UBUNTU: [Config] Disable CONFIG_MANDATORY_FILE_LOCKING

Upstream is trying to remove this feature. It appears to be unused and
causes maintenance burdens. Disable in common config and enforce in
policy.

BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1940392
Signed-off-by: Kees Cook <kees@ubuntu.com>
Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>

diff --git a/debian.master/config/annotations b/debian.master/config/annotations
index 69fd9f73820c4c8e5676f424d38179737e5dc394..d40fed206ff9c9ba3f9258695383a23aa3e7f829 100644 (file)
--- a/debian.master/config/annotations
+++ b/debian.master/config/annotations
@@ -10647,7 +10647,7 @@ CONFIG_ZONEFS_FS                                policy<{'amd64': 'm', 'arm64': '
 CONFIG_FS_DAX                                   policy<{'amd64': 'y', 'arm64': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_EXPORTFS_BLOCK_OPS                       policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_FILE_LOCKING                             policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
-CONFIG_MANDATORY_FILE_LOCKING                   policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
+CONFIG_MANDATORY_FILE_LOCKING                   policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 's390x': 'n'}>
 CONFIG_FS_ENCRYPTION                            policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_FS_ENCRYPTION_INLINE_CRYPT               policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_FS_VERITY                                policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>

diff --git a/debian.master/config/config.common.ubuntu b/debian.master/config/config.common.ubuntu
index 5e4a2c4828e2528a3b4c72b384cf5cee48e38abf..807801ef6d22e25d37ae281b6cc2cf61fc6de35d 100644 (file)
--- a/debian.master/config/config.common.ubuntu
+++ b/debian.master/config/config.common.ubuntu
@@ -5819,7 +5819,7 @@ CONFIG_MAGIC_SYSRQ_SERIAL=y
 CONFIG_MAGIC_SYSRQ_SERIAL_SEQUENCE=""
 CONFIG_MAILBOX_TEST=m
 CONFIG_MANAGER_SBS=m
-CONFIG_MANDATORY_FILE_LOCKING=y
+# CONFIG_MANDATORY_FILE_LOCKING is not set
 CONFIG_MANTIS_CORE=m
 CONFIG_MAPPING_DIRTY_HELPERS=y
 # CONFIG_MARCH_Z10 is not set