How can I boot Linux from the grub> prompt, as if I were booting from cold?

I have full disk encryption. When I fat-finger the encryption password, it bumps me to grub rescue (bonus points if you can tell me how to have it give 2 attempts to enter the password ... :) ) From here, I can unlock the disk (cryptomount hdX,gpt1).

After doing this (demonstrating keyboard is working, I'm typing the correct key, not asleep, etc) - I just want to boot the system, with the Linux argument line as normal. The system has no issues, obviously, so this will work (I had just fat-fingered the passphrase).

As it may be necessary in order to disambiguate what my system does, here is the first entry from my grub.cfg

menuentry 'Ubuntu' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-320f<GUID...>' {
        gfxmode $linux_gfx_mode
        insmod gzio
        if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
        insmod part_gpt
        insmod cryptodisk
        insmod luks
        insmod gcry_rijndael
        insmod gcry_rijndael
        insmod gcry_sha256
        insmod ext2
        cryptomount -u b6b7<32_char_part_id>
        set root='cryptouuid/b6b7<32_char_part_id>'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root --hint='cryptouuid/b6b7<32_char_part_id>'  76f4<GUID...>
          search --no-floppy --fs-uuid --set=root 76f4<GUID...>
        linux   /vmlinuz-5.15.0-84-generic root=/dev/mapper/ubuntu--vg-root ro rootflags=subvol=@  quiet splash $vt_handoff
        initrd  /initrd.img-5.15.0-84-generic

2 Answers 2


The command normal should return to the menu. You should probably do this before manually unlocking the volume, as it's likely not smart enough to "resume" – it'll only you reinvoke the whole menu item (all or nothing).

There's no direct "just boot" command as the OS kernel hasn't been loaded yet at this point (it would've been the subsequent command in the menu item), so the only alternative is to manually load the kernel and initramfs using the same commands as the menu item has.

I'd probably avoid encrypting the /boot filesystem in general – let the initramfs prompt for the / password instead. If you can ensure that GRUB itself hasn't been tampered with, you can use the same method to ensure the kernel and initramfs haven't been tampered with, without necessarily having to encrypt them.

  • 1
    If you don't encrypt /boot then you should digitally sign or TPM measure the kernel, initramfs and your grub config as well. Neither option is particularly easy. Though it depends what threats you are protecting against with encryption I guess. Sep 22 at 7:20
  • Normal does not seem to do ... anything? At this point I have not successfully decrypted my drive, so about the only thing that could meaningfully be next is to prompt with the decryption ID. TWO steps is OK, as I stated I can cryptomount the correct partition (since that hdX,gpt1 is displayed for several seconds before I get dumped into grub) as step (1), then step (2) needs to be a pretty straightforward way to get boot either going, or get me into menus that prompt for choices (I'm not a grub expert, I might not have a 2nd PC handy, etc ...) Sep 23 at 3:25

The grub command prompt and grub configuration language are both basically the same.

The simple way you can find out how to do this will be to read the menuenry {} from the file /boot/grub/grub.cfg. There's one command hiding named boot which is implied by the menuentry.

On many / most systems you can use:

linux (hdX,gptY)/boot/vmlinuz_kernel_file root=root_fs_device
initrd (hdX,gptY)/boot/initramfs_file

The other trick you can use us to call configfile to execute your grub.cfg file again as it's own script. This should display the menu you usually use.

configfile (hdX,gptY)/boot/grub.cfg

Note there are commands that can help you find the placeholders above:

search let's you find a partition by label or UUID

ls let's you list partitions or files on a partition. To list files on a partition Y on device X you would use ls (hdX,gptY)/ or ls (hdX,gptY)/bar/ to list directory "bar".

cat lets you read a file, so may be useful for reading your grub.cfg if you don't have a note of what it says.

  • Hi, thanks for your reply, you clearly put some time into the contribution. Perhaps it's because I'm obviously a grub novice, I don't see how it answers my question? Now booted into my system, I'm trying to parse what you're saying, and without either some simplification (or more details), I don't follow. Each menuentry for me is ~20 lines including a bunch of insmod, a cryptomount (with ~25char hex ID), set root, etc and finally ending with my linux command line (which has a different syntax from yours, starting with /vmlinux.... Definitely NOT stuff I could transcribe in grub Sep 23 at 3:16
  • I've added a menuconfig entry; assuming all that is needed, it seems like WAY too much to type manually; is that what configfile does, and then I can just boot? If so, please edit your answer to make that clear, thanks! Sep 23 at 3:26
  • @somebitsflipped I'll try to clarify my answer when I get a moment. You say in your question that you have already used cryptmount to unlock the boot drive... so one suggestion here is just use "configfile" command to load the menu on screen (it should just work). The other suggestion is you boot manually as you asked in the question. You may only need three lines: "Linux" "initrd" and "boot" commands but the tricky part is working out the rest of each line. Other lines in the menu entry will set variables which are then used with "$". Insmod loads new commands into grub. Sep 23 at 6:22
  • I just hit this for the bazillionth time; it's late, I apparently can't type, and I swear my keyboard is dropping keystrokes ... but I end up in grub, stuck. Reading this from my laptop, I tried to follow and failed. (1) on boot, I'm prompted (and fail) to decrypt hd6,gpt1. Then in grub, I (successfully) cryptomount hd6,gpt1 and it says something about unlocking slot 0. But then running ls (hd6,gpt1) and it says (roughly) no known filesystem :(. hard-rebooting about 3 more times - I'm booted to ubuntu now ... Nov 15 at 2:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .