AZL3: How to remove lockdown kernel parameter in ISO

[ankithmr]

I am using AZL3 iso and customizing it for our HPE servers. I need to disable lockdown=integrity parameter in the base ISO.
I tried removing it from grub.cfg but still the OS is coming up with "lockdown=integrity" parameter. It seems the parameter is coming from somewhere else. Can you please share the correct way to update it in ISO ?

I tried it in the following file:

set timeout=0

# The use of mariner.media=CDROM is a workaround that our installer does not require
# but it is observed to be needed to boot on some hardware/SoCs.
menuentry "Azure Linux" {
    search --label CDROM --set root
    linux /isolinux/vmlinuz root=/dev/ram0 mariner.media=CDROM lockdown=integrity sysctl.kernel.unprivileged_bpf_disabled=1 console=tty0 console=ttyS0,115200n8
    initrd /isolinux/initrd.img
}

[elsaco]

@ankithmr are you using Secure Boot? From man page: On an EFI-enabled x86 or arm64 machine, lockdown will be automatically enabled if the system boots in EFI Secure Boot mode

[ankithmr]

I checked the bios setting and secure boot is disabled.

"SecureBootStatus": "Disabled"

[zcobol]

If the secure boot is disabled, removing lockdown=integrity from the boot menu (on startup or edit /boot/grub2/grub.cfg) should work:

zcobol@texas:~$ ssh zcobol@192.168.124.57
Welcome to Microsoft Azure Linux 3.0 (x86_64)
Last login: Thu Oct 17 17:39:47 2024 from 192.168.124.1
zcobol@august [ ~ ]$ sudo dmesg | grep -i secure
[    0.000000] secureboot: Secure boot disabled
[    0.285800] Loaded X.509 cert 'Microsoft Corporation: Mariner Secure Boot(Production Signing): b42d6b9e2809b7b9097cff9e9b0194b86e80bf95'
zcobol@august [ ~ ]$ cat /proc/cmdline 
BOOT_IMAGE=/boot/vmlinuz-6.6.51.1-5.azl3 root=UUID=b3ee3f09-b879-4633-befa-a2616848d8cf ro selinux=0 rd.auto=1 net.ifnames=0
zcobol@august [ ~ ]$ cat /sys/kernel/security/lockdown 
[none] integrity confidentiality

[ankithmr]

Sorry probably I wasn't clear in my first message. I want to make sure that it is removed in the ISO itself. We use an automated installation process and want to remove it in the ISO.

I already tried by removing the parameter from grub file and recreated the ISO but it doesn't help

[zcobol]

@ankithmr you need to build your own ISO image. First modify https://github.com/microsoft/azurelinux/blob/3.0/toolkit/resources/assets/isomaker/iso_root_static_files/boot/grub2/grub.cfg and remove lockdown=integrity then run make iso and choose the image config you want. There are several options in toolkit/imageconfigs folder.

[ankithmr]

@zcobol , even after removing lockdown from grub.cfg and building the ISO image, the OS still boots with lockdown parameter.

grub.cfg

epcadmin@devel5g-1 [ /mnt/disk/ankit/AfoMariner/AzureLinux/toolkit ]$ cat resources/assets/isomaker/iso_root_static_files/boot/grub2/grub.cfg
set timeout=0

# The use of mariner.media=CDROM is a workaround that our installer does not require
# but it is observed to be needed to boot on some hardware/SoCs.
menuentry "Azure Linux" {
    search --label CDROM --set root
    linux /isolinux/vmlinuz root=/dev/ram0 mariner.media=CDROM sysctl.kernel.unprivileged_bpf_disabled=1 console=tty0 console=ttyS0,115200n8
    initrd /isolinux/initrd.img
}
epcadmin@devel5g-1 [ /mnt/disk/ankit/AfoMariner/AzureLinux/toolkit ]$

Then I ran make command:

sudo make iso -j8 REBUILD_TOOLS=y REBUILD_PACKAGES=n CONFIG_FILE=./imageconfigs/full.json

Small updates in full.json file:

epcadmin@devel5g-1 [ /mnt/disk/ankit/AfoMariner/AzureLinux/toolkit ]$ cat ./imageconfigs/full.json
{
    "SystemConfigs": [
        {
            "Name": "Azure Linux Full",
            "PackageLists": [
                "packagelists/grub2-mkconfig.json",
                "packagelists/developer-packages.json",
                "packagelists/core-packages-image.json",
                "packagelists/core-tools-packages.json",
                "packagelists/ssh-server.json"
            ],
            "KernelCommandLine": {
                "lockdown": "none"
            },
            "KernelOptions": {
                "default": "kernel"
            },
            "AdditionalFiles": {
                "additionalconfigs/99-dhcp-en.network": "/etc/systemd/network/99-dhcp-en.network"
            }
        },
        {
            "Name": "Azure Linux Core",
            "PackageLists": [
                "packagelists/grub2-mkconfig.json",
                "packagelists/core-packages-image.json"
            ],
            "KernelOptions": {
                "default": "kernel"
            },
            "AdditionalFiles": {
                "additionalconfigs/99-dhcp-en.network": "/etc/systemd/network/99-dhcp-en.network"
            }
        }
    ]
}

Is there anything else needed ?