feat: build kernel lockdown LSM

This enables CONFIG_SECURITY_LOCKDOWN_LSM so that users can set a lockdown mode. Signed-off-by: Andrew Rynhard <[email protected]>
siderolabs · Jan 28, 2020 · 452221e · 452221e
1 parent 02a0356
commit 452221e
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/kernel/config-amd64 b/kernel/config-amd64
@@ -4574,7 +4574,11 @@ CONFIG_FORTIFY_SOURCE=y
 # CONFIG_SECURITY_LOADPIN is not set
 CONFIG_SECURITY_YAMA=y
 # CONFIG_SECURITY_SAFESETID is not set
-# CONFIG_SECURITY_LOCKDOWN_LSM is not set
+CONFIG_SECURITY_LOCKDOWN_LSM=y
+CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
+# CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE is not set
+# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
+# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 CONFIG_INTEGRITY=y
 # CONFIG_INTEGRITY_SIGNATURE is not set
 CONFIG_INTEGRITY_AUDIT=y