Record).

MBR - Master Boot Record

The Master Boot Record is generally found on the first sector of the bootable disk (less than 512 bytes in size). This will probably be "/dev/sda" or "/dev/hda" on older systems. The master boot record can be broken down into three sections. The Primary Bootloader which takes up the first 446 bytes of information. Next is the Partition Table which takes the next 64 bytes of information. The last 2 bytes are taken by the MBR validation check. The MBR contains information about your boot loader. On older systems this was "Lilo" and on newer systems this is "GRUB" (Grand Unified Bootloader). Basically the MBR loads and executes the boot loader.

GRUB - The Grand Unified Bootloader

GRUB is one of the most commonly used bootloader on Linux systems. There are currently two versions in use. GRUB 1.0 which is still in use on older supported systems and GRUB 2.0 which normally ships with most new systems. Using GRUB gives you the ability to load the kernel image of choice if you have more than one on your system, otherwise the default option will be loaded. Various other modifications can be made at this point in the boot process. These will be covered in more detail later. GRUB configuration files are normally located within the following locations:

GRUB 1.0 - OpenSUSE/Debian - "/boot/grub/menu.lst"
GRUB 2.0 - Debian - "/boot/grub/grub.conf" or "/boot/grub/grub.cfg"
Other systems such as Fedora often provide a symbolic link from "/etc/grub.conf" which points to "/boot/grub/grub.conf"

Example of GRUB config file under CentOS 6.3 running under VirtualBox:

[root@centos ~]# cat /etc/grub.conf
# grub.conf generated by anaconda
# Note that you do not have to rerun grub after making changes to this file
# NOTICE:  You have a /boot partition.  This means that
#          all kernel and initrd paths are relative to /boot/, eg.
#          root (hd0,0)
#          kernel /vmlinuz-version ro root=/dev/mapper/vg_centos-lv_root
#          initrd /initrd-[generic-]version.img
title CentOS (2.6.32-279.el6.i686)
    root (hd0,0)
    kernel /vmlinuz-2.6.32-279.el6.i686 ro root=/dev/mapper/vg_centos-lv_root nomodeset rd_NO_LUKS  KEYBOARDTYPE=pc KEYTABLE=uk LANG=en_US.UTF-8 rd_LVM_LV=vg_centos/lv_swap rd_NO_MD SYSFONT=latarcyrheb-sun16 crashkernel=auto rd_LVM_LV=vg_centos/lv_root rd_NO_DM rhgb quiet
    initrd /initramfs-2.6.32-279.el6.i686.img


The Kernel is responsible for mounting the root filesystem. Initiates the "init process" /sbin/inittab program. This is the first process to run on your system and will always have the process Id of "1" (PID of 1). initrd is an "Initial RAM Disk", this space is used by the kernel as a temporary root filesystem. Various drivers are stored here which allow access to your system and partitions.


This is the /etc/inittab which decides on which runlevel to load at boot. There are various runlevels available and each has a specific roll or function if selected. The following are the available runlevels (depending on your system):

Run Level Description
0 Halt the system. Runlevel 0 is used by System Administrators to shutdown the system quickly.
1, s, S Single User Mode, often called Maintenance Mode. In this mode, system services such as network interfaces, web servers, and file sharing are not started. This mode is usually used for interactive filesystem maintenance. The three choices 1, s, and S are all the same.
2 Multiuser Mode. On Debian based systems, this is the default runlevel. On Red Hat based systems this is multiuser mode without NFS file sharing or the X Window System (the graphical user interface).
3 On Red Hat based systems, this is the default multiuser mode, which runs everything except the X Window System. Runlevels 3, 4 and 5 are not usually used on Debian based systems.
4 Not Used.
5 On Red Hat based systems this is the Full multi user mode with login screen. Similar to runlevel 3 with the exception that the X11 Graphical user Interface is started.
6 Reboot the system.

Directories /etc/rc0.d through /etc/rc6.d

The scripts in /etc/init.d are not directly executed by the init process. Instead, each of the directories /etc/rc0.d through /etc/rc6.d contain symbolic links to scripts in the /etc/init.d directory. So when the system is started and a runlevel is selected, the scripts within the relevant directory are executed in strict order. For example, when the init process enters runlevel N, it examines all of the links in the associated rcN.d directory. These links have a special naming convention:

SNNname and KNNname. Here the "S" stands for "start" and the "K" stands for "kill". Each particular runlevel defines a state in which services are running and all others are not running. The "S" prefix is used to mark files for all services that should be running (started). The "K" prefix is used for all other services, which should not be running. The "NN" is a numerical order that is used to depict the sequence in which the scripts should run. The lowest number is executed first and the highest last.

How to determine your current runlevel

If you need to check what your current runlevel is, you can check this quickly by issuing the command "runlevel" or by issuing the command "who -r".

$ runlevel
N 5

$ who -r
         run-level 5  2021-05-08 09:41

The above example indicates that I am currently in runlevel "5" and the letter "N" indicates that there has been no change to the current runlevel since boot.

Switching between runlevels - init and telinit

To switch between runlevels is quite easy providing you are the root user and that you have permission to change to a different runlevel. The "init" or "telinit" command sends a request to the init process to change to a specified runlevel. Generally you would use the init command to shutdown your system, switch to Single User Mode or simply reboot the system. The syntax of the command is as follows:

init n

In the above the "n" refers to the runlevel. For example, to switch to runlevel 3 on a Red Hat based system, we could issue: init 3. To shut our system down we could issue:init 0. To reboot the system, we could issue: init 6. telinit is an alternative command to use instead of init. The syntax for using telinit remains the same as init.


If you are going to initiate a shutdown of your system and there are other users logged in to your system, it is always polite to notify them first. To do this, we would use the shutdown command. The shutdown command will accept times and a broadcast message:

shutdown [options] time [warning_message]

Frequently Used Options with shutdown

-f : Fast boot, skips fsck file checking on reboot.
-h : Halts system after shutdown.
-k : Send pretend Shutdown Warning Message.
-r : Reboot after shutdown.
-F : Force Filesystem checks on the next boot.

shutdown and reboot immediately

# shutdown -r now

Reboot in 5 minutes with message

# shutdown -r +5 System going down Please logoff immediately

shutdown and halt system at 22:00hrs

# shutdown -h 22:00

shutdown and halt immediately

# shutdown -h now