Kernel command line and UKI; systemd-stub and the ‘stubby’ alternative

https://media.ccc.de/v/all-systems-go...



Modification of the kernel command line has historically been one of the easiest ways to customize system behavior. Bootloaders allow for persistent changes via config-files and on-the-fly changes interactively during system boot.

System behavior changes made via the kernel command line are not limited to the kernel itself. Userspace applications from installers to init systems and beyond also take input from /proc/cmdline.

It is clear that some kernel command line options are desirable (console=ttyS0 verbose) and possibly even necessary. Others, such as the cromulent 'init=/bin/sh', can allow circumvention of benefits that Secureboot and TPM provide.
How to control access to kernel command line modification is a non-trivial subject. A recent pull request to systemd that added "command-line addons" garnered hundreds of comments.

This talk will cover:
The stub loader 'stubby' and its allowed-list approach to kernel command line options.
Systemd-stub’s solution for command line customization
System changes that can be made through kernel command line.
Alternative channels such as smbios oem strings, or qemu 'fw_cfg'



Scott Moser

https://cfp.all-systems-go.io/all-sys...

#asg2023