Arch Linux

SystemdReaper

Member

Registered: 2025-08-22

Posts: 6

Apparmor Kernel Parameters with systemd-boot NOT grub

Hello,

New to the forum. Have scoured the web for answers on how to do this but cannot seem to find any answers. All the answers point to setting up apparmor with GRUB, which I am not using.

I just did a fresh install today (Fri Aug 22 2025) which is as follows:

Kernel: linux-hardened.
Bootloader: systemd-boot.
Secure boot: Enabled.
UKI: Yes.
DE: KDE Plasma Wayland.

I am not a developer or a CS major / minor, but this has not worked for me or rather I have no clue how to go about this with the current system I have:

https://wiki.archlinux.org/title/AppArmor

To enable AppArmor as default security model on every boot, set the following kernel parameter:

lsm=landlock,lockdown,yama,integrity,apparmor,bpf

I can run:

zgrep CONFIG_LSM= /proc/config.gz

and

cat /sys/kernel/security/lsm

Please advise.

Last edited by SystemdReaper (2025-08-22 23:04:25)

loqs

Member

Registered: 2014-03-06

Posts: 18,760

Re: Apparmor Kernel Parameters with systemd-boot NOT grub

https://wiki.archlinux.org/title/Kernel … stemd-boot

SystemdReaper

Member

Registered: 2025-08-22

Posts: 6

Re: Apparmor Kernel Parameters with systemd-boot NOT grub

https://wiki.archlinux.org/title/Kernel … stemd-boot

Tried that. Does not work with SecureBoot enabled, and when I disable SecureBoot, it boots but drops me into an emergency shell and I have to shutdown, enable SecureBoot, to get back to my desktop.

loqs

Member

Registered: 2014-03-06

Posts: 18,760

Re: Apparmor Kernel Parameters with systemd-boot NOT grub

Tried that. Does not work with SecureBoot enabled, and when I disable SecureBoot, it boots but drops me into an emergency shell and I have to shutdown, enable SecureBoot, to get back to my desktop.

As SecureBoot is enabled the options would need to be set when the UKI is built with the details depending on which method you use for that https://wiki.archlinux.org/title/Unifie … rnel_image.

Last edited by loqs (2025-08-22 23:19:13)

SystemdReaper

Member

Registered: 2025-08-22

Posts: 6

Re: Apparmor Kernel Parameters with systemd-boot NOT grub

Tried that. Does not work with SecureBoot enabled, and when I disable SecureBoot, it boots but drops me into an emergency shell and I have to shutdown, enable SecureBoot, to get back to my desktop.

As SecureBoot is enabled the options would need to be set when the UKI is built with the details depending on which method you use for that https://wiki.archlinux.org/title/Unifie … rnel_image.

The UKI was set up during install with the install script on the ISO.

SystemdReaper

Member

Registered: 2025-08-22

Posts: 6

Re: Apparmor Kernel Parameters with systemd-boot NOT grub

Tried that. Does not work with SecureBoot enabled, and when I disable SecureBoot, it boots but drops me into an emergency shell and I have to shutdown, enable SecureBoot, to get back to my desktop.

As SecureBoot is enabled the options would need to be set when the UKI is built with the details depending on which method you use for that https://wiki.archlinux.org/title/Unifie … rnel_image.

Looking into this:

/etc/cmdline.d/security.conf

# enable apparmor

lsm=landlock,lockdown,yama,integrity,apparmor,bpf audit=1 audit_backlog_limit=256

from

https://wiki.archlinux.org/title/Unifie … rnel_image

and will let you know if it takes.

SystemdReaper

Member

Registered: 2025-08-22

Posts: 6

Re: Apparmor Kernel Parameters with systemd-boot NOT grub

Tried that. Does not work with SecureBoot enabled, and when I disable SecureBoot, it boots but drops me into an emergency shell and I have to shutdown, enable SecureBoot, to get back to my desktop.

As SecureBoot is enabled the options would need to be set when the UKI is built with the details depending on which method you use for that https://wiki.archlinux.org/title/Unifie … rnel_image.

That's a bit complex. I selected the option to use UKI when installing and all that was done by the installer. I have a .conf in /boot/loader/entries, with the lsm=...........apparmor, bpf, but that does not appear to be used because  cat /sys/kernel/security/lsm does not list apparmor.

sekret

Member

Registered: 2013-07-22

Posts: 302

Re: Apparmor Kernel Parameters with systemd-boot NOT grub

Tried that. Does not work with SecureBoot enabled, and when I disable SecureBoot, it boots but drops me into an emergency shell and I have to shutdown, enable SecureBoot, to get back to my desktop.

As SecureBoot is enabled the options would need to be set when the UKI is built with the details depending on which method you use for that https://wiki.archlinux.org/title/Unifie … rnel_image.

Looking into this:

/etc/cmdline.d/security.conf

# enable apparmor

lsm=landlock,lockdown,yama,integrity,apparmor,bpf audit=1 audit_backlog_limit=256

from

https://wiki.archlinux.org/title/Unifie … rnel_image

and will let you know if it takes.

That's how I do it and it works perfectly. Don't forget to run mkinitcpio -P after each change you make.