The lockdown LSM exposes /sys/kernel/security/lockdown, but it does not
select SECURITYFS. If SECURITYFS is disabled, securityfs_create_file()
returns -ENODEV, lockdown_secfs_init() fails and the LSM framework logs:
failed LSM lockdown core initcall with errno -19
while the sysfs interface advertised by the Kconfig help text is missing.
Select SECURITYFS like the other LSMs that create securityfs entries
(AppArmor, SafeSetID, TOMOYO and IMA) already do.
Signed-off-by: Cai Xinchen <redacted>
---
security/lockdown/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig
index e84ddf484010..82b69d8253bd 100644
--- a/security/lockdown/Kconfig
+++ b/security/lockdown/Kconfig
@@ -2,6 +2,7 @@ config SECURITY_LOCKDOWN_LSM
bool "Basic module for enforcing kernel lockdown"
depends on SECURITY
select MODULE_SIG if MODULES
+ select SECURITYFS
help
Build support for an LSM that enforces a coarse kernel lockdown
behaviour.
--
2.18.0.huawei.25