[PATCH 5/5] host/rootfs: enable IPE in the host kernel

[colbyt <colby@colbyt.com>]

Enable the IPE LSM in the host kernel used by the Spectrum rootfs,
including the QEMU host-rootfs run path.

The generated kernel config already enables audit, audit syscall support,
securityfs, and an LSM order containing ipe. Enabling SECURITY_IPE also
selects the dm-verity root-hash provider for the host rootfs.

This only enables kernel support. It does not install an IPE policy.

Signed-off-by: colbyt <colby@colbyt.com>
---
 host/rootfs/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix
index 6bfeefb..79baea4 100644
--- a/host/rootfs/default.nix
+++ b/host/rootfs/default.nix
@@ -51,7 +51,11 @@ let
     system.stateVersion = trivial.release;
   });
 
-  kernel = linux_latest;
+  kernel = linux_latest.override {
+    structuredExtraConfig = with lib.kernel; {
+      SECURITY_IPE = yes;
+    };
+  };
 
   appvm = callSpectrumPackage ../../img/app { inherit (foot) terminfo; };
   netvm = callSpectrumPackage ../../vm/sys/net { inherit (foot) terminfo; };
-- 
2.54.0