diff options
| author | Daniel Axtens <dja@axtens.net> | 2020-12-03 15:28:07 +1100 |
|---|---|---|
| committer | Michael Ellerman <mpe@ellerman.id.au> | 2020-12-04 01:01:34 +1100 |
| commit | ed2bbd2b8581313ca18a7c586a947f6cdd93a52a (patch) | |
| tree | 2a590a358eb5f68b2c379f641a3bafd7b4ed2e31 /arch/powerpc/configs | |
| parent | 1f69aa0b89240653fdf708aada6a3d968447cce7 (diff) | |
| download | linux-ed2bbd2b8581313ca18a7c586a947f6cdd93a52a.tar.bz2 | |
powerpc: add security.config, enforcing lockdown=integrity
It's sometimes handy to have a config that boots a bit like a system
under secure boot (forcing lockdown=integrity, without needing any
extra stuff like a command line option).
This config file allows that, and also turns on a few assorted security
and hardening options for good measure.
Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201203042807.1293655-1-dja@axtens.net
Diffstat (limited to 'arch/powerpc/configs')
| -rw-r--r-- | arch/powerpc/configs/security.config | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/arch/powerpc/configs/security.config b/arch/powerpc/configs/security.config new file mode 100644 index 000000000000..1c91a35c6a73 --- /dev/null +++ b/arch/powerpc/configs/security.config @@ -0,0 +1,15 @@ +# This is the equivalent of booting with lockdown=integrity +CONFIG_SECURITY=y +CONFIG_SECURITYFS=y +CONFIG_SECURITY_LOCKDOWN_LSM=y +CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y +CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y + +# These are some general, reasonably inexpensive hardening options +CONFIG_HARDENED_USERCOPY=y +CONFIG_FORTIFY_SOURCE=y +CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y + +# UBSAN bounds checking is very cheap and good for hardening +CONFIG_UBSAN=y +# CONFIG_UBSAN_MISC is not set
\ No newline at end of file |