Drivers and Secure Boot

Kernel Arguments

The defaults

Every RakuOS image boots with:

ArgumentWhat it does
lockdown=integritynothing in user space can modify the running kernel
module.sig_enforce=1only signed drivers load
intel_iommu=on, iommu.passthrough=0, iommu.strict=1the IOMMU is on and devices can't access memory around it (AMD systems have it on by default)
sysctl.kernel.kexec_load_disabled=1the running kernel can't be swapped for another

The RakuOS kernel uses AppArmor for access control (with the BPF security module on). SELinux isn't part of it, so the old selinux=0, security=apparmor and apparmor=1 arguments are no longer needed.

What lockdown blocks

  • Undervolting and TDP tools that write CPU registers (MSRs).
  • Raw /dev/mem access.
  • Hibernation. Sleep (suspend) still works.

These settings are deliberate, and Easy Anti-Cheat requires them. Lockdown and driver signature checks can't be turned off: the kernel only lets them get stricter, so adding lockdown=none or module.sig_enforce=0 does nothing.

Adding your own

Open RakuOS System, page System, Kernel Parameters…. What you add there comes after the defaults, so where you set the same option to a different value, your value wins (except lockdown and signature checks, above). It takes effect at the next boot.

If the IOMMU causes problems

On some older Intel PCs, turning the IOMMU on breaks a piece of hardware. For example, a laptop's TPM isn't found any more, so a disk that unlocked automatically with the TPM asks for its passphrase again.

  1. Test it for one boot. At the boot menu, press e on the RakuOS entry, delete intel_iommu=on iommu.passthrough=0 iommu.strict=1 from the line starting with linux, and press Ctrl+X. Nothing is saved; the next boot is back to normal.
  2. If that fixed it, add intel_iommu=off in Kernel Parameters… and reboot. It stays through updates.
  3. To undo it, remove intel_iommu=off there again.

With the IOMMU off, games that use Easy Anti-Cheat v2 won't start, and the anti-cheat check shows it. If the TPM is back but the disk still asks for the passphrase, run sudo rakuos reenroll-tpm2 once.

Checking what's in effect

cat /proc/cmdline
cat /sys/kernel/security/lockdown                  # shows [integrity]
cat /sys/module/module/parameters/sig_enforce      # shows Y