From aca1c25ebf2c3161429c0117c493b353ba3ac426 Mon Sep 17 00:00:00 2001
From: Jeremy Cline <jcline@redhat.com>
Date: Fri, 20 Mar 2020 17:56:53 -0400
Subject: Switch Secure Boot to lock down in integrity mode (rhbz 1815571)

---
 efi-secureboot.patch | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'efi-secureboot.patch')

diff --git a/efi-secureboot.patch b/efi-secureboot.patch
index 326c73a0f..90ac9feca 100644
--- a/efi-secureboot.patch
+++ b/efi-secureboot.patch
@@ -303,7 +303,7 @@ index 1797623b0c3a..fa8ac411bf6e 100644
 +
 +#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT
 +	if (efi_enabled(EFI_SECURE_BOOT))
-+		security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_CONFIDENTIALITY_MAX);
++		security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX);
 +#endif
 +
  	dmi_setup();
-- 
cgit