2023-09-14, 11:30–11:55 (Europe/Berlin), Main Hall
Modification of the kernel command line has historically been one of the easiest ways to customize system behavior. Bootloaders allow for persistent changes via config-files and on-the-fly changes interactively during system boot.
System behavior changes made via the kernel command line are not limited to the kernel itself. Userspace applications from installers to init systems and beyond also take input from /proc/cmdline.
It is clear that some kernel command line options are desirable (console=ttyS0 verbose) and possibly even necessary. Others, such as the cromulent 'init=/bin/sh', can allow circumvention of benefits that Secureboot and TPM provide.
How to control access to kernel command line modification is a non-trivial subject. A recent pull request to systemd that added "command-line addons" garnered hundreds of comments.
This talk will cover:
* The stub loader 'stubby' and its allowed-list approach to kernel command line options.
* Systemd-stub’s solution for command line customization
* System changes that can be made through kernel command line.
* Alternative channels such as smbios oem strings, or qemu 'fw_cfg'
Scott Moser is a software engineer for Cisco Systems. He has worked in software development on linux for more than 20 years. He and his team at Cisco work on an image-based linux for managing containers. He has an amazing large family that occupies most of his free time.
Please feel free to reach out to smoser on github.com.