| 1 |
# Alloy default kernel cmdline additions. |
| 2 |
# |
| 3 |
# `quiet` + `loglevel=3` suppresses kernel/audit printk on tty1 so the |
| 4 |
# greetd/tuigreet UI isn't overwritten by systemd-hostnamed and |
| 5 |
# user-runtime-dir audit messages. Anyone debugging boot problems can |
| 6 |
# still get the full log via `journalctl -k` or `dmesg`. |
| 7 |
# |
| 8 |
# --------------------------------------------------------------------- |
| 9 |
# The console palette is the image's default theme, and this is the only |
| 10 |
# place it can be set for the greeter. |
| 11 |
# |
| 12 |
# tuigreet takes a --theme, and etc/greetd/config.toml passes it one, but |
| 13 |
# its parser accepts only the sixteen ANSI color names. Hex is not |
| 14 |
# rejected, it is ignored: a value it cannot read falls back to a default, |
| 15 |
# which is how a literal `prompt=#8a4530` renders red. Verified against |
| 16 |
# tuigreet 0.9.1 by booting it both ways. |
| 17 |
# |
| 18 |
# So the names stay in the greetd config and the *palette behind them* |
| 19 |
# moves here. These three arrays are the Linux console's 16-color table, |
| 20 |
# and setting them makes tuigreet's `white` be surface.page and its |
| 21 |
# `yellow` be status.warning, without tuigreet knowing anything about it. |
| 22 |
# The same substitution themes every VT: the debug shell, a getty, and |
| 23 |
# anything that writes to the console before a compositor exists. |
| 24 |
# |
| 25 |
# The table itself is skelgen's `ANSI_16`, which rio's [colors] block also |
| 26 |
# renders from, so a terminal and a bare VT now agree on what "red" means |
| 27 |
# by construction. They did not before: the mapping was maintained twice |
| 28 |
# and the two copies disagreed on three of the sixteen slots. |
| 29 |
# |
| 30 |
# This block used to end by admitting there was no build step deriving it |
| 31 |
# and nothing to report the drift. There is one now — these arrays come |
| 32 |
# from the theme file, and a change to it lands here without anyone |
| 33 |
# retyping a byte. |
| 34 |
# --------------------------------------------------------------------- |
| 35 |
|
| 36 |
# --------------------------------------------------------------------- |
| 37 |
# Kernel hardening arguments (KSPP), added 2026-08-21. |
| 38 |
# |
| 39 |
# The self-protection settings that can only be asked for on the command |
| 40 |
# line. Their sysctl-shaped siblings live in |
| 41 |
# /usr/lib/sysctl.d/90-alloy-hardening.conf; rationale for the whole set is |
| 42 |
# wiki `alloy-hardening-posture`. |
| 43 |
# |
| 44 |
# `init_on_alloc=1` is deliberately absent: Fedora's kernel is built with |
| 45 |
# CONFIG_INIT_ON_ALLOC_DEFAULT_ON, so setting it here would state a default |
| 46 |
# twice and imply the other half is off when it is not. |
| 47 |
# |
| 48 |
# `lockdown=confidentiality` is also absent, and that is an open decision |
| 49 |
# rather than an omission (GoingsOn alloy `17489bac`). It costs hibernation |
| 50 |
# and unsigned module loading, and the aarch64 NVIDIA work is exactly the |
| 51 |
# case that would collide with it. |
| 52 |
# |
| 53 |
# The two with a measurable throughput cost are `init_on_free` and |
| 54 |
# `slab_nomerge`, and this machine is also a build host. If a build gets |
| 55 |
# slower after this lands, these are the lines to measure rather than the |
| 56 |
# ones to quietly drop. |
| 57 |
# --------------------------------------------------------------------- |
| 58 |
|
| 59 |
kargs = [ |
| 60 |
"quiet", |
| 61 |
"loglevel=3", |
| 62 |
# Free memory is wiped on release, so a use-after-free reads zeroes rather |
| 63 |
# than the previous occupant's data. |
| 64 |
"init_on_free=1", |
| 65 |
# Slab caches of the same size stay separate, so an overflow in one object |
| 66 |
# type cannot land on another type's object. |
| 67 |
"slab_nomerge", |
| 68 |
# The free lists start shuffled, so heap layout is not a constant an |
| 69 |
# exploit can assume. |
| 70 |
"page_alloc.shuffle=1", |
| 71 |
# A random offset per syscall on the kernel stack. |
| 72 |
"randomize_kstack_offset=on", |
| 73 |
# The legacy vsyscall page is a fixed-address, executable mapping in every |
| 74 |
# process. Nothing built this decade needs it; a pre-2013 glibc binary does. |
| 75 |
"vsyscall=none", |
| 76 |
# debugfs exposes kernel internals to root and is a recurring source of |
| 77 |
# information leaks. Nothing in this image reads it. |
| 78 |
"debugfs=off", |
| 79 |
"vt.default_red=@{vt.red}", |
| 80 |
"vt.default_grn=@{vt.grn}", |
| 81 |
"vt.default_blu=@{vt.blu}", |
| 82 |
] |
| 83 |
|