[PATCH v1 1/1] UBUNTU: [Config] Enable Landlock by default

[Mickaël Salaün]

BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1953192

Landlock is a feature to create security sandboxes thanks to 3 new
dedicated system calls.  They are designed to be safe to used by any
processes, which can only drop their privileges, similarly to seccomp.

The new Landlock LSM is build in the kernel (CONFIG_SECURITY_LANDLOCK=y)
but it is not enough to make it usable by default.  As a stackable LSM,
it is required to enable it at boot time, either with the "lsm=" boot
argument, or with the CONFIG_LSM list (as described in the kernel
documentation).

As for other stackable LSMs, prepending Landlock to the default LSM list
enables users to potentially get more protection by default by letting
applications sandbox themselves.

Signed-off-by: Mickaël Salaün <mic at digikod.net>
Link: https://lore.kernel.org/r/20211203185226.1957311-2-mic@digikod.net
---
 debian.master/config/config.common.ubuntu | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/debian.master/config/config.common.ubuntu b/debian.master/config/config.common.ubuntu
index 912871ce8fde..0e26e7846024 100644
--- a/debian.master/config/config.common.ubuntu
+++ b/debian.master/config/config.common.ubuntu
@@ -5702,7 +5702,7 @@ CONFIG_LPARCFG=y
 # CONFIG_LP_CONSOLE is not set
 CONFIG_LRU_CACHE=m
 CONFIG_LSI_ET1011C_PHY=m
-CONFIG_LSM="lockdown,yama,integrity,apparmor"
+CONFIG_LSM="landlock,lockdown,yama,integrity,apparmor"
 CONFIG_LSM_MMAP_MIN_ADDR=0
 CONFIG_LS_EXTIRQ=y
 CONFIG_LS_SCFG_MSI=y
-- 
2.33.1