Looks all good and quite in Whonix 15.0.1.5.1.

• https://github.com/Whonix/security-misc/commit/3cd7b144bba1a92ca771b16fc5215073c7561a1a
• https://github.com/Whonix/debug-misc/commit/5a856595c1cf0a4a3b08e6ea75bd2fe2b3f2f398
• https://github.com/Whonix/debug-misc/commit/9e1ea579ca0a2d4399f2e1126b2ae2f583410947
• https://github.com/Whonix/debug-misc/commit/2cac2bed7169ae4d5477cbca1f2916bae110a450

Setting quiet loglevel=0 in that exact order as per https://github.com/Whonix/security-misc/commit/6485df8126b52a2072824fa442e8d1dd5cb18981 does now hide [sda] Incomplete mode parameter data. However, messages by LKRG are not yet hidden.

Even kernel parameter quiet loglevel=3 rd.systemd.show_status=auto rd.udev.log_priority=3
(from https://wiki.archlinux.org/index.php/Silent_boot)
does not hide [sda] Incomplete mode parameter data.

https://github.com/Whonix/security-misc/commit/8d2e4b68dcae87b27f519196488e0ed7e8b95ef2

kernel.printk = 3 3 3 3

And of course these messages are attributed to whatever Whonix issue someone is having.

Not fully fixed.

Thanks!

This issue is fixed now due to the quiet boot parameter. kernel.printk=3 3 3 3 isn't needed anymore.

In T950#19249, @Patrick wrote:

The loader of tirdad is currently using dmesg.

The loader of tirdad is currently using dmesg.

In T950#19231, @madaidan wrote:

quiet

This just prevents writing to /dev/kmsg. It doesn't stop kernel logs being displayed during boot.

Still wondering if initramfs modification this can be avoided... Still wondering if kernel.printk can be set through a kernel parameter. Looking again at https://github.com/torvalds/linux/blob/master/Documentation/admin-guide/kernel-parameters.txt...

Sounds good.

https://github.com/Whonix/security-misc/pull/51

We can use a sysctl.d drop-in and an initramfs hook in security-misc so non-initramfs users will still be mostly protected.

I guess because a sysctl.d drop-in config file is easy and catches most.
initramfs hook covers only initramfs users. Not dracut. But
security-misc initramfs hook sounds good enough. dracut support can
come later, if ever. Please implement.

Why not use an initramfs hook in security-misc? Not everyone will have security-misc and apparmor-profile-everything installed. Users with just security-misc installed will still have some kernel logs shown during early boot.

https://github.com/Whonix/security-misc/commit/ede536913daa0c7ddfe55e20c93d7b752daa5de3

Yes. Probably both. initramfs for apparmor-profile-everything users and
/etc/sysctl.d/ security-misc.

https://github.com/Whonix/security-misc/pull/50

Should this be set in the initramfs?

That worked.

https://github.com/Whonix/security-misc/commit/5ba2a5b6ff53df37ad38f082ad86ff2227158d93
https://github.com/Whonix/security-misc/commit/dfe8a569b639dd09ef4cd7f35c05efd7ea080406