Why in kernel boot parameters there is security= without parameters?

English Install/Boot/Login
21

I just use a profile to install packages, you can even just use profile parts and then finish off with the browser interface…

{
  "bootloader": {
    "timeout": 1,
    "extraKernelParams": "security=apparmor intel_iommu=on intel_pstate=passive"
  },
  "hostname": {
    "static": "build-server",
    "hostname": "build-server"
  },
  "localization": {
    "locale": "en_US.UTF-8",
    "keymap": "us",
    "timezone": "America/Chicago"
  },
  "product": {
    "id": "openSUSE_Leap"
  },
  "software": {
    "patterns": [ "apparmor" ],
    "packages": [ "btop", "fastfetch", "inxi", "gptfdisk" ],
    "remove": [ "*plymouth*", "*libply*" ]
  }
1 Like
22

I used different systems, first opensuse-migration-tool
second install stick 16.0
third agama installer
no advice I received

23

My post was hidden as inappropriate, but I’m sure the relevant “I added things” quote was included. So far this has meant that you add home: repos.

24

Thanks Malcolm … I copied your sample profile and saved it for future installs (with some modifications of course) :+1:

25

@myswtest I add a root user and standard user as well as the ssh keys etc… You can add any patterns, packages etc… I also do this https://agama-project.github.io/docs/devel/live_iso#injecting-the-default-password-into-the-iso-image

1 Like
26

not, only patterns, selinux things, cockpit things and other things from myrlyn menu

27

manythanks, I have to understand many things about profiles but I saved your example

28

This should give you a reliable, stable system and when support is needed something that those who try to help can relate to.

And, last but by far not least: Do not do first when in doubt, but ask.

29

manythanks, I followed that instuctions and selinux seems to work
about errors this is the output

pla@plaST-slowroll:~> sudo ausearch -m avc,user_avc,selinux_err,user_selinux_err -ts boot
[sudo] password for root: 
----
time->Thu Sep  3 10:55:15 2026
type=USER_AVC msg=audit(1788425715.705:145): pid=894 uid=496 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for  scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:system_r:powerprofiles_t:s0 tclass=dbus permissive=1 exe="/usr/bin/dbus-broker" sauid=496 hostname=? addr=? terminal=?'
pla@plaST-slowroll:~>

is this ok??

30

I wold like to avoid th reinstall, for now I remain with this system that seems to work, the spare system I’ll follow your suggestion

31

I don’t think so.

But before you report a bug do

touch /.autorelabel

followed by a restart of your system (this will relable all files in your system so it can take quite long esp. if your system has many rotating disks).

After that try

ausearch -m avc,user_avc,selinux_err,user_selinux_err -ts boot

again and if the error persists you should file a bugreport.

32

manythanks, it seems no error, correct?

pla@plaST-slowroll:~> sudo ausearch -m avc,user_avc,selinux_err,user_selinux_err -ts boot
[sudo] password for root: 
<no matches>
pla@plaST-slowroll:~>
33

Yes. Looks fine to me.

If you have not done so already you can now switch SELinux to enforcing.

To do so you edit the file /etc/selinux/config and change

SELINUX=permissive

to

SELINUX=enforcing

save the file and restart your system.

2 Likes
34

I did and it seems that everything go well manythanks