Skip to content

feat: disable kernel lockdown mode for azurelinux 3.0 aks image by default #7990

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
miz060 wants to merge 6 commits into
base: main
Choose a base branch
from
+20 −0
Open

feat: disable kernel lockdown mode for azurelinux 3.0 aks image by default #7990

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
97ec9b5
feat: disable kernel lockdown mode for azurelinux 3.0 aks image
miz060 Feb 27, 2026
48df3e9
Merge branch 'main' into mitchzhu/disable_kernel_lockdown_packer-pr
miz060 Apr 2, 2026
25cf7c9
Fix shellcheck error
miz060 Apr 2, 2026
05fd1a3
Merge branch 'main' into mitchzhu/disable_kernel_lockdown_packer-pr
miz060 Apr 9, 2026
7f16925
Merge branch 'main' into mitchzhu/disable_kernel_lockdown_packer-pr
miz060 Apr 16, 2026
ee2c789
replace grubby with sed+grub2-mkconfig
miz060 Apr 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions vhdbuilder/packer/pre-install-dependencies.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,6 +123,13 @@ if [[ ${OS} == ${MARINER_OS_NAME} ]] && [[ "${ENABLE_CGROUPV2,,}" == "true" ]];
fi
capture_benchmark "${SCRIPT_NAME}_enable_cgroupv2_for_azurelinux"

# Remove lockdown=integrity from kernel cmdline for Azure Linux 3.0
# The kernel has an OOT patch that auto-enables lockdown when secure boot is detected
if isMarinerOrAzureLinux "$OS" && [ "$OS_VERSION" = "3.0" ]; then
disableKernelLockdownCmdline
Comment thread
miz060 marked this conversation as resolved.
fi
Comment thread
miz060 marked this conversation as resolved.
capture_benchmark "${SCRIPT_NAME}_disable_kernel_lockdown_cmdline"

# shellcheck disable=SC3010
if [[ ${UBUNTU_RELEASE//./} -ge 2204 && "${ENABLE_FIPS,,}" != "true" ]]; then

Expand Down
13 changes: 13 additions & 0 deletions vhdbuilder/scripts/linux/mariner/tool_installs_mariner.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,6 +172,19 @@ activateNfConntrack() {
echo nf_conntrack >> /etc/modules-load.d/contrack.conf
}

# Remove lockdown=integrity from kernel cmdline for Azure Linux 3.0.
# The AzureLinux 3.0 kernel has an OOT patch that automatically enables
# lockdown when secure boot is detected.
disableKernelLockdownCmdline() {
Comment thread
miz060 marked this conversation as resolved.
echo "Removing lockdown=integrity from kernel cmdline..."
if [ -f /etc/default/grub ]; then
sed -i 's/lockdown=integrity//g' /etc/default/grub
grub2-mkconfig -o /boot/grub2/grub.cfg || exit 1
else
echo "Warning: /etc/default/grub not found, skipping lockdown removal"
Comment thread
miz060 marked this conversation as resolved.
fi
}

installFIPS() {

echo "Installing FIPS..."
Expand Down
Loading