Why can't I modify OpenBSD securelevel?

Question

I just installed an OpenBSD. I edited "vi /etc/rc.securelevel" and set the securelevel from 1 to 0. Saved the file, then rebooted. But after the reboot the sysctl states the securelevel is still 1. Why?

Answer 1

Looking at a specific part of the Absolute OpenBSD - Michael W. Lucas:

Securelevel 0

Securelevel 0 is used only when the system is first booting. It offers no special features. When the system reaches multiuser mode, however, the security is automatically raised to 1. Setting securelevel=0 in /etc/rc.securelevel is functionally equivalent to setting securelevel=1.

Taking a look at the OpenBSD documentation - securelevel(7):

Snip:

 Securelevel provides convenient means of ``locking down'' a system to a
 degree suited to its environment.  It is normally set at boot via the
 rc.securelevel(8) script, or the superuser may raise securelevel at any
 time by modifying the kern.securelevel sysctl(8) variable.  However, only
 init(8) may lower it once the system has entered secure mode.  A kernel
 built with option INSECURE in the config file will default to permanently
 insecure mode.

And taking a look at the permanently insecure:

 -1 Permanently insecure mode
       -   init(8) will not attempt to raise the securelevel
       -   may only be set with sysctl(8) while the system is insecure
       -   otherwise identical to securelevel 0

Now, looking at the relevant part of the init(8) manpage:

The kernel securelevel(7) is normally set to 0 while in single-user mode,
and raised to 1 when the system begins multi-user operations. This action
will not take place if the securelevel is -1, and can be modified via the
/etc/rc.securelevel script.

tl,dr: There is no way to stay at securelevel 0. It will automatically be raised do 1. To do this you will have to use securelevel -1, that can be achieved on a permanent way only by rebuilding your kernel(do you REALLY want this?). And remember: Securelevels can only be raised. Anything that needs to be executed before the securelevel raises, shall be placed at /etc/rc.securelevel.

Answer 2

I know it's a few months old question but may be still useful for someone considering that the answer above marked as correct IS WRONG!

"There is no way to stay at securelevel 0. It will automatically be raised do 1. To do this you will have to use securelevel -1, that can be achieved on a permanent way only by rebuilding your kernel(do you REALLY want this?)."

WRONG!

You actually can. This is something which has been changed with the last release and it was bothering me much. Introducing this stupid auto-switch to secure level 1 basically makes administration of your server the HELL ON EARTH if you were extensively using file flags as from 1 and up you cannot longer modify them.

A VERY quick fix is to edit the section (line 465-467) in /etc/rc:

if [ `sysctl -n kern.securelevel` -eq 0 ]; then
        sysctl kern.securelevel=1
fi

just change the securelevel here to -1:

    sysctl kern.securelevel=-1

and the server will come up with securelevel -1. Then it's up to you to lock it down.

"And remember: Securelevels can only be raised. Anything that needs to be executed before the securelevel raises, shall be placed at /etc/rc.securelevel."

INCORRECT!

Securelevels can only be raised WHEN the current is >=1.

Answer 3

Securelevel 0 is specifically used for the boot sequence. If you want no restriction like securelevel 0, then use the securelevel -1 instead.

Put the following line into your /etc/rc.securelevel :

sysctl kern.securelevel=-1

/etc/rc is the script that do the boot sequence. It executes /etc/rc.securelevel. Then rc checks the securelevel : if securelevel = 0 then rc raises it to 1. If securelevel <> 0, then rc do nothing.

Tested on OpenBSD 6.1.

Answer 4

Does setting it via sysctl work?

sysctl kern.securelevel=0

Also can you show what your /etc/rc.securelevel file looks like after reboot? Are you sure it was saved properly and is correct?