Ok I'll enable it in the configs. The grsec_lock has to be scripted/done manually by the user, it's not provided out of the box.