config [31mCONFIG_SECURITY_LOCKDOWN_LSM[0m bool "Basic module for enforcing kernel lockdown" depends on [31mCONFIG_SECURITY[0m select [31mCONFIG_MODULE_SIG[0m if [31mCONFIG_MODULES[0m help Build support for an [31mCONFIG_LSM[0m that enforces a coarse kernel lockdown behaviour. config [31mCONFIG_SECURITY_LOCKDOWN_LSM_EARLY[0m bool "Enable lockdown LSM early in init" depends on [31mCONFIG_SECURITY_LOCKDOWN_LSM[0m help Enable the lockdown [31mCONFIG_LSM[0m early in boot. This is necessary in order to ensure that lockdown enforcement can be carried out on kernel boot parameters that are otherwise parsed before the security subsystem is fully initialised. If enabled, lockdown will unconditionally be called before any other LSMs. choice prompt "Kernel default lockdown mode" default [31mCONFIG_LOCK_DOWN_KERNEL_FORCE_NONE[0m depends on [31mCONFIG_SECURITY_LOCKDOWN_LSM[0m help The kernel can be configured to default to differing levels of lockdown. config [31mCONFIG_LOCK_DOWN_KERNEL_FORCE_NONE[0m bool "None" help No lockdown functionality is enabled by default. Lockdown may be enabled via the kernel commandline or /sys/kernel/security/lockdown. config [31mCONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY[0m bool "Integrity" help The kernel runs in integrity mode by default. Features that allow the kernel to be modified at runtime are disabled. config [31mCONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY[0m bool "Confidentiality" help The kernel runs in confidentiality mode by default. Features that allow the kernel to be modified at runtime or that permit userland code to read confidential material held inside the kernel are disabled. endchoice |