Linux "Lockdown" Patches Hit Their 40th Revision

The long-running Linux "Lockdown" patches were sent out again overnight for their 40th time but it remains to be seen if these security-oriented patches will be pulled in for the upcoming Linux 5.4 cycle.

The Linux Lockdown functionality is for restricting access to the kernel and underlying hardware by blocking writes to /dev/mem, restricting PCI BAR and CPU MSR access, disabling system hibernation support, limiting Tracefs, and restricting or outright disabling other functionality that could alter the hardware state or running Linux kernel image.

Linux Lockdown has been opt-in only and designed for use-cases like honoring UEFI SecureBoot for ensuring nothing nefarious could happen once booted into the operating system by bad actors. Most end-users won't voluntarily want the lockdown mode due to all the restrictions in place, but could be a favor for enterprises and very security conscious users.

Linux Lockdown V40 doesn't have any functional changes but just fixes merged in around a kernel oops in Tracefs and build failures in some kernel configurations.

The V40 patches can be found on the kernel mailing list while waiting to see if this Lockdown Linux security module will finally make it for the upcoming 5.4 kernel merge window, which should be opening around mid-September.