···462462 SECURITY_SELINUX_BOOTPARAM_VALUE = whenOlder "5.1" (freeform "0"); # Disable SELinux by default
463463 # Prevent processes from ptracing non-children processes
464464 SECURITY_YAMA = option yes;
465465+ # The goal of Landlock is to enable to restrict ambient rights (e.g. global filesystem access) for a set of processes.
466466+ # This does not have any effect if a program does not support it
467467+ SECURITY_LANDLOCK = whenAtLeast "5.13" yes;
465468 DEVKMEM = whenOlder "5.13" no; # Disable /dev/kmem
466469467470 USER_NS = yes; # Support for user namespaces