The GRUB and MBR
This is not just a competition to see how many acronyms we can fit into a chapter heading, although, out of four words, having used two already is not a bad start. The GRUB is the system-supplied bootloader that ships with CentOS and Red Hat Enterprise Linux 6. This tiny piece of bootstrap code is used to load the kernel and allows us to dual boot different Linux versions or even with Microsoft Windows operating systems. The GRUB has been the bootloader of choice for many years, although other bootloaders do exist. These include:
- Lilo: This is the original Linux loader
- EXTLinux: This is part of the SYSLinux family that includes the following:
- EXTLinux to boot from fixed drives
- ISOLinux to boot from CDs and DVDs
- SYSLinux to boot from a USB device
- PXELinux to boot from the network
- GRUB2: More recently, this is making its appearance as a replacement to GRUB, or what is now referred to as the legacy GRUB. GRUB2 is likely to debut in CentOS 7 in 2014.
The GRUB bootloader is most commonly stored in the MBR of the bootable drive.
Tip
Although generally stored within the MBR, it is possible to install GRUB into the superblock, or the first 512 bytes, of a partition.
The MBR makes up the first 512 bytes of the disk, allowing up to 466 bytes of storage for the bootloader; the additional space will be used to store the partition table for that drive.
We can back up the MBR to a file using the dd command as follows:
# dd if=/dev/sda of=/tmp/sda.mbr count=1 bs=512
The dd command is used to duplicate a disk. In the previous command, we read from the first disk, /dev/sda, and backed it up to the /tmp/sda.mbr file. Rather than duplicating the entire disk, we limit the backup to a count of one block of 512 bytes.
Now that we have a backup for the MBR, we can investigate this fact a little more by running the following command:
Tip
The following commands can be destructive, in that they will destroy the MBR, so please take care if you will be running commands on your own system, and I would recommend running only the following demonstration commands on a test system.
# dd if=/dev/zero of=/dev/sda count=1 bs=512
With the preceding command, we have wiped the data stored within the first 512 bytes of the disk /dev/sda. The MBR now is effectively cleared. We can verify this by using the following command:
$ lsblk /dev/sda
The output should display an empty partition table. The system remains usable as the partition table is resident to the RAM on the running system; however, until we are able to restore the MBR, a reboot will soon identify how much of a disaster we are in. Never fear, we can restore the MBR from the backup. What dd takes away, dd can return, simply by using the dd command as follows. Quickly, before someone notices!
# dd if=/tmp/sda.mbr of=/dev/sda
We do not need to limit the amount of data to be read from the specified file. Remember, it only contains the 512 bytes that make up the MBR. With a little luck, using the fdisk command will now show the partition table correctly as it was before, and you can begin to breathe easy again:
$ fdisk /dev/sda
Tip
Using the dd command to wipe a disk completely with the /dev/zero input file is useful should you wish to wipe a disk before selling a computer, ensuring that the operating system, applications, and most importantly, the data is not sold with the device. We use fdisk in the second example as lsblk reads from memory and not the disk.
Once we have booted into GRUB, a menu will be shown allowing the user to select the operating system (OS) to enter. In general, the default selection is loaded without user interaction. We can configure the menu choices using the /boot/grub/menu.lst file. You will learn more about this file later.