0

I have the kernel parameters for our embedded device set during kernel build time, but these can be overridden by passing other parameters from the bootloader.

Is there a way to build a kernel that will ignore parameters that are passed to it?

My justification for wanting this are twofold:

First, it would be nice to isolate kernel things in the kernel "package" to ease distribution of updates. We don't currently use an initramfs, but I suppose it--if embedded in the kernel--could be a point to easily filter incoming parameters.

Second, another layer in our security strategy. It would be a somewhat non-trivial speedbump to either do a binary patch on the existing kernel or build a new one that would successfully boot a custom board; with a secure-boot chain it would be nigh impossible.

0

I don't think there's such a configuration because it doesn't make any sense. If you don't want to pass parameters to your kernel, lock your bootloader so that the command line parameters that it passes can't be changed.

The bootloader decides what kernel it loads, so preventing parameter changes in the kernel would not add any security. Building a kernel that boots on some machine is not a speedbump.

If you have a secure boot chain, then the kernel can't be substituted, but of course securing the boot chain includes securing the kernel parameters. That's a security property of the bootloader, not a security property of the kernel.

You can't set kernel parameters from the initramfs (except for parameters that can be set at runtime after the kernel has booted, of course). It's too late. If you need to set some kernel parameters, you need to do it in the bootloader — and that's its job. There wouldn't be any advantage in terms of packaging: if you're packaging the bootloader separately, and you don't want to tune some parameters from the bootloader, you only need to set the correct default values in the kernel binary, you don't need to prevent the kernel from accepting overrides on its command line.

  • 1
    Or, since he's using an embedded device, create a bootloader that doesn't allow values to be changed. That'll be easier than hunting down every single place where the kernel and kernel modules and init scripts and elsewhere might parse the kernel cmdline. – Stephen Harris Sep 20 '16 at 2:14
  • @StephenHarris Well, sure, many embedded devices don't have an interface to change bootloader parameters. But sometimes it's as easy as plugging in a serial cable. – Gilles Sep 20 '16 at 9:37
  • Mulling this over I think my base premise if flawed, like you assert. A simple string replacement would be enough to modify the default args compiled into the kernel even if there was some way to have the kernel ignore incoming parameters. And since our OS is on a removable SD card, it wouldn't be much of a barrier at all. Going to bump secure boot up the timeline. – joshperry Sep 21 '16 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.