[Nexus 6  General] istperson:
If you extract the files from the MRA58K boot.img this is what you get:

-rw-r--r-- 1 pjt pjt 398 nov 17 16:01 bootimg.cfg
-rw-r--r-- 1 pjt pjt 1125383 nov 17 16:01 initrd.img
-rw-r--r-- 1 pjt pjt 7262647 nov 17 16:01 zImage

The bootimg.cfg is the config file for the kernel, it has the command line parameters for booting it up. The initrd.img is the ramdisk, and the zImage is the kernel itself. So you always change all of these when you flash the boot.img with

fastboot flash boot boot.img

So when you flash a custom kernel, you also flash the ramdisk too. It's inevitable. So if you want to root your Marshmallow rom you need an appropriate kernel that allows it, and if you want to disable force encryption or want to hide the red triangle then you need a changed ramdisk. The contents of the ramdisk usually look like this:

lrwxrwxrwx 1 pjt pjt 13 okt 6 14:33 charger -> /sbin/healthd
drwxrwx--x 2 pjt pjt 4096 okt 6 14:33 data
-rw-r--r-- 1 pjt pjt 660 okt 6 14:33 default.prop
drwxr-xr-x 2 pjt pjt 4096 okt 6 14:33 dev
-rw-r--r-- 1 pjt pjt 21775 okt 6 14:33 file_contexts
-rw-r----- 1 pjt pjt 3533 okt 6 14:33 fstab.shamu
-rwxr-x--- 1 pjt pjt 645848 okt 6 14:33 init
-rwxr-x--- 1 pjt pjt 852 okt 6 14:33 init.environ.rc
-rwxr-x--- 1 pjt pjt 25026 okt 6 14:33 init.rc
-rwxr-x--- 1 pjt pjt 168 okt 6 14:33 init.shamu.diag.rc
-rwxr-x--- 1 pjt pjt 5553 okt 6 14:33 init.shamu.power.rc
-rwxr-x--- 1 pjt pjt 19743 okt 6 14:33 init.shamu.rc
-rwxr-x--- 1 pjt pjt 12391 okt 6 14:33 init.shamu.usb.rc
-rwxr-x--- 1 pjt pjt 1921 okt 6 14:33 init.trace.rc
-rwxr-x--- 1 pjt pjt 3885 okt 6 14:33 init.usb.rc
-rwxr-x--- 1 pjt pjt 301 okt 6 14:33 init.zygote32.rc
drwxr-xr-x 2 pjt pjt 4096 okt 6 14:33 oem
drwxr-xr-x 2 pjt pjt 4096 okt 6 14:33 proc
-rw-r--r-- 1 pjt pjt 3393 okt 6 14:33 property_contexts
drwxr-xr-x 3 pjt pjt 4096 okt 6 14:33 res
drwxr-x--- 2 pjt pjt 4096 okt 6 14:33 sbin
-rw-r--r-- 1 pjt pjt 596 okt 6 14:33 seapp_contexts
-rw-r--r-- 1 pjt pjt 51 okt 6 14:33 selinux_version
-rw-r--r-- 1 pjt pjt 158681 okt 6 14:33 sepolicy
-rw-r--r-- 1 pjt pjt 10031 okt 6 14:33 service_contexts
drwxr-xr-x 2 pjt pjt 4096 okt 6 14:33 sys
drwxr-xr-x 2 pjt pjt 4096 okt 6 14:33 system
-rw-r--r-- 1 pjt pjt 4587 okt 6 14:33 ueventd.rc
-rw-r--r-- 1 pjt pjt 3171 okt 6 14:33 ueventd.shamu.rc
-rw-r--r-- 1 pjt pjt 524 okt 6 14:33 verity_key

Of these the intersting one is the fstab.shamu, that lists all the persistent or known partitions, and the rules to mount them:

# Android fstab file.
# The filesystem that contains the filesystem checker binary (typically /system) cannot
# specify MF_CHECK, and must come before any filesystems that do specify MF_CHECK
#
#<src> <mnt_point> <type> <mnt_flags and options> <fs_mgr_flags>
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 ro,barrier=1 wait,verify=/dev/block/platform/msm_sdcc.1/by-name/metadata
/dev/block/platform/msm_sdcc.1/by-name/userdata /data ext4 rw,nosuid,nodev,noatime,nodiratime,noauto_da_alloc,nobarrier wait,check,formattable,forceencrypt=/dev/block/platform/msm_sdcc.1/by-name/metadata
/dev/block/platform/msm_sdcc.1/by-name/cache /cache ext4 rw,noatime,nosuid,nodev,barrier=1,data=ordered wait,check,formattable
/dev/block/platform/msm_sdcc.1/by-name/modem /firmware ext4 ro,barrier=1,context=u:object_r:firmware_file:s0 wait
/dev/block/platform/msm_sdcc.1/by-name/persist /persist ext4 rw,nosuid,nodev,barrier=1 wait,check,notrim
/dev/block/platform/msm_sdcc.1/by-name/boot /boot emmc defaults defaults
/dev/block/platform/msm_sdcc.1/by-name/recovery /recovery emmc defaults defaults
/dev/block/platform/msm_sdcc.1/by-name/misc /misc emmc defaults defaults
/dev/block/platform/msm_sdcc.1/by-name/modem /modem emmc defaults defaults
/dev/block/platform/msm_sdcc.1/by-name/mdm1m9kefs1 /mdm1m9kefs1 emmc defaults defaults
/dev/block/platform/msm_sdcc.1/by-name/mdm1m9kefs2 /mdm1m9kefs2 emmc defaults defaults
/dev/block/platform/msm_sdcc.1/by-name/mdm1m9kefs3 /mdm1m9kefs3 emmc defaults defaults
/dev/block/platform/msm_sdcc.1/by-name/sbl1 /sbl1 emmc defaults defaults
/dev/block/platform/msm_sdcc.1/by-name/tz /tz emmc defaults defaults
/dev/block/platform/msm_sdcc.1/by-name/rpm /rpm emmc defaults defaults
/dev/block/platform/msm_sdcc.1/by-name/sdi /sdi emmc defaults defaults
/dev/block/platform/msm_sdcc.1/by-name/aboot /aboot emmc defaults defaults
/dev/block/platform/msm_sdcc.1/by-name/versions /versions emmc defaults defaults
/dev/block/platform/msm_sdcc.1/by-name/logo /logo emmc defaults defaults
/dev/block/platform/msm_sdcc.1/by-name/frp /persistent emmc defaults defaults
/devices/*/xhci-hcd.0.auto/usb* auto auto defaults voldmanaged=usb:auto

And of these the cuplrit for force encrypting is is this line wher it says that the partition

"/dev/block/platform/msm_sdcc.1/by-name/userdata", with mount point "/data", and file system "ext4" will be mounted with the following parameters:

rw, nosuid, nodev, noatime, nodiratime, noauto_da_alloc, nobarrier wait, check, formattable, forceencrypt=/dev/block/platform/msm_sdcc.1/by-name/metadata

If you change forceencrypt to encryptable then it won't encrypt it by force.

Similarily if you delete the "verify=/dev/block/platform/msm_sdcc.1/by-name/metadata" part for the system partition then it won't check it for being tampered with, hence no red triangle.

This can be done in ten minutes on a linux machine or virtual machine and it's much safer than to donwload boot images from unknown sources.

Edit: When building AOSP the fstab.shamu is in device/moto/shamu/