How paulinotech1/lock_down works
Lock_Down is a hardware-specific set of Linux kernel configurations, host-security controls, and operating procedures for turning a stock Ubuntu installation on one ThinkPad model into a hardened workstation. The intended outcome is a bootable, recoverable system for daily desktop use, with network, authentication, power, and VM controls. The README documents these capabilities, but no source excerpts were provided, so implementation-level calls and several operational links are omitted.
Main entry points: KDE.md KDE workstation · build-kernel.sh Kernel build · config Kernel profiles · SECURE_BOOT.md Secure Boot
Components 20
Kernel and boot
- Kernel profiles
config - Kernel build
scripts/build-kernel.sh - Secure Boot
docs/SECURE_BOOT.md - Rescue kernel
docs/RECOVERY.md
Host hardening
- AppArmor policy
apparmor - Kernel sysctls
sysctl/99-workstation-hardening.conf - nftables firewall
nftables/workstation.nft - USB policy
usbguard/rules.conf - Security checks
scripts/preflight-security.sh
Storage and identity
- LUKS2 storage
docs/STORAGE_SECURITY.md - TPM2 and PIN
docs/TPM.md - YubiKey PAM
docs/YUBIKEY_PAM.md - Recovery credential
docs/RECOVERY.md
Workstation use
- KDE workstation
docs/KDE.md - Power policy
power - VM profiles
vm-profiles - KVM and libvirt
docs/KVM_SECURITY.md - Verified hardware
docs/HARDWARE.md
Other components
- System owner
- Ubuntu LTS
Connections 16
- System owner → Ubuntu LTS: starts with
- Kernel profiles → Kernel build: configures
- Ubuntu LTS → Kernel build: builds for
- Kernel build → Secure Boot: signs for boot
- Secure Boot → Rescue kernel: retains fallback
- TPM2 and PIN → LUKS2 storage: unlocks with PIN
- Recovery credential → LUKS2 storage: recovers access
- AppArmor policy → KDE workstation: confines processes
- Kernel sysctls → KDE workstation: hardens host
- nftables firewall → KDE workstation: filters traffic
- USB policy → KDE workstation: restricts devices
- YubiKey PAM → KDE workstation: authenticates users
- VM profiles → KVM and libvirt: profiles guests
- Power policy → KDE workstation: sets power policy
- Verified hardware → Kernel profiles: guides tailoring
- System owner → Security checks: runs checks