[PATCH] powerpc: add security.config, enforcing lockdown=integrity

[PATCH] powerpc: add security.config, enforcing lockdown=integrity

[Daniel Axtens]

It's sometimes handy to have a config that boots a bit like a system
under secure boot (forcing lockdown=integrity, without needing any
extra stuff like a command line option).

This config file allows that, and also turns on a few assorted security
and hardening options for good measure.

Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Daniel Axtens <dja@axtens.net>
---
 arch/powerpc/configs/security.config | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 arch/powerpc/configs/security.config

diff --git a/arch/powerpc/configs/security.config b/arch/powerpc/configs/security.config
new file mode 100644
index 000000000000..1c91a35c6a73
--- /dev/null
+++ b/arch/powerpc/configs/security.config
@@ -0,0 +1,15 @@
+# This is the equivalent of booting with lockdown=integrity
+CONFIG_SECURITY=y
+CONFIG_SECURITYFS=y
+CONFIG_SECURITY_LOCKDOWN_LSM=y
+CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
+CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y
+
+# These are some general, reasonably inexpensive hardening options
+CONFIG_HARDENED_USERCOPY=y
+CONFIG_FORTIFY_SOURCE=y
+CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
+
+# UBSAN bounds checking is very cheap and good for hardening
+CONFIG_UBSAN=y
+# CONFIG_UBSAN_MISC is not set
\ No newline at end of file
-- 
2.25.1

Re: [PATCH] powerpc: add security.config, enforcing lockdown=integrity

[Michael Ellerman]

On Thu, 3 Dec 2020 15:28:07 +1100, Daniel Axtens wrote:
> It's sometimes handy to have a config that boots a bit like a system
> under secure boot (forcing lockdown=integrity, without needing any
> extra stuff like a command line option).
> 
> This config file allows that, and also turns on a few assorted security
> and hardening options for good measure.

Applied to powerpc/next.

[1/1] powerpc: add security.config, enforcing lockdown=integrity
      https://git.kernel.org/powerpc/c/ed2bbd2b8581313ca18a7c586a947f6cdd93a52a

cheers