Securing the Kernel Command Line

In this lesson, you will learn how to protect your kernel boot parameters from unauthorized tampering to ensure that security modules remain active and effective.

The kernel command line is a powerful interface passed by your bootloader (like GRUB) to the kernel during startup. It controls critical settings, such as enabling or disabling security modules like SELinux (selinux=0) or AppArmor (apparmor=0). Because this string is processed before the OS fully initializes, an attacker with local access—or even a compromised bootloader configuration—could easily weaken your security posture by appending flags that bypass your Mandatory Access Control (MAC) policies.

Locking Down the Command Line

To secure this interface, you must prevent the command line from being modified by unauthorized users or malicious scripts. The most effective approach is to implement Unified Kernel Images (UKI) or Secure Boot combined with Signed Kernel Parameters.

1. Secure Boot: By using UEFI Secure Boot, you verify that the bootloader and the kernel image have not been tampered with. If the kernel command line is embedded within the signed kernel image itself, it becomes immutable to outside modification.
2. Kernel Lockdown Mode: When the kernel is in "Lockdown" mode (specifically integrity or confidentiality), it restricts access to features that could allow user-space processes to modify the running kernel image or its parameters, such as /dev/mem or certain kexec calls.

If you are using GRUB, ensure your configuration file (/boot/grub/grub.cfg or /etc/default/grub) is readable only by the root user:

# Set strict permissions on boot configuration
chmod 600 /boot/grub/grub.cfg
chown root:root /boot/grub/grub.cfg

Beyond file permissions, you should avoid passing sensitive configurations via the command line whenever possible. Instead, bake your desired security defaults directly into the kernel build configuration or via an immutable initramfs. If you rely on flags like selinux=1, ensure your bootloader is password-protected to prevent an attacker from dropping into the shell and editing the kernel arguments during the boot process.

Key Takeaway: Since the kernel command line dictates the early-boot security state, you must treat your bootloader configuration as a high-value secret and use cryptographically signed images to ensure your security modules cannot be bypassed at runtime.