pyllyukko / kspp_confnbuild Goto Github PK

The gradm match allows to match on grsecurity RBAC being enabled.
It is useful when iptables rules are applied early on bootup to
prevent connections to the machine (except from a trusted host)
while the RBAC system is disabled.

lockdown=       [SECURITY]
                { integrity | confidentiality }
                Enable the kernel lockdown feature. If set to
                integrity, kernel features that allow userland to
                modify the running kernel are disabled. If set to
                confidentiality, kernel features that allow userland
                to extract confidential information from the kernel
                are also disabled.