What is the bootloader?

The bootloader is the first program that runs when the phone powers on. It initialises the hardware, then checks the operating system before handing over control to it.

Manufacturers ship devices with a locked bootloader: only firmware signed by a key the device trusts can boot.

Verified Boot

Verified Boot is the check the bootloader performs. It enforces a chain of trust from the bootloader up to the system partition, so any modified or corrupted image is detected before it runs.

With a locked bootloader, a failed check stops the boot. With an unlocked bootloader, the check is bypassed.

Unlocking

Unlocking the bootloader is what makes installing /e/OS possible. It also has a cost:

  • Verified Boot is no longer enforced, any image can be flashed and booted
  • disk encryption is less strongly tied to the integrity of the system
  • unlocking triggers a factory reset (all data is wiped)
  • some apps refuse to run on an unlocked device

Relocking

Relocking puts the device back under Verified Boot, this time trusting the /e/OS signing key. The device boots /e/OS and nothing else, and a tampered system image stops the boot.

Relocking also wipes the device.

Locked vs unlocked

  Locked Unlocked
Verified Boot Enforced Bypassed
Flashing another OS Refused Allowed
Modified system image Blocked at boot Boots
Encryption keys Tied to system integrity Weaker guarantees
Persistent malware Low risk Can survive a reboot
Changing the state Factory reset Factory reset

An unlocked bootloader is not a remote vulnerability by itself. It requires physical access to be exploited. What it changes is the outcome of a compromise: an attacker who already gained a foothold can install something that survives reboots and factory resets.

Relocking on /e/OS

Warning: Relock the bootloader on official builds only. Community builds are not signed with the /e/OS release key and relocking them leaves the device unable to boot.
Warning: Relocking factory resets the device. Back up your data first.

Relocking is not possible on every device, it depends on what the manufacturer allows. Check the Bootloader field on your device page, it reads either lockable or not lockable.

When the device supports it, the commands are in the Locking the bootloader section at the end of its installation guide.

What relocking does not fix

Relocking restores Verified Boot, it does not restore Google’s device certification. Apps gated on Play Integrity or hardware attestation (banking, payment, some streaming apps) keep failing on a relocked /e/OS device, because the device is signed with the /e/OS key rather than the manufacturer one.