[PATCH 4/5] vm: enable IPE in sub-VM kernels

[colbyt <colby@colbyt.com>]

Enable the IPE LSM in the app VM and net VM kernels.

The generated kernel config already enables audit, audit syscall support,
securityfs, and an LSM order containing ipe. Enabling SECURITY_IPE also
selects the dm-verity root-hash provider, which lets later policy work
match files that come from the verified root.

This does not install an IPE policy yet.

Signed-off-by: colbyt <colby@colbyt.com>
---
 img/app/default.nix    | 1 +
 vm/sys/net/default.nix | 1 +
 2 files changed, 2 insertions(+)

diff --git a/img/app/default.nix b/img/app/default.nix
index 23487e3..8496755 100644
--- a/img/app/default.nix
+++ b/img/app/default.nix
@@ -33,6 +33,7 @@ let
       FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = lib.mkForce unset;
       FRAMEBUFFER_CONSOLE_DETECT_PRIMARY = lib.mkForce unset;
       FRAMEBUFFER_CONSOLE_ROTATION = lib.mkForce unset;
+      SECURITY_IPE = yes;
       RC_CORE = lib.mkForce unset;
       VIRTIO = yes;
       VIRTIO_BLK = yes;
diff --git a/vm/sys/net/default.nix b/vm/sys/net/default.nix
index 7f077a9..2f7e31d 100644
--- a/vm/sys/net/default.nix
+++ b/vm/sys/net/default.nix
@@ -39,6 +39,7 @@ let
       FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = lib.mkForce unset;
       FRAMEBUFFER_CONSOLE_DETECT_PRIMARY = lib.mkForce unset;
       FRAMEBUFFER_CONSOLE_ROTATION = lib.mkForce unset;
+      SECURITY_IPE = yes;
       RC_CORE = lib.mkForce unset;
       VIRTIO = yes;
       VIRTIO_BLK = yes;
-- 
2.54.0