feat: enforce kernel lockdown for UKI

UKI is meant to be for UEFI Secure Boot, so it's expected to enforce kernel lockdown. We might reconsider in the future to use a kernel patch instead: SUSE/kernel@b1a0314 Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
schaurian · Jul 22, 2023 · 5e13caf · 5e13caf
1 parent 4d96d64
commit 5e13caf
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/cmd/ukify/main.go b/cmd/ukify/main.go
@@ -34,6 +34,10 @@ func run() error {
 		return err
 	}
 
+	if err := defaultCmdline.AppendAll(kernelpkg.SecureBootArgs); err != nil {
+		return err
+	}
+
 	if err := defaultCmdline.AppendAll(metal.KernelArgs().Strings()); err != nil {
 		return err
 	}

diff --git a/pkg/machinery/kernel/kernel.go b/pkg/machinery/kernel/kernel.go
@@ -31,6 +31,11 @@ var DefaultArgs = []string{
 	"ima_hash=sha512",
 }
 
+// SecureBootArgs returns the kernel commandline options required for secure boot.
+var SecureBootArgs = []string{
+	"lockdown=confidentiality",
+}
+
 // Param represents a kernel system property.
 type Param struct {
 	Key   string