Linux-man Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH 1/1] kernel_lockdown.7: describe LSM activation
@ 2020-10-16 19:03 Heinrich Schuchardt
  2020-10-17 10:25 ` Michael Kerrisk (man-pages)
  0 siblings, 1 reply; 2+ messages in thread
From: Heinrich Schuchardt @ 2020-10-16 19:03 UTC (permalink / raw)
  To: Michael Kerrisk
  Cc: linux-man, Matthew Garrett, Ard Biesheuvel, David Howells,
	Heinrich Schuchardt

Describe the activation of the Kernel Lockdown feature via Kconfig and the
command line.

Cf. Documentation/admin-guide/kernel-parameters.rst.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
---
 man7/kernel_lockdown.7 | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/man7/kernel_lockdown.7 b/man7/kernel_lockdown.7
index 04de4d1fe..5aedd96e9 100644
--- a/man7/kernel_lockdown.7
+++ b/man7/kernel_lockdown.7
@@ -104,4 +104,17 @@ whether or not they are specified on the command line,
 for both the built-in and custom policies in secure boot lockdown mode.
 .SH VERSIONS
 The Kernel Lockdown feature was added in Linux 5.4.
+.SH NOTES
+The Kernel Lockdown feature is enabled by CONFIG_SECURITY_LOCKDOWN_LSM.
+The
+.I lsm=lsm1,...,lsmN
+command line parameter controls the sequence of the initialization of
+Linux Security Modules.
+It must contain the string
+.I lockdown
+to enable the Kernel Lockdown feature.
+If the command line parameter is not specified,
+the initialization falls back to the value of the deprecated
+.I security=
+command line parameter and further to the value of CONFIG_LSM.
 .\" commit 000d388ed3bbed745f366ce71b2bb7c2ee70f449
--
2.28.0


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH 1/1] kernel_lockdown.7: describe LSM activation
  2020-10-16 19:03 [PATCH 1/1] kernel_lockdown.7: describe LSM activation Heinrich Schuchardt
@ 2020-10-17 10:25 ` Michael Kerrisk (man-pages)
  0 siblings, 0 replies; 2+ messages in thread
From: Michael Kerrisk (man-pages) @ 2020-10-17 10:25 UTC (permalink / raw)
  To: Heinrich Schuchardt
  Cc: mtk.manpages, linux-man, Matthew Garrett, Ard Biesheuvel, David Howells

On 10/16/20 9:03 PM, Heinrich Schuchardt wrote:
> Describe the activation of the Kernel Lockdown feature via Kconfig and the
> command line.
> 
> Cf. Documentation/admin-guide/kernel-parameters.rst.
> 
> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>

Thanks, Heinrich. Patch applied.

Cheers,

Michael

> ---
>  man7/kernel_lockdown.7 | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/man7/kernel_lockdown.7 b/man7/kernel_lockdown.7
> index 04de4d1fe..5aedd96e9 100644
> --- a/man7/kernel_lockdown.7
> +++ b/man7/kernel_lockdown.7
> @@ -104,4 +104,17 @@ whether or not they are specified on the command line,
>  for both the built-in and custom policies in secure boot lockdown mode.
>  .SH VERSIONS
>  The Kernel Lockdown feature was added in Linux 5.4.
> +.SH NOTES
> +The Kernel Lockdown feature is enabled by CONFIG_SECURITY_LOCKDOWN_LSM.
> +The
> +.I lsm=lsm1,...,lsmN
> +command line parameter controls the sequence of the initialization of
> +Linux Security Modules.
> +It must contain the string
> +.I lockdown
> +to enable the Kernel Lockdown feature.
> +If the command line parameter is not specified,
> +the initialization falls back to the value of the deprecated
> +.I security=
> +command line parameter and further to the value of CONFIG_LSM.
>  .\" commit 000d388ed3bbed745f366ce71b2bb7c2ee70f449
> --
> 2.28.0
> 


-- 
Michael Kerrisk
Linux man-pages maintainer; http://www.kernel.org/doc/man-pages/
Linux/UNIX System Programming Training: http://man7.org/training/

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-16 19:03 [PATCH 1/1] kernel_lockdown.7: describe LSM activation Heinrich Schuchardt
2020-10-17 10:25 ` Michael Kerrisk (man-pages)

Linux-man Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-man/0 linux-man/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-man linux-man/ https://lore.kernel.org/linux-man \
		linux-man@vger.kernel.org
	public-inbox-index linux-man

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-man


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git