Linus Torvalds Hasn't Yet Decided On "LOCKDOWN" Functionality For Linux 5.4

[phoronix]

Phoronix: Linus Torvalds Hasn't Yet Decided On "LOCKDOWN" Functionality For Linux 5.4

The Linux 5.4 kernel merge window is set to close this weekend and as of writing it's still yet to be decided by Linus Torvalds whether to accept the kernel "lockdown" functionality feature for this release...

http://www.phoronix.com/scan.php?page=news_item&px=Linux-5.4-Lockdown-Undecided

[tildearrow]

Typo:

Among the limitations enforced in this lock-down mode is preventing hiberation support

[tildearrow]

Particularly for security conscious users and for applications like UEFI SecureBoot

Particularly for companies to make it easier to lock down their devices.

[starshipeleven]

Particularly for companies to make it easier to lock down their devices.

Commenting out stuff in their own kernel fork is just as fast, and does not require Torvald's permission, drop this bs already.

[chithanh]

As evidenced by the number of iterations that this has had to go through, kernel lockdown isn't all that trivial to implement correctly without breaking other things. Few companies would have the expertise and resources to maintain such a patchset and port it across kernel versions.

Now it becomes just the flip of a kernel config option. That is a godsend for every company who sells locked down devices.

[boxie]

Particularly for companies to make it easier to lock down their devices.

As someone who works for a company that uses android set top boxes, being able to lock them down to stop tampering is a good thing for us. things includes HDCP support and all the other things that we need to do to support playing back DRM content.

Note that these are not devices consumers purchase.

There are very legitimate use cases for this sort of thing outside of the "everything must be free" mantra.

[starshipeleven]

As evidenced by the number of iterations that this has had to go through, kernel lockdown isn't all that trivial to implement correctly without breaking other things. Few companies would have the expertise and resources to maintain such a patchset and port it across kernel versions.

Lol, "patchset", "maintain" and "port across kernel versions", very funny.

None does anything of that in embedded. They get the SDK with the kernel and a basic OS and hack that to their liking. No updates, no nothing.

This lockdown feature is for distribution maintainers for distros that will run on X86 and UEFI ARM servers, and maybe other few kinds of embedded devices that are close enough to that usecase and are frequently updated for some reason.

As you said, this functionality makes sense only if you need to update and maintain the stuff and can't just hack out what they don't like easily.

[brent]

Fedora has been shipping lockdown support for quite a while. No issues. Just get this merged already...

[Michael]

Landed: https://www.phoronix.com/scan.php?pa...-Adds-Lockdown

[tildearrow]

As someone who works for a company that uses android set top boxes, being able to lock them down to stop tampering is a good thing for us. things includes HDCP support and all the other things that we need to do to support playing back DRM content.

Note that these are not devices consumers purchase.

There are very legitimate use cases for this sort of thing outside of the "everything must be free" mantra.

I wish HDCP didn't exist at all... If it has been already broken, then what's the point?