Why does Linux allow ‘init=/bin/bash’?

I read this, answers are saying it's KERNEL running this init program.

Then I started to wonder, Linux usually comes with a initramfs, which will eventually mount and pivot_root to real root filesystem. So what does this init argument mean? The path in the initramfs? Or like I guessed, it's not read by the kernel but by init of initramfs to exec the real init.

Also, the root=UUID=xxxx argument, is that really read by kernel or just by init of initramfs to find the real root filesystem?

It seems like I can pass any argument I want as kernel arguments, so are they all read by the kernel or at least some of them are only meaningful to userspace programs?

2 Answers 2


Parameters passed on the kernel command line don’t have to be meaningful for the kernel: the kernel parameters documentation says

The kernel parses parameters from the kernel command line up to “--”; if it doesn’t recognize a parameter and it doesn’t contain a ‘.’, the parameter gets passed to init: parameters with ‘=’ go into init’s environment, others are passed as command line arguments to init. Everything after “--” is passed as an argument to init.

This doesn’t apply to init and root which really are kernel parameters, and are handled by the kernel. They can also be acted upon by user-space, since they appear in /proc/cmdline. (Thus for example systemd takes the quiet kernel parameter into account to reduce its output.)

When the kernel is booted with an initramfs, the root parameter isn’t used by the kernel directly, and the init parameter is only used if rdinit fails. init startup is handled in kernel_init, which works as follows:

  • if there’s a “ramdisk execute command” (either the value given to rdinit on the kernel command line, or /init) which is accessible, the kernel attempts to run that;
  • if that fails, and there’s an “execute command” (the value given to init on the kernel command line), the kernel attempts to run that, and panics if it can’t;
  • as a last resort, the kernel tries to run /sbin/init, /etc/init, /bin/init, and /bin/sh; if none of those can be run, it panics.

When there’s an initramfs, all of this happens there, and the target volume isn’t mounted by the kernel. What happens after the kernel runs the first init program (typically, the /init script in the initramfs) is up to the program, not the kernel. Arguments which aren’t passed to init are still available in /proc/cmdline if the /proc file system is mounted.

  • Also a little curious, what if init-in-the-initramfs is a set-uid-non-root file? A file without executable bit? Will it be run as root anyway? What if it's broken ELF or can't find ld-linux.so ELF or recursion-too-deep script or anything just can't be execve? Commented Oct 4, 2018 at 14:58
  • 3
    I'm pretty sure the kernel doesn't load the program specified in "init=" from the initramfs. It an initramfs is in use then it seems to run as normal before the user-specified init program is run (not sure if it's the kernel that does this or code in the initramfs).
    – plugwash
    Commented Oct 4, 2018 at 15:31
  • @炸鱼薯条德里克 To specify an alternate program instead of /init when booting from a ramdisk, you can use the rdinit=/path/to boot parameter.
    – user313992
    Commented Jun 23, 2019 at 4:40

Passing custom kernel arguments is one way to customize a system during a KickStart install, for example a PXE server could set:

linuxefi /c7/vmlinuz ks=http://.../ks/c7 lab ksdevice=eth0 net.ifnames=0 biosdevname=0

where lab is then used in the KickStart configuration to do different things than for other system builds:

case " $(cat /proc/cmdline)" in
   *\ lab*)

Here to setup a different filesystem layout than used on other system types. Hopefully different labels are used for local customizations than are used by the kernel, given the single namespace involved.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .