On 10/16/20 9:03 PM, Heinrich Schuchardt wrote: > Describe the activation of the Kernel Lockdown feature via Kconfig and the > command line. > > Cf. Documentation/admin-guide/kernel-parameters.rst. > > Signed-off-by: Heinrich Schuchardt <xypron.glpk@xxxxxx> Thanks, Heinrich. Patch applied. Cheers, Michael > --- > man7/kernel_lockdown.7 | 13 +++++++++++++ > 1 file changed, 13 insertions(+) > > diff --git a/man7/kernel_lockdown.7 b/man7/kernel_lockdown.7 > index 04de4d1fe..5aedd96e9 100644 > --- a/man7/kernel_lockdown.7 > +++ b/man7/kernel_lockdown.7 > @@ -104,4 +104,17 @@ whether or not they are specified on the command line, > for both the built-in and custom policies in secure boot lockdown mode. > .SH VERSIONS > The Kernel Lockdown feature was added in Linux 5.4. > +.SH NOTES > +The Kernel Lockdown feature is enabled by CONFIG_SECURITY_LOCKDOWN_LSM. > +The > +.I lsm=lsm1,...,lsmN > +command line parameter controls the sequence of the initialization of > +Linux Security Modules. > +It must contain the string > +.I lockdown > +to enable the Kernel Lockdown feature. > +If the command line parameter is not specified, > +the initialization falls back to the value of the deprecated > +.I security= > +command line parameter and further to the value of CONFIG_LSM. > .\" commit 000d388ed3bbed745f366ce71b2bb7c2ee70f449 > -- > 2.28.0 > -- Michael Kerrisk Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/ Linux/UNIX System Programming Training: http://man7.org/training/
