Linux 5.4 Pulls In LOCKDOWN Support For Opt-In Hardware/Kernel Security Restrictions

While yesterday Linus Torvalds was still undecided on whether to pull in the long-revised "LOCKDOWN" kernel patches and wanted to review them patch-by-patch, following that lengthy examination he has decided to indeed land this opt-in restricted functionality for Linux 5.4.

The Linux LOCKDOWN patches have been found in various distribution kernels for years and for the mainline process went through dozens of rounds of review to address various issues and ensure all bases are covered for tightening up the kernel's interaction with the system hardware when desired as well as ensuring the running kernel image cannot be manipulated.

When enabled, the Linux LOCKDOWN mode prevents the system from hibernating as one example of a user-facing restriction as well as blocking writes to /dev/mem even as root, blocking kernel module parameters that touch hardware bits, restricting CPU MSR access, and a variety of other restrictions in the name of tightening up security. Most use-cases for Linux Lockdown functionality is for pairing with UEFI SecureBoot or other security sensitive environments.

The now-merged lockdown functionality doesn't place any restrictions by default. The support can be activated with the lockdown= kernel parameter. Setting lockdown=integrity will block kernel features that allow user-space to modify the running kernel. Setting lockdown=confidentiality will block user-space from extracting "confidential information" from the running kernel, further restrictions on top of the integrity mode. All of the bits are controlled via the Kconfig SECURITY_LOCKDOWN_LSM option for enabling this Linux security module. Via SECURITY_LOCKDOWN_LSM_EARLY is also the ability to permanently force the integrity/confidentiality lockdown modes if desired.

The support made it in time for the Linux 5.4-rc1 release expected on Sunday that will mark the closure of the feature merge window for this last stable kernel release of 2019.