0001 # This is the equivalent of booting with lockdown=integrity
0002 CONFIG_SECURITY=y
0003 CONFIG_SECURITYFS=y
0004 CONFIG_SECURITY_LOCKDOWN_LSM=y
0005 CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
0006 CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY=y
0007
0008 # These are some general, reasonably inexpensive hardening options
0009 CONFIG_HARDENED_USERCOPY=y
0010 CONFIG_FORTIFY_SOURCE=y
0011 CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
0012
0013 # UBSAN bounds checking is very cheap and good for hardening
0014 CONFIG_UBSAN=y
0015 # CONFIG_UBSAN_MISC is not set
