The Linux Boot Process

A Brief History Of Unix

The Unix OS which Linux is based on, was derived from AT&T's "Sys V" (System 5) Unix. The init process is designed to control the startup and shutdown of system services, or "daemons" and allows for different startup configurations or "run levels."

There are some Linux distributions (Slackware) which use the BSD init process which was developed at the Berkeley University. Sys V systems use a much more complex set of command files and directories of command files to determine what services are available at different run levels than the BSD init process.

The information provided here applies only to distributions which use the "System V" init, such as Mandrake, RedHat, SuSE, Caldera, etc.....

Booting Linux-Unix

The first thing a computer does when it starts up is to conduct a basic self test to determine things such as how much memory it has, what drives it has, whether a keyboard and mouse are present, etc. After completing the self-test, the system reads a block of information from the device it is booting from, which is usually your hard disk.

The boot block is always found at the same location track 0, cylinder 0, and head 0 of the device the system is booting from. You can modify the settings of your computer's "Basic Input Output System" (BIOS).

The boot block contains a program loader usually LILO or Grub, which are programs that Linux systems typically use to give users a choice of operating systems to run. For the rest of this document I'll use LILO for example. It is usually installed in the boot sector which is also called the master boot record (MBR).

If the user chooses to boot Linux, LILO will attempt to load the Linux kernel. Here is a brief description of what happens:

1) LILO will have a time-out period for the user to press the TAB key. If the user does not press the TAB key before the time-out occurs, LILO will run the default operating system selected when it was installed. If the user presses the TAB key, LILO will present the user with a choice of systems to boot from based upon the labels and images as set up in the /etc/LILO.conf. This is very significant to system administrators. Let's say you have or want to install a multiple boot Linux or Linux/Windows system. Assuming you want LILO to control the boot process and you have two versions of Linux.

2) The Linux kernel is installed compressed and contains a small program to decompress itself, it will then uncompress itself.

3) If the kernel recognizes that the system has a video card which supports some special text modes (such as 100 columns by 40 rows), Linux may ask which mode to use. The video mode and other options can be specified either during the kernel compilation or with LILO or the rdev program. Therefore the video mode can be preset, so the user is never asked.

4) The kernel checks the hardware (hard disks, floppies, network adapters, etc), and configures some of its device drivers, while outputting messages about its findings.

5) The kernel will attempt to mount the root filesystem. The location of the filesystem is configurable at compilation time, with the rdev program, or with LILO. The filesystem type is detected automatically. If mounting the root filesystem fails, the kernel will panic and halt the system. The root filesystem is usually mounted read-only so that the filesystem can be checked while it is mounted. This feature can also be modified using the rdev program. It is not advised to check a filesystem already mounted as read-write.

6) The kernel starts the program "init" which becomes process number 1. Init will start the rest of the system.

The INIT Process

The first process is known as the init (initialization) process; it is the parent of all other processes on a Unix/Linux system. The init process is the first process to be run on any Linux-Unix system, it is spawned by the kernel as it boots up. It is given the process number 0; it then proceeds to ultimately spawn all of the other processes that are available on your system.

The /etc/inittab File

Once your system has found an operating system that it can boot and has loaded that operating system, it starts the init process, which first examines the file /etc/inittab (Init Table) to determine what to do next. The "/etc/inittab" file tells init which run level to start the system at and describes the processes to be run at each run level ( See "Explanation Of Linux-Unix Run Levels" below).

Next, the init process finds the line with the action sysinit (system initialization) and executes the command file identified in that line, in this case /etc/rc.d/rc.sysinit. After executing the /etc/rc. d/rc.sysinit script, the init process will then begin to execute the commands associated with the default run level.

The next few lines in the /etc/inittab file are specific to different run levels. Each of these lines runs a single script (/etc/rc.d/rc) which takes a number from 1-6 as an argument that tells it which run level the system wishes to enter. The most common action for these run-level specific entries in the /etc/inittab file is wait, which means that the init process executes the command file for the specified run level and then waits for that run level to terminate.

The /etc/rc.d/rc.sysinit File

The command that is identified in the system initialization entry in /etc/inittab is executed only once by the init process each time your system boots. In general, this script runs a bunch of commands that perform the following tasks:

1) Determines if your system is on a network based on the contents of the file /etc/sysconfig/network.

2) Mounts the /proc file system used internally by Linux to track the status of various processes on your system.

3) Sets the Linux system clock based on the settings your BIOS and the time zone and other settings you identified when you installed Linux.

4) Starts virtual memory on your system by activating any swap partitions identified in your /etc/fstab (File System table) file.

5) Sets your system's host name for networking and system wide authentication mechanisms, such as NIS (the Network Information Service, also known as the Yellow Pages to graying system administrators), NIS + (an enhanced version of NIS), and so on.

6) Checks the root file system for your system for serious problems and mounts it if no problems were found.

7) Checks the other file systems identified in your /etc/fstab file, as appropriate.

8) Identifies any special routines that may be required for the operating system to use the hardware in your computer, configures any older plug-and-play devices that may be attached, and activates other basic system services, such as sound.

9) Checks the status of any specialized disk devices you may be using, such as RAID (Redundant Array of Inexpensive Disks) drives.

10) Mounts all of the file systems identified in your /etc/fstab.

11) Performs various other system accounting tasks.

