GRUB, the GNU bootloader, is the program that starts a Linux system before the kernel takes over. It loads the selected kernel, passes boot options, and hands control to the operating system. Because it runs very early, GRUB is a critical part of the boot chain and a common target for attackers who want to alter startup behavior or intercept secrets.
In cyber security, GRUB matters because secure boot and measured boot often use it as a trust checkpoint. If a TPM policy measures GRUB but not later stages such as the kernel or initramfs, an attacker may change those unmeasured components while still satisfying the TPM’s key-release rules. Defenders therefore treat GRUB as one link in a longer chain: it should be verified, measured, and paired with policies that cover every boot stage that can affect disk unlock or system integrity.