CONFIG_EFI_SECURE_BOOT_LOCK_DOWN=y