securelevel is a security mechanism in *BSD kernels, which can optionally restrict certain capabilities. Securelevel is controlled by a sysctl variable kern.securelevel. This value is an integer, which set to a value > 0 enables certain class of restrictions. Any superuser process can raise securelevel, but only init process can lower it. When used with FreeBSD jails, each jail maintains its own securelevel in addition to the global securelevel. When evaluated, the higher of the two securelevels will be used. This allows the host environment to run at a lower securelevel than jails, so that it can manipulate file flags that the jails may not be able to. When compiled with options REGRESSION, a new sysctl is added to the FreeBSD kernel that allows the securelevel to be lowered for the purposes of automated regression testing. Securelevel is not to be confused with runlevel.
Definitions
On OpenBSD the securelevels are defined as follows:
-1' is functionally identical to securelevel 0 except the Kernel will never attempt to increase the level as it would in level 0. This effectively disables securelevel protections.
0' all devices can be read or written to and system file flags can be cleared using chflags. This mode is typically used while the system is booting, and once boot is completed and system enters multi-user mode, it is elevated to level 1.
1' this is the default mode when the system is booted into multi-user mode. In this mode the securelevel can not be lowered, the raw memory devices can not be written to, the raw devices of mounted file systems can not be written to, important kernel variables are locked down and only GPIOpins that were present during boot may be accessed.
2' has the same effects are securelevel 1, and in addition raw disk devices can not be written to even if unmounted, certain time related functions are locked down so the time cannot be set in the past and pf rules may not be altered. This mode is designed to provide some semblance of defence in the event that the root user account is compromised.
