Why in kernel boot parameters there is security= without parameters?

English Install/Boot/Login
1

on my laptops I installed slowroll with KDE and noted that in kernel boot parameters there is security=without anything after “=”
why this? what it is for? is it correct?

pla@plaST-slowroll:~> sudo update-bootloader --default-settings
[sudo] password for root: 
kernel=/boot/opensuse-slowroll/7.1.8-1.0.8.sr20260802-default/linux-39e5f3d517ecf96edf293d599c01481c1d137016
initrd=/boot/opensuse-slowroll/7.1.8-1.0.8.sr20260802-default/initrd-69b7e63d2bfb6a8ec2ba632b85bd0a2002a95182
append="root=/dev/nvme0n1p4 mitigations=auto security= ia32_emulation=1 mem_sleep_default=deep plymouth.enable=0"
pla@plaST-slowroll:~>
1 Like
2

Having no value means that it will use the default, built-in security modules.

My understanding is that the parameter is deprecated, replaced by lsm= instead, which allows for multiple Linux Security Modules to be specified.

You can see what your system is using by running cat /sys/kernel/security/lsm.

2 Likes
3

That is not how I understood it. I asked how I could turn off apparmor, the maintainer said I sould put that kernel parameter. For activating selinux add that, for moving back to apparmor add that.

4

@hendersj , asked around a bit. On https://www.kernel.org/doc/html/v4.20/admin-guide/LSM/index.html it says:

The Linux Security Module (LSM) framework provides a mechanism for various security checks to be hooked by new kernel extensions. The name “module” is a bit of a misnomer since these extensions are not actually loadable kernel modules. Instead, they are selectable at build-time via CONFIG_DEFAULT_SECURITY and can be overridden at boot-time via the “security=…” kernel command line argument, in the case where multiple LSMs were built into a given kernel.

This means that security= with no “module” results in no LSM being activated. I guess this btw is indeed a thing in newer kernels

5

https://www.kernel.org/doc/html/latest/admin-guide/kernel-parameters.html tells a different story:

    security=       [SECURITY] Choose a legacy "major" security module to
                    enable at boot. This has been deprecated by the
                    "lsm=" parameter.

As well as:

   lsm=lsm1,...,lsmN
                   [SECURITY] Choose order of LSM initialization. This
                   overrides CONFIG_LSM, and the "security=" parameter.

While this set of documentation is “latest” (currently 7.3.0-rc1), this text is the same in the 7.1 documentation tree (I’m running 7.1.8 here still).

But the bit that you quoted:

says pretty clearly that “security=” overrides what’s set at build-time. Logically, if there’s a build-time defined value, then security= as the parameter would just not override what’s set at build-time. Looking at the current Kconfig, it seems that CONFIG_DEFAULT_SECURITY has itself been superseded by a series of bools, and on my main system, the security setting at build time is set as CONFIG_DEFAULT_SECURITY_APPARMOR=y (from zcat /proc/config.gz | grep CONFIG_DEFAULT_SECURITY)

So that behavior might be different now.

2 Likes
6

/me Learned today not to dive into kernel stuff. The browser history is flooded with kernel related pages :rofl:

3 Likes
7

my system says:

pla@plaST-slowroll:~> cat /sys/kernel/security/lsm
lockdown,capability,landlock,yama,bpf,ima,evmpla@plaST-slowroll:~>

I supposed that was related to selinux or apparmor, am I use selinux or apparmor?

8

I don’t know how to test for apparmor but sestatus tells you about SELinux:

> sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      35
>
9

For AppArmor…
sudo aa-status
…and the service unit…
systemctl status apparmor

10 
pla@plaST-slowroll:~> sestatus
SELinux status:                 disabled
pla@plaST-slowroll:~> systemctl status apparmor
Unit apparmor.service could not be found.
pla@plaST-slowroll:~> sudo aa-status
[sudo] password for root: 
sudo: aa-status: command not found
pla@plaST-slowroll:~>

so it means that slowroll disable selinux as default??
is it ok?
I remember that leap 16.0 was enabled

11

No, it only means that this is no clean Slowroll installation but an upgrade from Leap 16.0 without known condition of the Leap system prior upgrade.

12

no, the upgrade failed, it is a clean slowroll installation via amaga installer, on both laptops.
how can I have a working selinux?

13

Seems you haven’t enabled either of them (?)

Even on my Leap 15.6 system, it shows what I’m using :

myswtest@machine :~>  cat /sys/kernel/security/lsm
lockdown,capability,apparmor,bpf
myswtest@machine :~>

(16.1 also shows apparmor)

14

You may want to read the documentation which knurpht cited.

No, cat /sys/kernel/security/lsm does not show which LSM you are actually using as it is overriden by the kernel command line parameter “security=xxxx”.

In case of Leap 15.6 the kernel command line parameter is security=apparmor.
In case of Leap 16.0 and 16.1 the kernel command line parameter is security=selinux.

You may also want to read the Leap 16.x release notes, which explain that Selinux is the new default LSM for new installations starting from SLE 16 onwards. You cannot even choose AppArmor in the Leap 16.x installer. You need to manually switch to AppArmor after initial installation of the system when you want that.

The only reliable way to find out which LSM is running is to use sestatus and aa-status command.

1 Like
15
  1. I know that … while in Agama during installation, I disabled (removed the checkmark) the “SELinux” option.
  2. After installation was completed, I enabled AppArmor.
16

Have a look here:

Setup SELinux on new Tumbleweed installations

It is for openSUSE Tumbleweed but it might apply to Slowroll as well.

17

That made me curious… And yes, i found why no LSM module is enabled/installed on your box.

You used the upstream Agama Live ISO (which is unfortunately linked on the Slowroll Wiki portal…). The Agama Live ISO is kind of an experimental ISO to test Agama.
The Live ISO does not contain the full set of packages of an usual openSUSE provided ISO. Even if the box is connected to the internet whilst installation, it does not pull or provide missing software patterns.

When you use the Agama live ISO there is a completely reduced set of available desktop environments (even less than for Leap 16.x). Also all other patterns like LSM, Cockpit or anything else is completely missing from the Agama Live ISO installer.
This leads to a kind of funky installation with many usual packages and patterns missing. Sure you can install them later on when you have setup your system initially and you are aware that you are using an incomplete installation. But normal users like you will wonder why stuff like you found does not work out of the box.

Conclusion:

  • ONLY use the Agama Live ISO when you want to test the newest Agama development snapshot.
  • Do NOT use it for standard system installation unless you know what you are doing.
  • Use the openSUSE provided ISO instead to install openSUSE products when you are no developer but normal user
1 Like
18

I removed the Agama Live ISO link from the Slowroll wiki portal to prevent broken installations for unaware users.

1 Like
19

I don’t remember well, (I tried to upgrade and failed then tried to install 16.0 and failed again so I found slowroll that worked) but in the usb stick the name is this
Install-openSUSE-x86_64/
and it contains:

pla@plaST-slowroll:/media/Install-openSUSE-x86_64> ls
boot  EFI  LiveOS
pla@plaST-slowroll:/media/Install-openSUSE-x86_64>

I thought it was an online installer
and it allow to install slowroll, tumbleweed and micro

I added many things after installation, but now is it possible to make my system as it was installed with the correct ISO ??
without reinstalling the whole system of course