1. Introduction
  2. Securelevel restrictions
    1. -1 Permanently insecure mode
    2. 0 Insecure mode
    3. 1 Secure mode
    4. 2 Highly secure mode
  3. Examining and changing securelevel
  4. Setting securelevel permanently
  5. See also


Kernel security levels have been introduced back in 4.4 to use file flags as a mechanism to enhance security. Ususally the system is running at a level 1, which can be checked with sysctl kern.securelevel, once the level has been set in the bootup process using the securelevel option in /etc/rc.conf you cannot lower the level anymore, but you are allowed to raise it to either 1 or 2.

The ?sysctl variable kern.securelevel is a variable that is usually -1 or 0, and can be raised during normal operation to disallow certain operations in the filesystem to increase security.

Securelevel restrictions

secmodel_bsd44(9) defines the following restrictions:

-1 Permanently insecure mode

0 Insecure mode

Note: You can't run X11 with legacy (e.g. VESA) drivers above this securelevel

Try sysutils/aperture if you really need it.

1 Secure mode

2 Highly secure mode

Examining and changing securelevel

As a user, you can see the current value of securelevel:

$ sysctl kern.securelevel
kern.securelevel = -1

But of course, you cannot change it:

$ sysctl -w kern.securelevel=0
sysctl: kern.securelevel: sysctl() failed with Operation not permitted

You need to be root to do that:

# sysctl -w kern.securelevel=1
kern.securelevel: -1 -> 1

Once it is set, its value can never be set to a lower value again:

# sysctl -w kern.securelevel=-1
sysctl: kern.securelevel: sysctl() failed with Operation not permitted

... except by the kernel debugger, which you can enter at the console. On i386, press ++:

db> w/l securelevel (-1)
netbsd:securelevel   0x1 -> 0xffffffff
db> c

Setting securelevel permanently

The securelevel can be set after booting the system by setting the securelevel shell variable in /etc/rc.conf (see ?manpage).

See also