From: Ondrej Mosnacek <omosnace(a)redhat.com>
configs: clean up LSM configs
1. Set CONFIG_SECURITY_LOCKDOWN_LSM=y on both Fedora and ARK. Both now
use this as the basis of the UEFI secure boot implementation.
2. Remove ark/generic/CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE - this
config has been removed upstream.
3. Deduplicate default value of CONFIG_LSM_MMAP_MIN_ADDR - set it to
65536 under common/ and only override it in
fedora/generic/arm/armv7/.
4. Trim LSMs that are not build-enabled from CONFIG_LSM on Fedora/ARK,
which can now be unified under common/.
Note that this commit adds the Lockdown LSM to the default LSM list and
therefore effectively enables it on both Fedora (where it was enabled in
build, but disabled on boot) and ARK (where it wasn't even enabled at
build). According to Peter Robinson and Al Stone it should be enabled,
so hopefully this is the expected result.
Signed-off-by: Ondrej Mosnacek <omosnace(a)redhat.com>
diff a/redhat/configs/ark/generic/CONFIG_LSM b/redhat/configs/ark/generic/CONFIG_LSM
--- a/redhat/configs/ark/generic/CONFIG_LSM
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_LSM="yama,integrity,selinux"
diff a/redhat/configs/ark/generic/CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE
b/redhat/configs/ark/generic/CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE
--- a/redhat/configs/ark/generic/CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=1
diff a/redhat/configs/common/generic/CONFIG_LSM
b/redhat/configs/common/generic/CONFIG_LSM
--- /dev/null
+++ b/redhat/configs/common/generic/CONFIG_LSM
@@ -0,0 +1 @@
+CONFIG_LSM="lockdown,yama,integrity,selinux"
diff a/redhat/configs/ark/generic/CONFIG_LSM_MMAP_MIN_ADDR
b/redhat/configs/common/generic/CONFIG_LSM_MMAP_MIN_ADDR
--- a/redhat/configs/ark/generic/CONFIG_LSM_MMAP_MIN_ADDR
+++ b/redhat/configs/common/generic/CONFIG_LSM_MMAP_MIN_ADDR
diff a/redhat/configs/fedora/generic/CONFIG_SECURITY_LOCKDOWN_LSM
b/redhat/configs/common/generic/CONFIG_SECURITY_LOCKDOWN_LSM
--- a/redhat/configs/fedora/generic/CONFIG_SECURITY_LOCKDOWN_LSM
+++ b/redhat/configs/common/generic/CONFIG_SECURITY_LOCKDOWN_LSM
diff a/redhat/configs/fedora/generic/CONFIG_SECURITY_LOCKDOWN_LSM_EARLY
b/redhat/configs/common/generic/CONFIG_SECURITY_LOCKDOWN_LSM_EARLY
--- a/redhat/configs/fedora/generic/CONFIG_SECURITY_LOCKDOWN_LSM_EARLY
+++ b/redhat/configs/common/generic/CONFIG_SECURITY_LOCKDOWN_LSM_EARLY
diff a/redhat/configs/fedora/generic/CONFIG_LSM
b/redhat/configs/fedora/generic/CONFIG_LSM
--- a/redhat/configs/fedora/generic/CONFIG_LSM
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_LSM="yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor"
diff a/redhat/configs/fedora/generic/CONFIG_LSM_MMAP_MIN_ADDR
b/redhat/configs/fedora/generic/CONFIG_LSM_MMAP_MIN_ADDR
--- a/redhat/configs/fedora/generic/CONFIG_LSM_MMAP_MIN_ADDR
+++ /dev/null
@@ -1 +0,0 @@
-CONFIG_LSM_MMAP_MIN_ADDR=65536
diff a/redhat/configs/pending-common/generic/CONFIG_SECURITY_LOCKDOWN_LSM
b/redhat/configs/pending-common/generic/CONFIG_SECURITY_LOCKDOWN_LSM
--- a/redhat/configs/pending-common/generic/CONFIG_SECURITY_LOCKDOWN_LSM
+++ /dev/null
@@ -1 +0,0 @@
-# CONFIG_SECURITY_LOCKDOWN_LSM is not set
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/922