[PATCH 1/3] kernel: enable CONFIG_SECURITY_LOCKDOWN_LSM