Re: X server blocked by SecureBoot

[Christian <chris@argonautx.net>]

Hi Thomas, thank you for your help. So far I couldn't see anything in my 
cmdline which is kernel_lockdown related. And I grep'ed the whole /etc 
and /boot directory recursively. Nothing. And neither in the dmesg, 
there is no "lsm=" line. Only in the kernel .config is 
CONFIG_SECURITY_LOCKDOWN=y, enabled. So yes the kernel supports it.
Debian Live boot system couldn't either boot up my new PC, but Ubuntu 
did. WIth Ubuntu I was able to boot it with Desktop and everthing, but 
they used Nouveu driver. And dmesg dumped this out:
[    0.209551] LSM: initializing 
lsm=lockdown,capability,landlock,yama,apparmor,ima,evm

I couldn't find out where this parameters are set. Even on the Ubuntu 
Live system I didn't find a file with just one single line with the 
words lsm= or lockdown (case insensitive)

Thank you

BR Christian


> Hi,
>
> Christian wrote:
> > [   47.042454] Lockdown: Xorg: raw io port access is restricted; see man kernel_lockdown.7
> > I think it's still SecureBoot, but what is it this time? Can anyone help
> At least the above log snippet seems to be related to SecureBoot.
> In
>    https://manpages.debian.org/bookworm/manpages/kernel_lockdown.7.en.html
> i see
>
>    "On an EFI-enabled x86 or arm64 machine, lockdown will be automatically
>     enabled if the system boots in EFI Secure Boot mode.
>     Coverage
>     When lockdown is in effect, a number of features are disabled or have
>     their use restricted. This includes special device files and kernel
>     services that allow direct access of the kernel image:"
>     [...]
>    NOTES
>      The Kernel Lockdown feature is enabled by CONFIG_SECURITY_LOCKDOWN_LSM.
>      The lsm=lsm1,...,lsmN command line parameter controls the sequence of
>      the initialization of Linux Security Modules. It must contain the
>      string lockdown to enable the Kernel Lockdown feature. If the command
>      line parameter is not specified, the initialization falls back to the
>      value of the deprecated security= command line parameter and further
>      to the value of CONFIG_LSM."
>
> So i guess you have to look into your boot configuration for kernel
> parameter "lockdown".
>
> On
>    https://bbs.archlinux.org/viewtopic.php?id=290866
> i see this statement by espritlibre:
>
>    "Re: Secure boot and Nvidia
>     i have secure boot enabled, but lockdown disabled  (for another
>     reason). loading the nvidia module does taint the kernel, but loads
>     and work just fine with prime-run on a hybrid systme. i'm not signing
>     OOT modules, just kernel and efi stuff."
>
> (Whatever "prime-run" might be ...)
>
>
> Have a nice day :)
>
> Thomas