The lockdown LSM exposes /sys/kernel/security/lockdown, but it does not select SECURITYFS. If SECURITYFS is disabled, securityfs_create_file() returns -ENODEV, lockdown_secfs_init() fails and the LSM framework logs: failed LSM lockdown core initcall with errno -19 while the sysfs interface advertised by the Kconfig help text is missing. Select SECURITYFS like the other LSMs that create securityfs entries (AppArmor, SafeSetID, TOMOYO and IMA) already do. Signed-off-by: Cai Xinchen --- security/lockdown/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/security/lockdown/Kconfig b/security/lockdown/Kconfig index e84ddf484010..82b69d8253bd 100644 --- a/security/lockdown/Kconfig +++ b/security/lockdown/Kconfig @@ -2,6 +2,7 @@ config SECURITY_LOCKDOWN_LSM bool "Basic module for enforcing kernel lockdown" depends on SECURITY select MODULE_SIG if MODULES + select SECURITYFS help Build support for an LSM that enforces a coarse kernel lockdown behaviour. -- 2.18.0.huawei.25