# Arcline Workstation — kernel command line
# Same hardening baseline as server, without the serial console and with
# graphics-friendly settings.

console=tty0
quiet
loglevel=3
systemd.show_status=auto

# hardening
init_on_alloc=1
init_on_free=1
slab_nomerge
page_poison=1
pti=on
spectre_v2=on
spec_store_bypass=on
tsx=off
lockdown=integrity
oops=panic
panic=-1

# btrfs / storage
rootflags=subvol=@