live_lockdown.cfg

label live-Hidden
	menu label ^Live (Modo Security Persistent)
	menu default
	linux /live/vmlinuz
	initrd /live/initrd.img
	append boot=live username=root ipv6.disable=1 net.ifnames=0 apparmor=1 security=apparmor slab_nomerge slub_debug=FZP mce=0 page_poison=1 pti=on mds=full,nosmt module.sig_enforce=1 audit=1 components union=overlay vsyscall=none init_on_alloc=1 init_on_free=1 l1tf=full,force spectre_v2=on spec_store_bypass_disable=seccomp extra_latent_entropy tsx=off lockdown=confidentiality


label live-encrypted-persistence
    menu label ^Live USB Encrypted Persistence
    linux /live/vmlinuz
    initrd /live/initrd.img
    append boot=live persistent=cryptsetup persistence-encryption=luks username=root ipv6.disable=1 net.ifnames=0 apparmor=1 security=apparmor slab_nomerge slub_debug=FZP mce=0 page_poison=1 pti=on mds=full,nosmt module.sig_enforce=1 audit=1 components union=overlay vsyscall=none init_on_alloc=1 init_on_free=1 l1tf=full,force spectre_v2=on spec_store_bypass_disable=seccomp extra_latent_entropy persistence tsx=off