BROADCASTS.com

Modification of the kernel command line has historically been one of the easiest ways to customize system behavior. Bootloaders allow for persistent changes via config-files and on-the-fly changes interactively during system boot.\n\nSystem behavior changes made via the kernel command line are not limited to the kernel itself. Userspace applications from installers to init systems and beyond also take input from /proc/cmdline.\n\nIt is clear that some kernel command line options are desirable (console=ttyS0 verbose) and possibly even necessary. Others, such as the cromulent 'init=/bin/sh', can allow circumvention of benefits that Secureboot and TPM provide.\nHow to control access to kernel command line modification is a non-trivial subject. A recent pull request to systemd that added "command-line addons" garnered hundreds of comments.\n\nThis talk will cover:\n * The stub loader 'stubby' and its allowed-list approach to kernel command line options.\n * Systemd-stub\u2019s solution for command line customization\n * System changes that can be made through kernel command line.\n * Alternative channels such as smbios oem strings, or qemu 'fw_cfg'\nabout this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/T3QFGS/