[PATCH 1/1] kernel_lockdown.7: describe LSM activation

[PATCH 1/1] kernel_lockdown.7: describe LSM activation

[Heinrich Schuchardt]

Describe the activation of the Kernel Lockdown feature via Kconfig and the
command line.

Cf. Documentation/admin-guide/kernel-parameters.rst.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
---
 man7/kernel_lockdown.7 | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/man7/kernel_lockdown.7 b/man7/kernel_lockdown.7
index 04de4d1fe..5aedd96e9 100644
--- a/man7/kernel_lockdown.7
+++ b/man7/kernel_lockdown.7
@@ -104,4 +104,17 @@ whether or not they are specified on the command line,
 for both the built-in and custom policies in secure boot lockdown mode.
 .SH VERSIONS
 The Kernel Lockdown feature was added in Linux 5.4.
+.SH NOTES
+The Kernel Lockdown feature is enabled by CONFIG_SECURITY_LOCKDOWN_LSM.
+The
+.I lsm=lsm1,...,lsmN
+command line parameter controls the sequence of the initialization of
+Linux Security Modules.
+It must contain the string
+.I lockdown
+to enable the Kernel Lockdown feature.
+If the command line parameter is not specified,
+the initialization falls back to the value of the deprecated
+.I security=
+command line parameter and further to the value of CONFIG_LSM.
 .\" commit 000d388ed3bbed745f366ce71b2bb7c2ee70f449
--
2.28.0

Re: [PATCH 1/1] kernel_lockdown.7: describe LSM activation

[Michael Kerrisk (man-pages)]

On 10/16/20 9:03 PM, Heinrich Schuchardt wrote:
> Describe the activation of the Kernel Lockdown feature via Kconfig and the
> command line.
> 
> Cf. Documentation/admin-guide/kernel-parameters.rst.
> 
> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>

Thanks, Heinrich. Patch applied.

Cheers,

Michael

> ---
>  man7/kernel_lockdown.7 | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/man7/kernel_lockdown.7 b/man7/kernel_lockdown.7
> index 04de4d1fe..5aedd96e9 100644
> --- a/man7/kernel_lockdown.7
> +++ b/man7/kernel_lockdown.7
> @@ -104,4 +104,17 @@ whether or not they are specified on the command line,
>  for both the built-in and custom policies in secure boot lockdown mode.
>  .SH VERSIONS
>  The Kernel Lockdown feature was added in Linux 5.4.
> +.SH NOTES
> +The Kernel Lockdown feature is enabled by CONFIG_SECURITY_LOCKDOWN_LSM.
> +The
> +.I lsm=lsm1,...,lsmN
> +command line parameter controls the sequence of the initialization of
> +Linux Security Modules.
> +It must contain the string
> +.I lockdown
> +to enable the Kernel Lockdown feature.
> +If the command line parameter is not specified,
> +the initialization falls back to the value of the deprecated
> +.I security=
> +command line parameter and further to the value of CONFIG_LSM.
>  .\" commit 000d388ed3bbed745f366ce71b2bb7c2ee70f449
> --
> 2.28.0
> 


-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/