The /etc/rc.d/init.d Directory

The /etc/rc.d/init.d directory contains all of the command files that actually start and stop the services that are associated with all of the run levels, the rc stands for "Run Command".

All of the command files in the /etc/rc.d/init.d directory have short names that are descriptive of the services with which they are associated. For example, the file /etc/rc.d/init.d/amd starts and stops the automount daemon, which mounts NFS hosts and devices whenever required.

The scripts in /etc/rc.d/init.d start or stop the services that they are associated with based on the specific arguments with which they are called. For example, the start command starts the automount daemon, while the /etc/rc.d/init.d/amd stop command stops the automount daemon. Some of these command files accept other arguments, such as restart or status.

The restart command-line argument terminates any processes associated with that command file and then starts the service over again. The status command line argument lists any processes associated with that command file, and then exits without changing anything.

Logging In

After the init process has executed all of the commands, files, and scripts, the last few processes it starts are /sbin/mingetty processes which display the banner and login message on your monitor. The system is now up and running and ready for you to log on.

Explanation Of Linux-Unix Run Levels

Run levels represent the mode in which your computer is operating. They are defined by the set of network and system services available on a system at any given time. Run levels are merely different ways that your Linux system makes itself available to you as both a user and as an administrator.

As a user you wouldn't normally be aware of run levels, but the multi-user run levels make available the services you would expect to find when using a Linux system printing, networking, and other high-level services.

As an administrator, the single-user run levels let you add or modify hardware, disable existing services or add new ones, change the order in which services start and so on, without having to worry that a user will log onto the system while you're working on it.

Here is a list of the 6 Run Levels:

0: Halt (Shuts down the system and turns it off, when possible)

1: Also known as "Single user mode," the system is running a minimal set of daemons. The root filesystem is mounted read only. This run level is commonly used when any other run level fails to properly boot the system.

2: Most services are running, with the exception of the network services (httpd, nfs, named, etc.) This run level is useful for troubleshooting network services, and maintaining shared filesystems.

3: Full multi-user mode, with networking support.

4: Unused on most distributions. On some systems such as Slackware, run level 4 is equivalent to run level 3 with graphical logon enabled.

5: Full multi-user user mode with an XII graphical login

6: Reboot. Terminates all running processes and reboots the system to its default run level.

Changing Run levels

One of the key features of the init process, and perhaps the most confusing, is it's ability to move from one run level to another.

The system boots to the run level specified in /etc/inittab, or the run level given at the LILO prompt. To change to another run level, use the init command. For instance to change to run level 3 you would use:

init 3

This would stop most services, and bring the system into full multi-user mode, with networking support. Be careful when changing run levels to avoid killing a daemon you are currently using. For instance changing to run level 1 will stop networking, and disconnect all users!

The Run level Directories

Each run level has a directory of symbolic links pointing to corresponding scripts in the init.d directory. These directories are usually:


The names of the symbolic links found in these directories are significant. They specify which services should be started, or stopped, and when.

Links beginning with a capital "S" are to be started, whenever the system is entering the given run level. Links beginning with a capital "K" are to be stopped whenever leaving that run level.

As the scripts are executed in the order listed, each symbolic link has a number at the beginning of it's name.

Here's a sample of some of the links in /etc/rc.d/rc2.d:

K20nfs -> ../init.d/nfs
K50inet -> ../init.d/inet
S60lpd -> ../init.d/lpd
S80sendmail -> ../init.d/sendmail

When the system changes run levels, init will compare the kill list (links beginning with "K") in the current run level directory, against the start list (links beginning with "S") found in the destination directory. It will then determine which daemons should be started or stopped accordingly.


When the system boots to run level 3 it will execute all "S" entries in the order listed:

/etc/rc.d/rc3.d/S60lpd start
/etc/rc.d/rc3.d/S80sendmail start
(and so on...)

If the system is to change to run level 1 it will execute:

/etc/rc.d/rc3.d/K20nfs stop
/etc/rc.d/rc3.d/K50inet stop
(assuming nfs and inet do not have start entries in /etc/rc.d/rc1.d )

It will then process any start entries in /etc/rc.d/rc1.d which are not currently running. In this case there is only one:


Here are some practical examples of using init, and the run levels on your system, as usual, the following commands must be run as root. Please exercise caution as many of these commands could make your system unusable.

Changing the default run level

To change the default run level to run level 3, open /etc/inittab in a text editor, and edit the following line:


( Do NOT set the default run level to either 0, or 6)

Booting to an alternative run level

At the LILO prompt enter the desired run level before the system boots, for example, to boot to run level 3 type:

linux 3

Removing a service from a run level

To disable a service in a run level, you can simply remove (or rename) its symbolic link from that run levels directory. For example, to disable pcmcia from starting in run level 3:

rm /etc/rc.d/rc3.d/S45pcmcia

Adding a service to a run level

To add a service to a run level, you need to create a symbolic link pointing to that service's script in the init.d directory. When creating the link, be sure to number it so that the service is started at an appropriate time. If the service you're adding requires networking, be sure to assign your new service a number higher than networking, to ensure it will start after the networking scripts have been executed.

To add "lpd" to run level 3, you would use:

ln -s /etc/rc.d/init.d/lpd /etc/rc.d/rc3.d/S64lpd

For more information on some of the topics covered here, open a console and type:

man ln
man init
man chkconfig
man inittab
man lilo
man lilo.conf
man shutdown