From aca1c25ebf2c3161429c0117c493b353ba3ac426 Mon Sep 17 00:00:00 2001
From: Jeremy Cline <jcline@redhat.com>
Date: Mar 20 2020 21:56:53 +0000
Subject: Switch Secure Boot to lock down in integrity mode (rhbz 1815571)


---

diff --git a/efi-secureboot.patch b/efi-secureboot.patch
index 326c73a..90ac9fe 100644
--- a/efi-secureboot.patch
+++ b/efi-secureboot.patch
@@ -303,7 +303,7 @@ index 1797623b0c3a..fa8ac411bf6e 100644
 +
 +#ifdef CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT
 +	if (efi_enabled(EFI_SECURE_BOOT))
-+		security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_CONFIDENTIALITY_MAX);
++		security_lock_kernel_down("EFI Secure Boot mode", LOCKDOWN_INTEGRITY_MAX);
 +#endif
 +
  	dmi_setup();
diff --git a/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch b/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch
index 0779418..70e3f76 100644
--- a/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch
+++ b/s390-Lock-down-the-kernel-when-the-IPL-secure-flag-i.patch
@@ -3,7 +3,7 @@ From: Jeremy Cline <jcline@redhat.com>
 Date: Wed, 30 Oct 2019 14:37:49 +0000
 Subject: [PATCH] s390: Lock down the kernel when the IPL secure flag is set
 
-Automatically lock down the kernel to LOCKDOWN_CONFIDENTIALITY_MAX if
+Automatically lock down the kernel to LOCKDOWN_INTEGRITY_MAX if
 the IPL secure flag is set.
 
 Suggested-by: Philipp Rudo <prudo@redhat.com>
@@ -56,7 +56,7 @@ index 9cbf490fd162..0510ecdfc3f6 100644
  	log_component_list();
  
 +	if (ipl_get_secureboot())
-+		security_lock_kernel_down("Secure IPL mode", LOCKDOWN_CONFIDENTIALITY_MAX);
++		security_lock_kernel_down("Secure IPL mode", LOCKDOWN_INTEGRITY_MAX);
 +
  	/* Have one command line that is parsed and saved in /proc/cmdline */
  	/* boot_command_line has been already set up in early.c */