Describe the activation of the Kernel Lockdown feature via Kconfig and the command line. Cf. Documentation/admin-guide/kernel-parameters.rst. Signed-off-by: Heinrich Schuchardt <xypron.glpk@xxxxxx> --- man7/kernel_lockdown.7 | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/man7/kernel_lockdown.7 b/man7/kernel_lockdown.7 index 04de4d1fe..5aedd96e9 100644 --- a/man7/kernel_lockdown.7 +++ b/man7/kernel_lockdown.7 @@ -104,4 +104,17 @@ whether or not they are specified on the command line, for both the built-in and custom policies in secure boot lockdown mode. .SH VERSIONS The Kernel Lockdown feature was added in Linux 5.4. +.SH NOTES +The Kernel Lockdown feature is enabled by CONFIG_SECURITY_LOCKDOWN_LSM. +The +.I lsm=lsm1,...,lsmN +command line parameter controls the sequence of the initialization of +Linux Security Modules. +It must contain the string +.I lockdown +to enable the Kernel Lockdown feature. +If the command line parameter is not specified, +the initialization falls back to the value of the deprecated +.I security= +command line parameter and further to the value of CONFIG_LSM. .\" commit 000d388ed3bbed745f366ce71b2bb7c2ee70f449 -- 2.28.0
